\n \n \n \n\n",[],[78,145],"dcdea6f9-7810-432f-9ba2-4cc857d89a29","favicon.svg","019f4d88-ebd3-7218-9092-072314b1de7e",["D",1783712246617],"\n",[],[78,154],"ae887443-2e14-4b3e-9163-23d32458cece","components","019f4d88-ebd3-7218-9092-021606bdd3ce",["D",1783712246617],[166,167,168,169,170],[78,161],{"_36":204,"_13":205,"_63":206,"_71":162,"_61":62,"_74":207,"_88":89,"_38":208,"_17":70,"_68":69,"_66":209,"_94":51,"_76":-5,"_95":210,"_18":211},{"_36":195,"_13":196,"_63":197,"_71":162,"_61":62,"_74":198,"_88":89,"_38":199,"_17":200,"_68":69,"_66":201,"_94":51,"_76":-5,"_95":202,"_18":203},{"_36":187,"_13":188,"_63":189,"_71":162,"_61":62,"_74":190,"_88":89,"_38":191,"_17":34,"_68":69,"_66":192,"_94":51,"_76":-5,"_95":193,"_18":194},{"_36":179,"_13":180,"_63":181,"_71":162,"_61":62,"_74":182,"_88":89,"_38":183,"_17":149,"_68":69,"_66":184,"_94":51,"_76":-5,"_95":185,"_18":186},{"_36":171,"_13":172,"_63":173,"_71":162,"_61":62,"_74":174,"_88":89,"_38":175,"_17":70,"_68":69,"_66":176,"_94":51,"_76":-5,"_95":177,"_18":178},"e713b025-42df-4644-bf15-106a09f04cb3","StatsPanel.tsx","c5575790-af80-11f1-84d6-1607ee4eb77e",111,["D",1789310302348],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\n\ninterface HitStats {\n total: number;\n totalPublic: number;\n totalStaff: number;\n last7: number;\n last30: number;\n today: number;\n byDay: { day: string; total: number; public: number; staff: number }[];\n}\n\nexport function StatsPanel({ token, onClose }: { token: string; onClose: () => void }) {\n const [stats, setStats] = useState(null);\n const [error, setError] = useState(\"\");\n\n useEffect(() => {\n fetch(\"/api/stats\", { headers: { authorization: `Bearer ${token}` } })\n .then(async (r) => {\n if (!r.ok) throw new Error(`Failed to load (${r.status})`);\n setStats(await r.json());\n })\n .catch((e) => setError(e.message));\n }, [token]);\n\n return (\n

Site activity

\n \n

\n\n {error &&

{error}

}\n {!stats && !error &&

Loading…

}\n\n {stats && (\n <>\n

\n \n \n \n \n \n

\n\n

\n \n \n \n \n \n \n \n \n \n \n {stats.byDay.map((d) => (\n \n \n \n \n \n \n ))}\n {stats.byDay.length === 0 && (\n \n )}\n \n

Day	Total views	Public	Staff
{d.day}	{d.total}	{d.public}	{d.staff}
No views recorded yet.

\n A \"view\" is counted each time the directory is loaded. Staff views are counted separately when signed in.\n

\n \n )}\n

\n );\n}\n\nfunction Stat({ label, value }: { label: string; value: number }) {\n return (\n

{value}

{label}

\n );\n}\n",[],[78,161,172],"ca8ee66c-07d8-42ed-8f35-ac002716acac","ListingsTable.tsx","ded182a2-7c97-11f1-8c37-1607ee4eb77e",87,["D",1789301792441],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport type { Listing } from \"../types.ts\";\nimport { locationList } from \"../types.ts\";\n\ntype SortKey = \"created_at\" | \"name\" | \"type\" | \"location\";\n\nfunction telHref(phone: string): string | null {\n const match = phone.match(/\$?\\d{3}\$?[-.\\s]?\\d{3}[-.\\s]?\\d{4}/);\n return match ? `tel:${match[0].replace(/\\D/g, \"\")}` : null;\n}\n\nfunction WebsiteCell({ listing }: { listing: Listing }) {\n if (listing.website) {\n const label = new URL(listing.website.startsWith(\"http\") ? listing.website : `https://${listing.website}`).hostname;\n return (\n \n {label}\n \n );\n }\n return null;\n}\n\nfunction SortHeader({\n label,\n sortKey,\n activeKey,\n sortDir,\n onSort,\n}: {\n label: string;\n sortKey: SortKey;\n activeKey: SortKey;\n sortDir: \"asc\" | \"desc\";\n onSort: (key: SortKey) => void;\n}) {\n const active = sortKey === activeKey;\n return (\n onSort(activeKey)}\n >\n {label}\n {active && {sortDir === \"asc\" ? \"↑\" : \"↓\"}}\n \n );\n}\n\ninterface Props {\n listings: Listing[];\n canEdit: boolean;\n isStaff: boolean;\n sortKey: SortKey;\n sortDir: \"asc\" | \"desc\";\n onSort: (key: SortKey) => void;\n onEdit?: (l: Listing) => void;\n onDelete?: (l: Listing) => void;\n onMarkVerified?: (l: Listing) => void;\n onFlagUnsuitable?: (l: Listing) => void;\n}\n\nexport function ListingsTable({\n listings,\n canEdit,\n isStaff,\n sortKey,\n sortDir,\n onSort,\n onEdit,\n onDelete,\n onMarkVerified,\n onFlagUnsuitable,\n}: Props) {\n return (\n \n \n \n \n \n \n \n \n \n \n {isStaff && }\n \n {canEdit && }\n \n \n \n {listings.map((l) => {\n const staffBits = [\n l.staff_notes && `Staff notes: ${l.staff_notes}`,\n l.unsuitable_notes && `⚠ Unsuitable: ${l.unsuitable_notes}`,\n (l.date_validated || l.validated_by) &&\n `Validated ${l.date_validated || \"?\"}${l.validated_by ? ` by ${l.validated_by}` : \"\"}`,\n ].filter(Boolean) as string[];\n return (\n \n \n \n \n \n \n \n \n {isStaff && (\n \n )}\n \n {canEdit && (\n \n )}\n \n );\n })}\n \n

Phone	Contact name	Website	Notes	Staff-only info	Actions
\n {l.name \|\| (no name)}\n	{l.type}	{locationList(l.location).join(\", \")}	\n {telHref(l.phone)\n ? {l.phone}\n : l.phone}\n	{l.contact_name}	\n \n	{l.notes}	\n {staffBits.length\n ? staffBits.map((b, i) => {b} )\n : —}\n	{l.created_at}	\n {onMarkVerified && (\n \n )}\n {onEdit && (\n \n )}\n {onFlagUnsuitable && (\n \n )}\n {onDelete && (\n \n )}\n

\n );\n}",[],[78,161,180],"9bffb1d0-e26b-4d27-bdde-215d4a7da5b9","ListingForm.tsx","e7ba4d72-7c97-11f1-9fef-1607ee4eb77e",86,["D",1789301635801],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\nimport { AREAS, LISTING_TYPES, locationList, type ListingInput } from \"../types.ts\";\n\ninterface Props {\n initial: ListingInput;\n title: string;\n onSave: (input: ListingInput) => Promise;\n onCancel: () => void;\n}\n\nconst inputClass = \"border border-gray-300 rounded px-2 py-1 w-full\";\n\nexport function ListingForm({ initial, title, onSave, onCancel }: Props) {\n const [form, setForm] = useState(initial);\n const [saving, setSaving] = useState(false);\n const [error, setError] = useState(\"\");\n\n const field = (label: string, key: keyof ListingInput, placeholder = \"\", type = \"text\") => (\n \n {label}\n setForm({ ...form, [key]: e.target.value })}\n />\n \n );\n\n const textarea = (label: string, key: keyof ListingInput, staffOnly = false) => (\n \n \n {label}{staffOnly && \" (staff only)\"}\n \n setForm({ ...form, [key]: e.target.value })}\n />\n \n );\n\n const selectedAreas = locationList(form.location);\n\n const toggleArea = (a: string) => {\n const next = selectedAreas.includes(a)\n ? selectedAreas.filter((x) => x !== a)\n : [...selectedAreas, a];\n setForm({ ...form, location: next.join(\", \") });\n };\n\n return (\n {\n e.preventDefault();\n setError(\"\");\n setSaving(true);\n try {\n await onSave(form);\n } finally {\n setSaving(false);\n }\n }}\n >\n

{title}

\n \n Type\n setForm({ ...form, type: e.target.value })}\n >\n \n {LISTING_TYPES.map((t) => )}\n \n \n {field(\"Name (rental, agency, or landlord)\", \"name\")}\n {field(\"Phone\", \"phone\")}\n\n {field(\"Website URL\", \"website\", \"https://…\")}\n {field(\"Contact name\", \"contact_name\")}\n\n

\n Location (choose any, or none)\n

\n {AREAS.map((a) => (\n \n toggleArea(a)}\n />\n {a}\n \n ))}\n

\n\n {textarea(\"Notes\", \"notes\")}\n\n

\n Staff-only — hidden from the public site\n

\n {textarea(\"Staff notes\", \"staff_notes\", true)}\n {textarea(\"Unsuitable notes\", \"unsuitable_notes\", true)}\n {field(\"Date validated\", \"date_validated\", \"e.g. 9/13/2026\")}\n {field(\"Validated by (staff name)\", \"validated_by\")}\n

\n {error &&

{error}

}\n

\n \n {saving ? \"Saving…\" : \"Save\"}\n \n \n

\n \n );\n}",[],[78,161,188],"a9fed38c-66d9-47eb-b622-85daf04cbd25","App.tsx","019f4d88-ebd3-7218-9091-fa024ee09187",128,["D",1789318325275],41,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useMemo, useState } from \"https://esm.sh/react@18.2.0\";\nimport { emptyListing, AREAS, HOUSING_TYPES, locationList, type DiscoveredListing, type Listing, type ListingInput, type StaffUser } from \"../types.ts\";\nimport { ListingForm } from \"./ListingForm.tsx\";\nimport { ListingsTable } from \"./ListingsTable.tsx\";\nimport { AdminUsers } from \"./AdminUsers.tsx\";\nimport { StatsPanel } from \"./StatsPanel.tsx\";\n\nconst RANK: Record = { viewer: 1, editor: 2, admin: 3 };\n\nexport function App() {\n const [listings, setListings] = useState([]);\n const [loading, setLoading] = useState(true);\n const [query, setQuery] = useState(\"\");\n const [area, setArea] = useState(\"\");\n const [housing, setHousing] = useState(\"\");\n const [sortKey, setSortKey] = useState<\"created_at\" | \"name\" | \"type\" | \"location\">(\"type\");\n const [sortDir, setSortDir] = useState<\"asc\" | \"desc\">(\"asc\");\n const [token, setToken] = useState(localStorage.getItem(\"staffToken\") ?? \"\");\n const [user, setUser] = useState(null);\n const [editing, setEditing] = useState(null);\n const [showAdmin, setShowAdmin] = useState(false);\n const [showForgot, setShowForgot] = useState(false);\n const [showSignIn, setShowSignIn] = useState(false);\n const [showStats, setShowStats] = useState(false);\n const [areaResults, setAreaResults] = useState(null);\n const [searching, setSearching] = useState(false);\n const [added, setAdded] = useState>(new Set());\n\n const staff = !!user;\n const canEdit = staff && RANK[user.role] >= RANK.editor;\n\n // Restore session\n useEffect(() => {\n if (!token) { setLoading(false); return; }\n fetch(\"/api/me\", { headers: { authorization: `Bearer ${token}` } })\n .then((r) => r.json())\n .then((d) => {\n if (d.user) setUser(d.user);\n else { localStorage.removeItem(\"staffToken\"); setToken(\"\"); }\n })\n .finally(() => setLoading(false));\n }, []);\n\n async function refresh() {\n const res = await fetch(\"/api/listings\", staff ? { headers: { authorization: `Bearer ${token}` } } : undefined);\n setListings(await res.json());\n setLoading(false);\n }\n useEffect(() => {\n refresh();\n }, [token]);\n\n const filtered = useMemo(() => {\n const q = query.trim().toLowerCase();\n const result = listings.filter((l) => {\n if (housing && l.type !== housing) return false;\n if (area && !locationList(l.location).includes(area)) return false;\n if (!q) return true;\n return [l.name, l.type, l.location, l.phone, l.contact_name, l.notes, l.website,\n l.staff_notes, l.unsuitable_notes, l.date_validated, l.validated_by]\n .join(\" \")\n .toLowerCase()\n .includes(q);\n });\n const TYPE_RANK: Record = {\n \"rental property\": 1,\n \"rental agency\": 2,\n \"support services\": 3,\n \"private landlord\": 4,\n \"senior living\": 5,\n };\n const dir = sortDir === \"asc\" ? 1 : -1;\n return result.sort((a, b) => {\n let av = (a[sortKey] || \"\").toString().toLowerCase();\n let bv = (b[sortKey] || \"\").toString().toLowerCase();\n if (sortKey === \"type\") {\n const ar = TYPE_RANK[av] ?? 99;\n const br = TYPE_RANK[bv] ?? 99;\n if (ar !== br) return (ar - br) * dir;\n // Same type group: sort alphabetically by name\n av = (a.name || \"\").toString().toLowerCase();\n bv = (b.name || \"\").toString().toLowerCase();\n }\n if (av < bv) return -1 * dir;\n if (av > bv) return 1 * dir;\n return 0;\n });\n }, [listings, query, area, housing, sortKey, sortDir]);\n\n function onSort(key: \"created_at\" | \"name\" | \"type\" | \"location\") {\n if (sortKey === key) {\n setSortDir((d) => d === \"asc\" ? \"desc\" : \"asc\");\n } else {\n setSortKey(key);\n setSortDir(key === \"created_at\" ? \"desc\" : \"asc\");\n }\n }\n\n async function exportCsv() {\n const res = await fetch(\"/api/listings/export\", { headers: { authorization: `Bearer ${token}` } });\n if (!res.ok) {\n alert(`Export failed (${res.status}). If you were signed in a while ago, sign in again.`);\n return;\n }\n const blob = await res.blob();\n const url = URL.createObjectURL(blob);\n const a = document.createElement(\"a\");\n a.href = url;\n a.download = `housing-directory-${new Date().toISOString().slice(0, 10)}.csv`;\n a.click();\n URL.revokeObjectURL(url);\n }\n\n async function signIn(email: string, password: string): Promise {\n const res = await fetch(\"/api/login\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email, password }),\n });\n const data = await res.json();\n if (!res.ok) return data.error ?? \"Sign in failed\";\n localStorage.setItem(\"staffToken\", data.token);\n setToken(data.token);\n setUser(data.user);\n setShowForgot(false);\n return null;\n }\n\n async function signOut() {\n await fetch(\"/api/logout\", { method: \"POST\", headers: { authorization: `Bearer ${token}` } });\n localStorage.removeItem(\"staffToken\");\n setToken(\"\");\n setUser(null);\n setShowAdmin(false);\n setEditing(null);\n }\n\n async function apiWrite(method: string, path: string, body?: any) {\n const res = await fetch(path, {\n method,\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n body: body ? JSON.stringify(body) : undefined,\n });\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n alert(`Action failed: ${data.error ?? res.status}. If you were signed in a while ago, sign in again.`);\n return false;\n }\n await refresh();\n return true;\n }\n\n async function save(input: ListingInput) {\n const ok = editing === \"new\"\n ? await apiWrite(\"POST\", \"/api/listings\", input)\n : await apiWrite(\"PUT\", `/api/listings/${(editing as Listing).id}`, input);\n if (ok) setEditing(null);\n }\n\n async function remove(l: Listing) {\n if (!confirm(`Delete \"${l.name || l.phone}\"?`)) return;\n await apiWrite(\"DELETE\", `/api/listings/${l.id}`);\n }\n\n async function flagUnsuitable(l: Listing) {\n const note = prompt(`Flag \"${l.name || l.phone}\" as unsuitable.\\nExplain the issue (required, staff-only note):`);\n if (note === null) return;\n if (!note.trim()) { alert(\"A note explaining the issue is required.\"); return; }\n await apiWrite(\"POST\", `/api/listings/${l.id}/flag-unsuitable`, { note });\n }\n\n async function searchArea() {\n if (!area) return;\n setSearching(true);\n try {\n const res = await fetch(\"/api/discover-area\", {\n method: \"POST\",\n headers: { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" },\n body: JSON.stringify({ area }),\n });\n if (!res.ok) {\n alert(`Area search failed (${res.status}).`);\n return;\n }\n const data = await res.json();\n setAdded(new Set());\n setAreaResults(data.results);\n if (data.results.length === 0) {\n alert(`No new listings found for ${area} — everything found is already in the directory.`);\n }\n } finally {\n setSearching(false);\n }\n }\n\n async function addDiscovered(d: DiscoveredListing) {\n const dateStr = new Date().toISOString().slice(0, 10);\n const ok = await apiWrite(\"POST\", \"/api/listings\", {\n ...emptyListing,\n location: AREAS.includes(d.location) ? d.location : area,\n name: d.name,\n phone: d.phone || \"\",\n website: d.website || \"\",\n notes: d.notes\n ? `${d.notes} — AI-discovered ${dateStr}, verify contact info`\n : `AI-discovered ${dateStr}, verify contact info`,\n });\n if (ok) setAdded((s) => new Set(s).add(d.name));\n }\n\n async function markVerified(l: Listing) {\n if (!l.website) {\n const open = confirm(\"This listing has no website, so it can't be auto-checked. Verify it manually, then press OK to stamp today's date as verified.\");\n if (open) {\n const today = new Date().toLocaleDateString(\"en-US\");\n await apiWrite(\"PUT\", `/api/listings/${l.id}`, { ...l, date_validated: today, validated_by: user?.first_name || user?.email || \"staff\" });\n }\n return;\n }\n setLoading(true);\n try {\n const res = await fetch(`/api/listings/${l.id}/auto-verify`, {\n method: \"POST\",\n headers: { authorization: `Bearer ${token}` },\n });\n if (!res.ok) {\n alert(`Auto-check failed to run (${res.status}).`);\n return;\n }\n const result = await res.json();\n let msg = result.verified\n ? `✓ Auto-check passed: ${result.reason}`\n : `✗ Auto-check failed: ${result.reason}`;\n if (result.foundPhone) msg += `\\n\\nPhone \"${result.phone}\" was added from the website.`;\n msg += result.isRentalSite\n ? \"\\n\\n✓ Site looks like a rental/property site\"\n : \"\\n\\n⚠ Site may NOT be a rental/property site\";\n if (result.fmrReferences?.length) {\n msg += `\\n\\n⚠ Site references Fair Market Rent / HUD: ${result.fmrReferences.join(\", \")} (noted on listing)`;\n }\n if (result.verified) {\n alert(msg);\n } else {\n const open = confirm(msg + \"\\n\\nVerify manually. Open the website now?\");\n if (open) window.open(l.website, \"_blank\", \"noopener\");\n }\n } finally {\n setLoading(false);\n await refresh();\n }\n }\n\n // Password reset landing (staff clicks email link → /?reset=TOKEN)\n const params = new URLSearchParams(window.location.search);\n const resetToken = params.get(\"reset\");\n\n return (\n

The Haven — Housing Directory

\n Rental properties, agencies, private landlords, transitional & assisted living — maintained by{\" \"}\n The Haven.\n

\n\n {resetToken && (\n \n )}\n\n {showForgot && (\n setShowForgot(false)} />\n )}\n\n

\n setQuery(e.target.value)}\n />\n { setHousing(e.target.value); setAreaResults(null); }}\n >\n \n {HOUSING_TYPES\n .filter((h) => staff || h !== \"Private Landlord\")\n .map((h) => )}\n \n { setArea(e.target.value); setAreaResults(null); }}\n >\n \n {AREAS.map((a) => )}\n \n {canEdit && area && (\n \n {searching ? `Searching ${area}…` : `🔍 Search ${area}`}\n \n )}\n {staff && (\n \n Export to Excel\n \n )}\n {filtered.length} of {listings.length} listings\n \n {staff\n ? (\n <>\n \n {user.first_name || user.email} ({user.role})\n \n {user.role === \"admin\" && (\n \n )}\n {canEdit && (\n \n )}\n setShowStats((v) => !v)}\n className=\"border border-gray-300 rounded px-3 py-1.5 text-sm\"\n title=\"Views of the directory, public vs staff\"\n >\n 📊 Site activity\n \n \n 📖 Staff guide\n \n \n \n )\n : (\n <>\n \n \n )}\n

\n\n {!staff && showSignIn && (\n { setShowSignIn(false); setShowForgot(true); }}\n />\n )}\n\n {!staff && showSignIn && (\n \n )}\n\n {staff && showAdmin && user.role === \"admin\" && (\n \n )}\n\n {staff && showStats && (\n setShowStats(false)} />\n )}\n\n {areaResults !== null && (\n

\n AI search results: {area}{\" \"}\n ({areaResults.length} found)\n

\n \n

\n {areaResults.length === 0 && (\n

\n No new listings found — everything in this area may already be in the directory.\n

\n )}\n {areaResults.map((d) => {\n const isAdded = added.has(d.name);\n return (\n

\n {d.name} ({d.location})\n

{d.notes || \"No description\"}

\n {d.phone &&

{d.phone}

}\n

\n {d.website && (\n \n visit site\n \n )}\n addDiscovered(d)}\n disabled={isAdded}\n className={isAdded ? \"text-gray-400\" : \"text-green-700 hover:underline\"}\n >\n {isAdded ? \"added ✓\" : \"+ add\"}\n \n

\n );\n })}\n

\n )}\n\n {editing && (\n setEditing(null)}\n />\n )}\n\n {loading ?

Loading…

: (\n \n )}\n\n \n

\n );\n}\n\nfunction SignInForm({ onSignIn, onForgot }: { onSignIn: (e: string, p: string) => Promise; onForgot: () => void }) {\n const [email, setEmail] = useState(\"\");\n const [password, setPassword] = useState(\"\");\n const [error, setError] = useState(\"\");\n return (\n {\n e.preventDefault();\n const err = await onSignIn(email, password);\n if (err) setError(err);\n }}\n >\n

Staff sign in

\n setEmail(e.target.value)} />\n setPassword(e.target.value)} />\n {error &&

{error}

}\n

\n \n \n

\n \n );\n}\n\n// Exported so App can render it in place of the sign-in link\nexport function SignInPanel({ onSignIn }: { onSignIn: (e: string, p: string) => Promise }) {\n return null;\n}\n\nfunction ForgotForm({ onClose }: { onClose: () => void }) {\n const [email, setEmail] = useState(\"\");\n const [sent, setSent] = useState(false);\n return (\n

Reset your password

\n {sent ? (\n

If that email is registered, a reset link has been sent. Check your inbox.

\n ) : (\n <>\n setEmail(e.target.value)} />\n {\n await fetch(\"/api/forgot-password\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email }),\n });\n setSent(true);\n }}\n >\n Send reset link\n \n \n )}\n \n

\n );\n}\n\nfunction ResetForm({ token }: { token: string }) {\n const [password, setPassword] = useState(\"\");\n const [error, setError] = useState(\"\");\n const [done, setDone] = useState(false);\n return (\n

Choose a new password

At least 12 characters with upper & lower case letters and a special character.

\n {done ? (\n

Password updated — you can sign in now.

\n ) : (\n <>\n setPassword(e.target.value)} />\n {error &&

{error}

}\n {\n const res = await fetch(\"/api/reset-password\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ token, password }),\n });\n const data = await res.json();\n if (!res.ok) setError(data.error ?? \"Failed\");\n else setDone(true);\n }}\n >\n Update password\n \n \n )}\n

\n );\n}\n\nfunction BootstrapForm() {\n const [empty, setEmpty] = useState(null);\n const [email, setEmail] = useState(\"\");\n const [first, setFirst] = useState(\"\");\n const [last, setLast] = useState(\"\");\n const [password, setPassword] = useState(\"\");\n const [msg, setMsg] = useState(\"\");\n\n useEffect(() => {\n fetch(\"/api/needs-bootstrap\")\n .then((r) => r.json())\n .then((d) => setEmpty(!!d.empty))\n .catch(() => setEmpty(false));\n }, []);\n\n if (empty === null || !empty) return null;\n\n return (\n

First-time setup

\n No users exist yet. Create the first administrator account (requires a strong password: 12+ chars, upper & lower case, special character).\n

\n {msg ? (\n

{msg}

\n ) : (\n <>\n setEmail(e.target.value)} />\n

\n setFirst(e.target.value)} />\n setLast(e.target.value)} />\n

\n setPassword(e.target.value)} />\n {\n const res = await fetch(\"/api/bootstrap-admin\", {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({ email, first_name: first, last_name: last, password }),\n });\n const data = await res.json();\n if (!res.ok) setMsg(data.error ?? \"Failed\");\n else {\n setMsg(\"Admin created — you can sign in now.\");\n setEmpty(false);\n }\n }}\n >\n Create admin\n \n {msg &&

{msg}

}\n \n )}\n

\n );\n}\n",[],[78,161,196],"83aaa046-454c-47e9-bd5e-98262f321c74","AdminUsers.tsx","59d6bbdc-a945-11f1-bc31-1607ee4eb77e",68,["D",1788625075015],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useState } from \"https://esm.sh/react@18.2.0\";\nimport type { StaffUser } from \"../types.ts\";\n\nconst ROLES = [\"admin\", \"editor\", \"viewer\"];\n\nexport function AdminUsers({ token, me }: { token: string; me: StaffUser }) {\n const [users, setUsers] = useState(null);\n const [error, setError] = useState(\"\");\n // new user form\n const [email, setEmail] = useState(\"\");\n const [first, setFirst] = useState(\"\");\n const [last, setLast] = useState(\"\");\n const [role, setRole] = useState(\"viewer\");\n const [password, setPassword] = useState(\"\");\n\n const auth = { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" };\n\n async function load() {\n const res = await fetch(\"/api/users\", { headers: auth });\n if (res.ok) setUsers(await res.json());\n else setError(\"Failed to load users\");\n }\n useEffect(() => {\n load();\n }, []);\n\n async function act(fn: () => Promise) {\n const res = await fn();\n if (!res.ok) {\n const data = await res.json().catch(() => ({}));\n alert(data.error ?? `Failed (${res.status})`);\n return false;\n }\n await load();\n return true;\n }\n\n return (\n

User administration

\n {error &&

{error}

}\n {users === null ?

Loading…

: (\n \n \n \n \n \n \n \n \n \n \n \n \n {users.map((u) => (\n \n \n \n \n \n \n \n \n ))}\n \n

Name	Email	Role	Created	Last login	Actions
{u.first_name} {u.last_name}{u.id === me.id ? \" (you)\" : \"\"}	{u.email}{!u.active && (inactive)}	\n act(() =>\n fetch(`/api/users/${u.id}/role`, { method: \"PUT\", headers: auth, body: JSON.stringify({ role: e.target.value }) }),\n )}\n >\n {ROLES.map((r) => )}\n \n	{u.created_at?.slice(0, 10)}	{u.last_login?.slice(0, 16).replace(\"T\", \" \") \|\| \"never\"}	\n {\n const pw = prompt(`New password for ${u.email} (min 12 chars, upper+lower+special):`);\n if (pw) act(() => fetch(`/api/users/${u.id}/password`, { method: \"PUT\", headers: auth, body: JSON.stringify({ password: pw }) }));\n }}\n >\n set password\n \n act(() =>\n fetch(`/api/users/${u.id}/active`, { method: \"PUT\", headers: auth, body: JSON.stringify({ active: !u.active }) }),\n )}\n >\n {u.active ? \"deactivate\" : \"reactivate\"}\n \n

\n )}\n\n

Add user

\n setEmail(e.target.value)} />\n setFirst(e.target.value)} />\n setLast(e.target.value)} />\n \n setPassword(e.target.value)} />\n {\n const ok = await act(() => fetch(\"/api/users\", {\n method: \"POST\",\n headers: auth,\n body: JSON.stringify({ email, first_name: first, last_name: last, role, password }),\n }));\n if (ok) {\n setEmail(\"\"); setFirst(\"\"); setLast(\"\"); setPassword(\"\");\n }\n }}\n >\n Create user\n \n

\n Passwords must be at least 12 characters with upper & lower case letters and a special character.\n

\n );\n}\n",[],[78,161,205],"83688e9c-c04c-4cea-8600-2b3d4f973f05","backend","102650c1-16df-4425-91f4-ad09aa6fdd92",["D",1783712386625],[218,219,220,221,222,223],[213],{"_36":265,"_13":266,"_63":267,"_71":214,"_61":62,"_74":268,"_88":89,"_38":269,"_17":70,"_68":69,"_66":270,"_94":51,"_76":-5,"_95":271,"_18":272},{"_36":256,"_13":257,"_63":258,"_71":214,"_61":62,"_74":259,"_88":89,"_38":260,"_17":149,"_68":261,"_66":262,"_94":51,"_76":-5,"_95":263,"_18":264},{"_36":248,"_13":249,"_63":250,"_71":214,"_61":62,"_74":251,"_88":89,"_38":252,"_17":109,"_68":69,"_66":253,"_94":51,"_76":-5,"_95":254,"_18":255},{"_36":240,"_13":241,"_63":242,"_71":214,"_61":62,"_74":243,"_88":89,"_38":244,"_17":34,"_68":69,"_66":245,"_94":51,"_76":-5,"_95":246,"_18":247},{"_36":233,"_13":234,"_63":235,"_71":214,"_61":62,"_74":34,"_88":89,"_38":236,"_17":70,"_68":69,"_66":237,"_94":51,"_76":-5,"_95":238,"_18":239},{"_36":224,"_13":225,"_63":226,"_71":214,"_61":62,"_74":227,"_88":89,"_38":228,"_17":229,"_68":69,"_66":230,"_94":51,"_76":-5,"_95":231,"_18":232},"8ee023df-381b-4b36-b003-192319b90de3","verify.ts","dbb2adce-a6fb-11f1-8620-1607ee4eb77e",56,["D",1788624351394],4,"import type { Listing } from \"./db.ts\";\n\nexport interface AutoCheckResult {\n verified: boolean; // true only if site reachable AND phone found\n siteStatus: number | null; // HTTP status, null if request failed / no site\n phoneFound: boolean | null; // null = couldn't check (no site or no phone)\n foundPhone: string | null; // phone number discovered on the page (when listing had none)\n reason: string; // human-readable summary for the UI\n}\n\nfunction digits(s: string): string {\n return s.replace(/\\D/g, \"\");\n}\n\n/** Find a US-style phone number in raw page text, formatted like 434-555-1234. */\nfunction findPhoneOnPage(text: string): string | null {\n const match = text.match(/(?:\\+?1[-.\\s]?)?\$?\\d{3}\$?[-.\\s]\\d{3}[-.\\s]\\d{4}/);\n return match ? match[0] : null;\n}\n\n/** Fetch a listing's homepage (only) and return its text, capped at ~500 KB. */\nexport async function fetchPageText(url: string): Promise<{ text: string | null; status: number | null }> {\n let res: Response;\n try {\n res = await fetch(url, {\n redirect: \"follow\",\n signal: AbortSignal.timeout(10_000),\n headers: { \"user-agent\": \"Mozilla/5.0 (compatible; HavenDirectoryCheck/1.0)\" },\n });\n } catch {\n return { text: null, status: null };\n }\n\n if (!res.ok) return { text: null, status: res.status };\n\n try {\n const reader = res.body?.getReader();\n let text = \"\";\n if (reader) {\n const decoder = new TextDecoder();\n while (text.length < 500_000) {\n const { done, value } = await reader.read();\n if (done) break;\n text += decoder.decode(value, { stream: true });\n }\n reader.cancel().catch(() => {});\n } else {\n text = await res.text();\n }\n // Strip tags so numbers inside markup attributes don't skew matching\n return { text: text.replace(/<[^>]*>/g, \" \"), status: res.status };\n } catch {\n return { text: null, status: res.status };\n }\n}\n\n/**\n * Auto-verify a listing's contact info: fetch the homepage (only), confirm it\n * responds OK, then:\n * - if the listing has a phone number, confirm it appears on the page\n * (compared digits-only, so formatting differences don't matter)\n * - if the listing has NO phone number, look for one on the page and return it\n * so the caller can fill it in\n */\nexport async function autoCheckContact(listing: Listing): Promise {\n if (!listing.website) {\n return {\n verified: false,\n siteStatus: null,\n phoneFound: null,\n foundPhone: null,\n reason: \"no website listed\",\n };\n }\n\n const url = listing.website.startsWith(\"http\") ? listing.website : `https://${listing.website}`;\n const { text, status } = await fetchPageText(url);\n\n if (text === null) {\n return {\n verified: false,\n siteStatus: status,\n phoneFound: null,\n foundPhone: null,\n reason: status === null\n ? \"website unreachable\"\n : `site responded ${status} (not OK)`,\n };\n }\n\n const phoneDigits = digits(listing.phone);\n if (phoneDigits.length >= 7) {\n const phoneFound = digits(text).includes(phoneDigits);\n return {\n verified: phoneFound,\n siteStatus: status,\n phoneFound,\n foundPhone: null,\n reason: phoneFound\n ? `site responded ${status}; phone found on page`\n : `site responded ${status}; phone NOT found on page`,\n };\n }\n\n // No usable phone in the directory — try to pull one off the page\n const found = findPhoneOnPage(text);\n return {\n verified: found !== null,\n siteStatus: status,\n phoneFound: found !== null,\n foundPhone: found,\n reason: found\n ? `site responded ${status}; phone found on page: ${found}`\n : `site responded ${status}; no phone number found on page`,\n };\n}\n\n// ---------- Extended checks: rental-site detection & FMR/HUD references ----------\n\nconst RENTAL_KEYWORDS = [\n \"rent\", \"rental\", \"apartment\", \"lease\", \"tenant\", \"housing\", \"property\",\n \"unit\", \"vacancy\", \"landlord\", \"residency\", \"for rent\", \"available now\",\n];\n\nconst FMR_KEYWORDS = [\n \"fair market rent\", \"fmr\", \"hud guidelines\", \"housing choice voucher\",\n \"section 8\", \"hud.org\", \"hud.gov\",\n];\n\nfunction countKeywords(text: string, keywords: string[]): string[] {\n const lower = text.toLowerCase();\n return keywords.filter((k) => lower.includes(k));\n}\n\nexport interface ExtendedCheck {\n isRentalSite: boolean;\n rentalSignals: string[];\n fmrReferences: string[];\n}\n\n/**\n * Analyze already-fetched page text for:\n * - whether it looks like a rental/property site\n * - any references to Fair Market Rent / HUD guidelines\n */\nexport function extendedChecks(pageText: string): ExtendedCheck {\n const rentalSignals = countKeywords(pageText, RENTAL_KEYWORDS);\n const fmrReferences = countKeywords(pageText, FMR_KEYWORDS);\n return {\n isRentalSite: rentalSignals.length >= 2,\n rentalSignals,\n fmrReferences,\n };\n}\n",[],[213,225],"b5fa7834-3e4a-4260-a261-7e1c83d58b2d","seed.ts","1b60461e-7c97-11f1-9075-1607ee4eb77e",["D",1783712386625],"// Initial data imported from The Haven's \"Landlord Directory FY25\" Google Sheet\n// (Properties and Property Mgt Companies List tab), July 2026.\n// website: real URL when the sheet had one; websiteLabel: hyperlink text whose\n// URL wasn't recoverable from the export; notes: descriptor text from the sheet.\n\nexport interface SeedListing {\n location: string;\n name: string;\n phone: string;\n website?: string;\n websiteLabel?: string;\n notes?: string;\n}\n\nexport const seedListings: SeedListing[] = [\n { location: \"Albemarle\", name: \"1st Dominon Realty - Various Properties\", phone: \"434-531-6688\", website: \"https://1stdominionrealty.com\" },\n { location: \"Albemarle\", name: \"Access Properties - Various Properties\", phone: \"(434) 296-7227\", websiteLabel: \"Explore Our Properties - Access Properties LLC\" },\n { location: \"Charlottesville/Albemarle\", name: \"Ally Properties - Various Properties\", phone: \"434-207-6557\", website: \"https://www.yourallypm.com\" },\n { location: \"Albemarle\", name: \"Wilton Farm Apartments\", phone: \"434-295-7368\", websiteLabel: \"Wilton Farm Apartments\" },\n { location: \"Albemarle\", name: \"Rio Hill Apartments\", phone: \"434-974-6377\", websiteLabel: \"Rio Hill Apartments\" },\n { location: \"Albemarle\", name: \"Spark Charlottesville\", phone: \"434-973-6432\", websiteLabel: \"Spark Charlottesville Apartments\" },\n { location: \"Albemarle\", name: \"Barracks West Apartments\", phone: \"434-542-8052\", websiteLabel: \"Barracks West\" },\n { location: \"Albemarle\", name: \"Braden Property Management - Various Properties\", phone: \"434-973-3003\", websiteLabel: \"Braden Property Management\" },\n { location: \"Charlottesville\", name: \"Carratt Apartments\", phone: \"434-979-7307\", websiteLabel: \"Carratt Apartments - Charlottesville\" },\n { location: \"Albemarle\", name: \"Cobalt Ridge\", phone: \"434-973-3620\", websiteLabel: \"Cobalt Ridge\" },\n { location: \"Charlottesville\", name: \"Carlton View Apartments\", phone: \"434-422-2110\", websiteLabel: \"Carlton Views\" },\n { location: \"Charlottesville\", name: \"Greenstone on 5th\", phone: \"434-295-3094\", websiteLabel: \"Greenstone on 5th Apartments | Community Housing Partners\" },\n { location: \"Orange\", name: \"Spicers Mill Apartments\", phone: \"540-672-3250\", websiteLabel: \"Community Housing Partners\" },\n { location: \"Charlottesville\", name: \"Community Service Housing - Various Properties\", phone: \"434-978-2007\", websiteLabel: \"Community Services Housing, Inc\" },\n { location: \"Charlottesville City, Albemarle County, Scottsville and Nelson County\", name: \"Various Properties (Piedmont Housing Alliance)\", phone: \"\", websiteLabel: \"Our Communities - Piedmont Housing Alliance\", notes: \"View website for contact information\" },\n { location: \"Charlottesville\", name: \"Spruce Street Group Home\", phone: \"434-971-2525\", websiteLabel: \"Community Services Housing, Inc\" },\n { location: \"Louisa\", name: \"Waverly Place\", phone: \"540-603-2477\", websiteLabel: \"Waverly Place - Louisa\" },\n { location: \"Charlottesville\", name: \"D.M. Rothwell - Various Properties\", phone: \"434-977-7676\", websiteLabel: \"D.M. Rothwell, Inc\" },\n { location: \"Charlottesville, Crozet and Lexington\", name: \"BMC Property Management - Various Properties\", phone: \"434-977-6400\", websiteLabel: \"BMC Property Management\" },\n { location: \"Charlottesville City/Albemarle County\", name: \"BlueSky Property Management - Various Properties\", phone: \"434-295-4663\", websiteLabel: \"BlueSky Property Management\" },\n { location: \"Charlottesville, Albemarle and Harrisonburg\", name: \"Barclay Place, Tarleton Square, WestGate Apartments, Solomon Court Apartments, Charlottesville Towers, Residence at 218 and Park Apartments (Harrisonburg)\", phone: \"434-296-4141\", website: \"https://www.gemc.com/residential.cfm\" },\n { location: \"Louisa\", name: \"Pine Ridge Apartments\", phone: \"540-967-9657\", notes: \"Website unavailable\" },\n { location: \"Albemarle\", name: \"Timberland Park Apartments\", phone: \"434-956-4784\", websiteLabel: \"Timberland Park | Apartments in Charlottesville, VA\" },\n { location: \"Nelson\", name: \"Lovingston Ridge Apartments\", phone: \"(434) 263-7724\", notes: \"Website unavailable\" },\n { location: \"Charlottesville and Albemarle\", name: \"Godfrey Property Management - Various Properties\", phone: \"434-979-8155\", websiteLabel: \"Godfrey Property Management\" },\n { location: \"Charlottesville\", name: \"Ephphatha Village Apartments\", phone: \"434-202-2265\", websiteLabel: \"Ephphatha Village Apartments | Community Housing Partners\" },\n { location: \"Albemarle\", name: \"Southwood\", phone: \"434-293-9066\", websiteLabel: \"Southwood Community | Find your Home\" },\n { location: \"Albemarle\", name: \"Hearthwood Apartments\", phone: \"434-260-1903\", websiteLabel: \"Hearthwood Apartments\" },\n { location: \"Louisa\", name: \"Club Hill Apartments\", phone: \"540-967-0965\", notes: \"Website unavailable\" },\n { location: \"Culpeper\", name: \"JHP Rental Properties - Various Properties\", phone: \"540-967-2641\", websiteLabel: \"Rental\" },\n { location: \"Orange\", name: \"Round Hill Meadows\", phone: \"540-672-4827\", websiteLabel: \"Round Hill Meadows\" },\n { location: \"Charlottesville and Albemarle\", name: \"Knight Realty and Investments - Various Properties\", phone: \"(434) 981-3919\", notes: \"Website unavailable\" },\n { location: \"Albemarle\", name: \"Berkshire and Barter Court Apts.\", phone: \"434-270-7771\", websiteLabel: \"Berkshire and Barter Court Apartments\" },\n { location: \"Albemarle\", name: \"The Meadows Apartments\", phone: \"434-328-5268\", website: \"https://www.themeadows-online.com/\" },\n { location: \"Greene\", name: \"Lily Ridge Apartments\", phone: \"(434) 939-9197\", websiteLabel: \"Lily Ridge\" },\n { location: \"Louisa\", name: \"Lloyd's Real Estate - Various Properties\", phone: \"540-967-0168\", websiteLabel: \"Lloyd's Real Estate\" },\n { location: \"Charlottesville\", name: \"MSC - Various Properties\", phone: \"434-423-5400\", websiteLabel: \"MSC UVA\" },\n { location: \"Charlottesville\", name: \"Midway Manor\", phone: \"434-971-6770\", website: \"https://midwaymanorapts.com/\" },\n { location: \"Charlottesville, Albemarle, Amherst and Orange\", name: \"Montague Miller and Co. - Various Properties\", phone: \"434-973-5393\", website: \"https://www.montaguemiller.com/results/?property_category=5&cidonly=1\" },\n { location: \"Charlottesville\", name: \"Nest Realty - Various Properties\", phone: \"434-566-0121\", websiteLabel: \"Nest Realty\" },\n { location: \"Charlottesville\", name: \"New House Company\", phone: \"434-978-7900\", websiteLabel: \"The New House Company\" },\n { location: \"Albemarle\", name: \"Brookdale Apartments\", phone: \"434-282-4986\", website: \"https://www.brookdalecville.com/\" },\n { location: \"Albemarle\", name: \"Treesdale Apartments\", phone: \"434-971-7368\", websiteLabel: \"Treesdale Apartments\" },\n { location: \"Various in Virginia\", name: \"Ruckersville Mobile Home Community\", phone: \"434-760-1994\", websiteLabel: \"Roseland Communities\" },\n { location: \"\", name: \"\", phone: \"434-465-8461\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-326-4786\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"Mews on Little High\", phone: \"434-286-3792\", notes: \"Complex\" },\n { location: \"Albemarle\", name: \"Private units in Eagle's Landing\", phone: \"434-234-3813\", notes: \"Shared\" },\n { location: \"Albemarle\", name: \"Various Properties\", phone: \"434-971-1600 x295\", notes: \"Various\" },\n { location: \"Charlottesville\", name: \"The Gleason\", phone: \"434-202-1852\", notes: \"Agent\" },\n { location: \"\", name: \"University Forum\", phone: \"434-971-1600\" },\n { location: \"Charlottesville\", name: \"Various Properties\", phone: \"434-989-2121\", notes: \"Various\" },\n { location: \"\", name: \"Various Properties\", phone: \"434-951-5155\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-760-0659\" },\n { location: \"Charlottesville\", name: \"Cavalier Court Apartments\", phone: \"434-979-7307\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"Shamrock Gardens Apartments\", phone: \"434-979-7307\", notes: \"Apartment Complex\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-979-7307\" },\n { location: \"\", name: \"\", phone: \"434-529-0471\" },\n { location: \"\", name: \"\", phone: \"757-617-3158\" },\n { location: \"Greene\", name: \"Jack Russell Apartments\", phone: \"540-948-3916\" },\n { location: \"Greene\", name: \"Skyline Apartments\", phone: \"540-948-3916\" },\n { location: \"Fluvanna\", name: \"Various Properties\", phone: \"434-245-0894\" },\n { location: \"Lake Monticello\", name: \"Various Properties\", phone: \"434-589-4507\" },\n { location: \"\", name: \"\", phone: \"434-326-2460\" },\n { location: \"Orange\", name: \"Meadow Run Apartments\", phone: \"540-832-5350\", notes: \"Complex\" },\n { location: \"Albemarle\", name: \"Turtle Creek Condos\", phone: \"434-295-4663\" },\n { location: \"Charlottesville\", name: \"Grand Marc\", phone: \"434-293-5358\", notes: \"Apartment Building\" },\n { location: \"Charlottesville/Albemarle County\", name: \"Wade Property Management - Various Properties\", phone: \"434-973-3294\", websiteLabel: \"Wade Rentals in Charlottesville, VA\" },\n { location: \"Charlottesville\", name: \"100 West South Street\", phone: \"434-971-8860\", notes: \"Apartment with shared kitchen\" },\n { location: \"Charlottesville\", name: \"Camden Plaza\", phone: \"434-971-8860\" },\n { location: \"Charlottesville\", name: \"Comyn Hall\", phone: \"434-971-8860\", notes: \"Apartment in House\" },\n { location: \"Charlottesville\", name: \"\", phone: \"434-971-8860\", notes: \"House with apartments\" },\n { location: \"Albemarle\", name: \"Arbor Crest\", phone: \"855-901-1116\" },\n { location: \"Orange\", name: \"Bellview Senior Apartments\", phone: \"(540) 661-3300\" },\n { location: \"Waynesboro\", name: \"Brandon Ladd Apartments\", phone: \"540-949-5000\" },\n { location: \"Albemarle\", name: \"Carriage Hill\", phone: \"434-971-8439\" },\n { location: \"Charlottesville\", name: \"Cavalier Crossing\", phone: \"434-363-9889\" },\n { location: \"Charlottesville\", name: \"Claremont at Carriage Hill\", phone: \"434-989-1559\" },\n { location: \"\", name: \"Eagle's Landing\", phone: \"434-984-5808\" },\n { location: \"Louisa/Gordonsville\", name: \"Eastgate Apartments\", phone: \"540-832-5837\" },\n { location: \"Albemarle\", name: \"Eastham Village\", phone: \"434-977-2650\" },\n { location: \"Charlottesville City/Albemarle County\", name: \"Various Properties (MSC)\", phone: \"434-423-5400\", websiteLabel: \"MSC UVA\" },\n { location: \"Louisa\", name: \"Epworth Manor Apartments\", phone: \"540-967-1696\", website: \"https://epworthmanorapartments.com\" },\n { location: \"Albemarle\", name: \"Fountain Court\", phone: \"434-977-2650\", websiteLabel: \"Fountain Court Apartments\" },\n { location: \"Charlottesville\", name: \"Ivy Gardens\", phone: \"434-220-6650\", websiteLabel: \"Ivy Garden Apartments\" },\n { location: \"Charlottesville\", name: \"Jeffersonian Apartments\", phone: \"434-977-3070 or 833-698-1081\", website: \"https://www.thejeffersonianapts.com\" },\n { location: \"Albemarle\", name: \"Mallside Forest Apartments\", phone: \"434-424-0371\", websiteLabel: \"Security Properties\" },\n { location: \"Albemarle\", name: \"North Woods at the Four Seasons\", phone: \"434-688-4966\", website: \"https://www.livewithnorthwoods.com\" },\n { location: \"Albemarle\", name: \"Park View at South Pantops\", phone: \"434-923-0200\", website: \"https://southpantops.enterpriseresidential.org\" },\n { location: \"Charlottesville\", name: \"The Crossings and Fourth and Preston\", phone: \"434-227-4251\", websiteLabel: \"Communities We Serve | SupportWorks Housing\" },\n { location: \"Charlottesville\", name: \"The Flats @ West Village\", phone: \"844-236-1118\", website: \"https://www.flatsatwestvillage.com\" },\n { location: \"Albemarle\", name: \"University Heights Apartments\", phone: \"434-326-1337\", website: \"https://www.uheights.net\" },\n { location: \"Albemarle\", name: \"Woodlands of Charlottesville\", phone: \"434-421-3191\", website: \"https://www.woodlandsofcharlottesville.com\" },\n];\n",[],[213,234],"f61c88ac-411d-4d7b-9982-d3ae52196919","discover.ts","8dc14ce0-85ec-11f1-a849-1607ee4eb77e",39,["D",1788374185326],"import { ValTownOpenAI } from \"https://esm.town/v/std/openai/main.ts\";\nimport type { Listing } from \"./db.ts\";\n\nexport interface DiscoveredListing {\n name: string;\n location: string;\n phone: string;\n website: string;\n notes: string;\n}\n\n/**\n * Build the system instructions that tell the model what we're looking for\n * and what's already in the directory so it doesn't duplicate.\n */\nfunction buildInstructions(existing: Listing[]): string {\n const names = existing\n .filter((l) => l.name.trim())\n .map((l) => `- ${l.name} (${l.location})`)\n .join(\"\\n\");\n\n const phones = existing\n .filter((l) => l.phone.trim())\n .map((l) => l.phone)\n .join(\", \");\n\n return `You are a housing researcher for The Haven, a nonprofit in Charlottesville, Virginia that helps clients find rental housing.\n\nYour job: search the web for rental properties, apartment complexes, and property management companies in the Charlottesville, VA region and nearby counties that are NOT already in our directory.\n\nTarget areas: Charlottesville, Albemarle County, Crozet, Louisa, Gordonsville, Orange, Greene, Fluvanna, Lake Monticello, Nelson, Lovingston, Waynesboro, Staunton, Culpeper, Ruckersville, Scottsville, and Harrisonburg.\n\nFor each new property or company you find, provide:\n- name: The name of the apartment complex or property management company\n- location: The city or county area (e.g. \"Charlottesville\", \"Albemarle\", \"Louisa\")\n- phone: A phone number with area code (e.g. \"434-555-1234\"). Use empty string if you can't find one.\n- website: The full URL (e.g. \"https://example.com\"). Use empty string if you can't find one.\n- notes: A brief description (e.g. \"Apartment complex\", \"Property management company\", \"Senior housing\"). Use empty string if nothing notable.\n\nRules:\n1. Only include properties you actually found via web search — do not make things up.\n2. CRITICAL — Do not return any property that is already in our directory. This includes near-matches:\n - \"The Flats @ West Village\" and \"The Flats at West Village\" are the SAME property\n - \"Carlton View Apartments\" and \"Carlton Views Apartments\" are the SAME property\n - \"Montague Miller & Co.\" and \"Montague Miller and Co.\" are the SAME company\n - Punctuation differences (@ vs at, & vs and), plural vs singular, and minor word variations are NOT different properties\n - When in doubt, skip it — it's better to miss one than to create a duplicate\n3. Do NOT include any property whose phone number matches an existing listing (compare digits only).\n4. Aim for 5-15 genuinely new listings. If you can't find that many new ones, return fewer — quality over quantity.\n5. Skip national listing sites (Zillow, Apartments.com, Trulia, etc.) — we want the actual property or management company.\n\nEXISTING LISTINGS (do not duplicate any of these, including near-matches):\n${names}\n\nEXISTING PHONE NUMBERS: ${phones}`;\n}\n\nconst SCHEMA = {\n type: \"object\",\n properties: {\n new_listings: {\n type: \"array\",\n items: {\n type: \"object\",\n properties: {\n name: { type: \"string\" },\n location: { type: \"string\" },\n phone: { type: \"string\" },\n website: { type: \"string\" },\n notes: { type: \"string\" },\n },\n required: [\"name\", \"location\", \"phone\", \"website\", \"notes\"],\n additionalProperties: false,\n },\n },\n },\n required: [\"new_listings\"],\n additionalProperties: false,\n} as const;\n\n/**\n * Calls OpenAI with web_search + structured outputs to discover new rental\n * listings not already in the directory.\n */\nexport async function discoverNewListings(\n existing: Listing[],\n): Promise {\n const openai = new ValTownOpenAI({});\n\n const response = await openai.responses.create({\n model: \"gpt-5.4-nano\",\n tools: [{ type: \"web_search\" }],\n instructions: buildInstructions(existing),\n input:\n \"Search the web for apartment complexes and property management companies in the Charlottesville, Virginia area that accept rentals. Find ones NOT already in our existing list above. Return up to 15 new listings.\",\n text: {\n format: {\n type: \"json_schema\",\n name: \"new_rental_listings\",\n schema: SCHEMA,\n },\n },\n });\n\n const parsed = JSON.parse(response.output_text) as {\n new_listings: DiscoveredListing[];\n };\n\n return parsed.new_listings;\n}\n\n/**\n * Deduplicate discovered listings against existing ones by name (case-insensitive)\n * or phone number. Also removes entries with empty names.\n */\nexport function filterNew(\n discovered: DiscoveredListing[],\n existing: Listing[],\n): DiscoveredListing[] {\n const existingNames = new Set(\n existing.map((l) => l.name.trim().toLowerCase()).filter(Boolean),\n );\n const existingPhones = new Set(\n existing.map((l) => l.phone.replace(/\\D/g, \"\")).filter(Boolean),\n );\n\n return discovered.filter((d) => {\n if (!d.name.trim()) return false;\n if (existingNames.has(d.name.trim().toLowerCase())) return false;\n const phoneDigits = d.phone.replace(/\\D/g, \"\");\n if (phoneDigits && existingPhones.has(phoneDigits)) return false;\n return true;\n });\n}\n/**\n * Area-scoped discovery for staff: search the web for rental properties in ONE\n * specific area, returning up to 10 candidates (not inserted — staff pick).\n */\nexport async function discoverByArea(\n area: string,\n existing: Listing[],\n): Promise {\n const openai = new ValTownOpenAI({});\n\n const response = await openai.responses.create({\n model: \"gpt-5.4-nano\",\n tools: [{ type: \"web_search\" }],\n instructions: `You are a housing researcher for The Haven, a nonprofit in Charlottesville, Virginia that helps clients find rental housing.\n\nYour job: search the web for apartment complexes, rental properties, and property management companies in ONE area: ${area} (in or near Charlottesville, VA).\n\nFor each property or company you find, provide:\n- name: The name of the apartment complex or property management company\n- location: \"${area}\" (or the most specific locality within it)\n- phone: A phone number with area code. Use empty string if you can't find one.\n- website: The full URL of the property or company site. Use empty string if you can't find one.\n- notes: A brief description (e.g. \"Apartment complex\", \"Property management company\", \"Senior housing\", \"3BR units starting $1,200/mo\"). Use empty string if nothing notable.\n\nRules:\n1. Only include properties you actually found via web search — do not make things up.\n2. CRITICAL — Do not return any property that is already in our directory. This includes near-matches:\n - Punctuation differences (@ vs at, & vs and), plural vs singular, and minor word variations are NOT different properties\n - When in doubt, skip it — it's better to miss one than to create a duplicate\n3. Skip national listing sites (Zillow, Apartments.com, Trulia, etc.) — we want the actual property or management company site.\n4. Return AT MOST 10 listings — quality over quantity. If the area is small, return fewer.\n\nEXISTING LISTINGS (do not duplicate any of these):\n${existing.filter((l) => l.name.trim()).map((l) => `- ${l.name} (${l.location})`).join(\"\\n\")}`,\n input: `Search the web for apartment complexes and rental property management companies in ${area}, Virginia. Return up to 10 that are NOT already in the existing list above.`,\n text: {\n format: {\n type: \"json_schema\",\n name: \"area_rental_listings\",\n schema: SCHEMA,\n },\n },\n });\n\n const parsed = JSON.parse(response.output_text) as {\n new_listings: DiscoveredListing[];\n };\n return parsed.new_listings.slice(0, 10);\n}",[],[213,241],"6415ea70-8baa-455a-981c-c26bad485335","db.ts","2c1523d0-7c97-11f1-83ac-1607ee4eb77e",108,["D",1789310196556],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TABLE = \"listings_v2\";\nconst USERS = \"users_v1\";\nconst SESSIONS = \"sessions_v1\";\nconst RESETS = \"password_resets_v1\";\nconst HITS = \"site_hits_v1\";\n\nexport const LISTING_TYPES = [\n \"Rental Agency\",\n \"Senior Living\",\n \"Rental Property\",\n \"Private Landlord\",\n \"Support Services\",\n] as const;\nexport type ListingType = (typeof LISTING_TYPES)[number];\n// Backwards-friendly alias\nexport const HOUSING_TYPES = LISTING_TYPES;\n\nexport const AREAS = [\n \"Charlottesville\",\n \"Albemarle\",\n \"Louisa\",\n \"Greene\",\n \"Nelson\",\n \"Fluvanna\",\n \"Multiple\",\n] as const;\n\nexport const ROLES = [\"admin\", \"editor\", \"viewer\"] as const;\nexport type Role = (typeof ROLES)[number];\n\nexport interface Listing {\n id: number;\n location: string; // comma-separated list of AREAS, may be blank\n name: string;\n website: string;\n type: string;\n phone: string;\n contact_name: string;\n notes: string;\n // staff-only fields (never sent to non-logged-in users)\n staff_notes: string;\n unsuitable_notes: string;\n date_validated: string;\n validated_by: string;\n created_at: string;\n updated_at: string;\n}\n\nexport type ListingInput = Omit;\n\nconst LISTING_COLS =\n \"id, location, name, website, type, phone, contact_name, notes, staff_notes, unsuitable_notes, date_validated, validated_by, created_at, updated_at\";\n\nconst STAFF_ONLY_COLS: (keyof Listing)[] = [\n \"staff_notes\",\n \"unsuitable_notes\",\n \"date_validated\",\n \"validated_by\",\n];\n\n/** Remove staff-only fields before sending a listing to the public. */\nexport function stripStaffFields(listing: Listing): Partial {\n const copy: any = { ...listing };\n for (const col of STAFF_ONLY_COLS) delete copy[col];\n return copy;\n}\n\nexport async function ensureTableAndSeed() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n location TEXT NOT NULL DEFAULT '',\n name TEXT NOT NULL DEFAULT '',\n website TEXT NOT NULL DEFAULT '',\n type TEXT NOT NULL DEFAULT 'Rental Property',\n phone TEXT NOT NULL DEFAULT '',\n contact_name TEXT NOT NULL DEFAULT '',\n notes TEXT NOT NULL DEFAULT '',\n staff_notes TEXT NOT NULL DEFAULT '',\n unsuitable_notes TEXT NOT NULL DEFAULT '',\n date_validated TEXT NOT NULL DEFAULT '',\n validated_by TEXT NOT NULL DEFAULT '',\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n updated_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n\n // One-time migration: drop the old v1 table (restructured schema; data was cleared)\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS meta_v1 (key TEXT PRIMARY KEY, value TEXT)`);\n const done = await sqlite.execute({ sql: `SELECT value FROM meta_v1 WHERE key = 'v1_dropped'` });\n if (done.rows.length === 0) {\n try {\n await sqlite.execute(`DROP TABLE IF EXISTS listings_v1`);\n } catch {\n // ignore\n }\n await sqlite.execute({ sql: `INSERT INTO meta_v1 (key, value) VALUES ('v1_dropped', datetime('now'))` });\n }\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${USERS} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n password_hash TEXT NOT NULL,\n first_name TEXT NOT NULL DEFAULT '',\n last_name TEXT NOT NULL DEFAULT '',\n role TEXT NOT NULL DEFAULT 'viewer',\n active INTEGER NOT NULL DEFAULT 1,\n created_at TEXT NOT NULL DEFAULT (datetime('now')),\n last_login TEXT NOT NULL DEFAULT ''\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${SESSIONS} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${HITS} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n ts TEXT NOT NULL DEFAULT (datetime('now')),\n kind TEXT NOT NULL DEFAULT 'directory_view',\n staff INTEGER NOT NULL DEFAULT 0\n )`);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS ${RESETS} (\n token TEXT PRIMARY KEY,\n user_id INTEGER NOT NULL,\n expires_at TEXT NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )`);\n}\n\n// ---------- Listings ----------\n\nexport async function listListings(): Promise {\n const result = await sqlite.execute(\n `SELECT ${LISTING_COLS} FROM ${TABLE} ORDER BY type, CASE WHEN name = '' THEN 1 ELSE 0 END, name COLLATE NOCASE`,\n );\n return result.rows as unknown as Listing[];\n}\n\nexport function validateListingInput(input: any): string | null {\n if (input.type && !(LISTING_TYPES as readonly string[]).includes(input.type)) {\n return `Invalid type: ${input.type}`;\n }\n if (input.location) {\n const parts = String(input.location).split(\",\").map((s: string) => s.trim()).filter(Boolean);\n const bad = parts.filter((p: string) => !(AREAS as readonly string[]).includes(p));\n if (bad.length) return `Invalid location — must be one or more of: ${AREAS.join(\", \")}`;\n }\n return null;\n}\n\nexport async function createListing(input: ListingInput): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${TABLE} (location, name, website, type, phone, contact_name, notes, staff_notes, unsuitable_notes, date_validated, validated_by)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n input.location ?? \"\", input.name ?? \"\", input.website ?? \"\",\n input.type ?? \"Rental Property\", input.phone ?? \"\", input.contact_name ?? \"\",\n input.notes ?? \"\", input.staff_notes ?? \"\", input.unsuitable_notes ?? \"\",\n input.date_validated ?? \"\", input.validated_by ?? \"\",\n ],\n });\n}\n\nexport async function getListing(id: number): Promise {\n const result = await sqlite.execute({ sql: `SELECT ${LISTING_COLS} FROM ${TABLE} WHERE id = ?`, args: [id] });\n return (result.rows[0] as Listing) ?? null;\n}\n\nexport async function updateListing(id: number, input: ListingInput): Promise {\n await sqlite.execute({\n sql: `UPDATE ${TABLE}\n SET location = ?, name = ?, website = ?, type = ?, phone = ?, contact_name = ?, notes = ?,\n staff_notes = ?, unsuitable_notes = ?, date_validated = ?, validated_by = ?,\n updated_at = datetime('now')\n WHERE id = ?`,\n args: [\n input.location ?? \"\", input.name ?? \"\", input.website ?? \"\",\n input.type ?? \"Rental Property\", input.phone ?? \"\", input.contact_name ?? \"\",\n input.notes ?? \"\", input.staff_notes ?? \"\", input.unsuitable_notes ?? \"\",\n input.date_validated ?? \"\", input.validated_by ?? \"\",\n id,\n ],\n });\n}\n\nexport async function deleteListing(id: number): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${TABLE} WHERE id = ?`, args: [id] });\n}\n\n// ---------- Users / auth ----------\n\nexport interface User {\n id: number;\n email: string;\n first_name: string;\n last_name: string;\n role: Role;\n active: number;\n created_at: string;\n last_login: string;\n}\n\nconst USER_COLS = \"id, email, password_hash, first_name, last_name, role, active, created_at, last_login\";\n\nexport async function getUserByEmail(email: string): Promise<(User & { password_hash: string }) | null> {\n const r = await sqlite.execute({ sql: `SELECT ${USER_COLS} FROM ${USERS} WHERE email = ? COLLATE NOCASE`, args: [email.trim()] });\n return (r.rows[0] as any) ?? null;\n}\n\nexport async function getUserById(id: number): Promise {\n const r = await sqlite.execute({ sql: `SELECT id, email, first_name, last_name, role, active, created_at, last_login FROM ${USERS} WHERE id = ?`, args: [id] });\n return (r.rows[0] as User) ?? null;\n}\n\nexport async function listUsers(): Promise {\n const r = await sqlite.execute(`SELECT id, email, first_name, last_name, role, active, created_at, last_login FROM ${USERS} ORDER BY email COLLATE NOCASE`);\n return r.rows as unknown as User[];\n}\n\nexport async function createUser(u: { email: string; password_hash: string; first_name: string; last_name: string; role: Role }): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ${USERS} (email, password_hash, first_name, last_name, role) VALUES (?, ?, ?, ?, ?)`,\n args: [u.email.trim(), u.password_hash, u.first_name, u.last_name, u.role],\n });\n}\n\nexport async function updateUserPassword(id: number, password_hash: string): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET password_hash = ? WHERE id = ?`, args: [password_hash, id] });\n}\n\nexport async function updateUserRole(id: number, role: Role): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET role = ? WHERE id = ?`, args: [role, id] });\n}\n\nexport async function setUserActive(id: number, active: boolean): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET active = ? WHERE id = ?`, args: [active ? 1 : 0, id] });\n}\n\nexport async function stampLogin(id: number): Promise {\n await sqlite.execute({ sql: `UPDATE ${USERS} SET last_login = datetime('now') WHERE id = ?`, args: [id] });\n}\n\nexport async function countAdmins(): Promise {\n const r = await sqlite.execute(`SELECT COUNT(*) AS n FROM ${USERS} WHERE role = 'admin' AND active = 1`);\n return Number((r.rows[0] as any).n);\n}\n\n// ---------- Sessions ----------\n\nexport async function createSession(token: string, userId: number): Promise {\n await sqlite.execute({ sql: `INSERT INTO ${SESSIONS} (token, user_id) VALUES (?, ?)`, args: [token, userId] });\n}\n\nexport async function getSessionUser(token: string): Promise {\n const r = await sqlite.execute({\n sql: `SELECT u.id, u.email, u.first_name, u.last_name, u.role, u.active, u.created_at, u.last_login\n FROM ${SESSIONS} s JOIN ${USERS} u ON u.id = s.user_id WHERE s.token = ?`,\n args: [token],\n });\n const user = r.rows[0] as User | undefined;\n return user && user.active ? user : null;\n}\n\nexport async function deleteSession(token: string): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${SESSIONS} WHERE token = ?`, args: [token] });\n}\n\n// ---------- Password resets ----------\n\nexport async function createResetToken(token: string, userId: number): Promise {\n await sqlite.execute({ sql: `DELETE FROM ${RESETS} WHERE user_id = ?`, args: [userId] });\n const expires = new Date(Date.now() + 60 * 60 * 1000).toISOString();\n await sqlite.execute({ sql: `INSERT INTO ${RESETS} (token, user_id, expires_at) VALUES (?, ?, ?)`, args: [token, userId, expires] });\n}\n\nexport async function consumeResetToken(token: string): Promise {\n const r = await sqlite.execute({ sql: `SELECT user_id, expires_at, used FROM ${RESETS} WHERE token = ?`, args: [token] });\n const row = r.rows[0] as any;\n if (!row || row.used) return null;\n if (new Date(row.expires_at) < new Date()) return null;\n await sqlite.execute({ sql: `UPDATE ${RESETS} SET used = 1 WHERE token = ?`, args: [token] });\n return row.user_id as number;\n}\n// ---------- Site hits (activity tracking) ----------\n\nexport async function recordHit(staff: boolean): Promise {\n await sqlite.execute({\n sql: `INSERT INTO site_hits_v1 (staff) VALUES (?)`,\n args: [staff ? 1 : 0],\n });\n}\n\nexport interface HitStats {\n total: number;\n totalPublic: number;\n totalStaff: number;\n last7: number;\n last30: number;\n today: number;\n byDay: { day: string; total: number; public: number; staff: number }[];\n}\n\nexport async function getHitStats(): Promise {\n const one = async (sql: string): Promise =>\n Number((await sqlite.execute(sql)).rows[0]?.n ?? 0);\n const total = await one(`SELECT COUNT(*) AS n FROM site_hits_v1`);\n const totalStaff = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE staff = 1`);\n const last7 = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE ts >= datetime('now', '-7 days')`);\n const last30 = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE ts >= datetime('now', '-30 days')`);\n const today = await one(`SELECT COUNT(*) AS n FROM site_hits_v1 WHERE date(ts) = date('now')`);\n const byDayRes = await sqlite.execute(`\n SELECT date(ts) AS day, COUNT(*) AS total,\n SUM(CASE WHEN staff = 0 THEN 1 ELSE 0 END) AS public_hits,\n SUM(CASE WHEN staff = 1 THEN 1 ELSE 0 END) AS staff_hits\n FROM site_hits_v1\n WHERE ts >= datetime('now', '-30 days')\n GROUP BY date(ts) ORDER BY day DESC`);\n return {\n total,\n totalPublic: total - totalStaff,\n totalStaff,\n last7,\n last30,\n today,\n byDay: byDayRes.rows.map((r: any) => ({\n day: r.day,\n total: Number(r.total),\n public: Number(r.public_hits),\n staff: Number(r.staff_hits),\n })),\n };\n}\n",[],[213,249],"a8c90b95-ee12-4db6-82a9-453ab1431200","cron.ts","9124a6e8-85ec-11f1-9db7-1607ee4eb77e",98,["D",1789301968642],"interval","import {\n ensureTableAndSeed,\n listListings,\n createListing,\n} from \"./db.ts\";\nimport { AREAS } from \"./db.ts\";\nimport { discoverNewListings, filterNew } from \"./discover.ts\";\n\n/**\n * Weekly cron job: uses OpenAI web search to discover new rental properties\n * and property management companies in the Charlottesville, VA area that aren't\n * already in the directory. New finds are inserted into the database with a\n * \"AI-discovered — verify contact info\" note so staff can review them.\n */\nexport default async function (interval: Interval) {\n await ensureTableAndSeed();\n\n const existing = await listListings();\n console.log(`Existing listings: ${existing.length}`);\n\n console.log(\"Searching the web for new rental listings...\");\n const discovered = await discoverNewListings(existing);\n console.log(`AI returned ${discovered.length} candidate listings`);\n\n const fresh = filterNew(discovered, existing);\n console.log(\n `After dedup: ${fresh.length} new listings to add`,\n );\n\n if (fresh.length === 0) {\n console.log(\"No new listings found this run.\");\n return;\n }\n\n const today = new Date().toISOString().slice(0, 10);\n let added = 0;\n for (const l of fresh) {\n await createListing({\n location: AREAS.includes(l.location) ? l.location : \"\",\n name: l.name,\n phone: l.phone,\n website: l.website,\n type: \"Rental Property\",\n contact_name: \"\",\n notes: l.notes\n ? `${l.notes} — AI-discovered ${today}, verify contact info`\n : `AI-discovered ${today}, verify contact info`,\n staff_notes: \"\",\n unsuitable_notes: \"\",\n date_validated: \"\",\n validated_by: \"\",\n } as any);\n added++;\n console.log(` + ${l.name} (${l.location}) — ${l.phone}`);\n }\n\n console.log(`Done. Added ${added} new listings.`);\n}\n",[],[213,257],"f97307e7-6b4a-4014-93e9-e61c39e8d6de","auth.ts","903158a6-a943-11f1-97c0-1607ee4eb77e",54,["D",1788624307201],"import { scryptSync, randomBytes, timingSafeEqual } from \"node:crypto\";\nimport { getSessionUser, type Role, type User } from \"./db.ts\";\n\n// ---------- Password hashing ----------\n\nexport function hashPassword(password: string): string {\n const salt = randomBytes(16).toString(\"hex\");\n const hash = scryptSync(password, salt, 64).toString(\"hex\");\n return `${salt}:${hash}`;\n}\n\nexport function verifyPassword(password: string, stored: string): boolean {\n const [salt, hash] = stored.split(\":\");\n if (!salt || !hash) return false;\n const candidate = scryptSync(password, salt, 64);\n const expected = Buffer.from(hash, \"hex\");\n return candidate.length === expected.length && timingSafeEqual(candidate, expected);\n}\n\n// ---------- Password policy ----------\n// At least 12 chars, upper + lower case, one special character\n\nexport function validatePasswordStrength(pw: string): string | null {\n if (pw.length < 12) return \"Password must be at least 12 characters long\";\n if (!/[a-z]/.test(pw)) return \"Password must contain a lowercase letter\";\n if (!/[A-Z]/.test(pw)) return \"Password must contain an uppercase letter\";\n if (!/[^A-Za-z0-9]/.test(pw)) return \"Password must contain a special character\";\n return null;\n}\n\n// ---------- Sessions & roles ----------\n\nexport function newToken(): string {\n return randomBytes(32).toString(\"hex\");\n}\n\nexport function normalizeEmail(email: unknown): string {\n return String(email ?? \"\").trim().toLowerCase();\n}\n\nexport function isEmail(email: string): boolean {\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email);\n}\n\nconst RANK: Record = { viewer: 1, editor: 2, admin: 3 };\n\nexport async function currentUser(c: any): Promise {\n const auth = c.req.header(\"authorization\") ?? \"\";\n const token = auth.startsWith(\"Bearer \") ? auth.slice(7) : \"\";\n if (!token) return null;\n return await getSessionUser(token);\n}\n\n/** Middleware: user must be signed in with role >= minRole. Sets c.set(\"user\"). */\nexport function requireRole(minRole: Role) {\n return async (c: any, next: () => Promise) => {\n const user = await currentUser(c);\n if (!user) return c.json({ error: \"Sign in required\" }, 401);\n if (RANK[user.role] < RANK[minRole]) return c.json({ error: `Requires ${minRole} access` }, 403);\n c.set(\"user\", user);\n await next();\n };\n}\n",[],[213,266],"6d79585e-4f87-4a0f-9f9e-e0782f6ee9c5",["D",1783712246617],"legacyEnvVars","httpPrivacy","description","Searchable rental directory for The Haven (Charlottesville)","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/64dc00cc-94d9-47dd-81b1-dde02610d900/square512?exp=1789549199&sig=78a5bc27f03474c98a49b09a954e18cc6dd63f22ba19ce3e096717a88d3522b5","userId","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","019f4d98-342f-73e3-90b3-c7f210ff5067","tursoName","6d79585e4f874a0f9f9ee0782f6ee9c5","tursoHostname","6d79585e4f874a0f9f9ee0782f6ee9c5-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789525245864],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_321":-5},"org",{"_11":12,"_315":316,"_317":-5,"_281":-5,"_318":319,"_320":89},"branch",{"_17":198,"_13":16,"_36":62,"_42":273,"_45":37,"_46":311,"_312":53,"_313":43,"_314":57,"_58":14,"_54":12},89,"forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","displayName","The Haven","avatar","tier","business","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":273,"_13":14,"_38":425,"_49":-5,"_275":51,"_52":53,"_276":53,"_277":278,"_279":280,"_281":282,"_283":87,"_284":89,"_285":-5,"_286":-5,"_287":70,"_56":288,"_289":290,"_291":292,"_293":426,"_295":-5,"_296":297,"_298":297,"_299":300,"_301":300,"_302":300,"_303":297,"_304":297,"_305":427,"_307":428,"_309":429,"_50":51},[359,366,377,378,379,380],"files",[359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380],"counts",{"_350":70,"_351":75,"_352":70,"_35":353,"_354":355},[],{"_36":60,"_13":65,"_63":64,"_71":72,"_61":62,"_74":75,"_88":89,"_38":348,"_17":70,"_68":69,"_66":67,"_94":51,"_76":-5,"_18":349},"upstreamProject",{"_36":43,"_13":59,"_277":345,"_279":280,"_52":53,"_305":346},"upstreamBranch",{"_36":37,"_38":343,"_40":344,"_13":16,"_42":43,"_17":44,"_45":-5,"_46":-5,"_47":48,"_49":-5,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1740674013689],["D",1785420707976],"Starter template with client-side React & Hono server",{"_11":55,"_321":347},"https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/129cab32-3bd7-4c3e-f39b-f12900c76100/square512?exp=1789549199&sig=85ec03bbe2ae9af315fa5e89fceebe840b59020b3ec43df39e2ab37ef0d215ad",["D",1783712246617],[78,65],"pulls","branches","forks",{"_356":75,"_358":70},"connections",{"_356":70,"_357":70},"count","unfilledCount","emptyCount",{"_36":212,"_13":213,"_63":214,"_71":-5,"_61":62,"_74":34,"_88":89,"_38":215,"_17":70,"_68":124,"_66":-5,"_94":51,"_76":-5,"_95":423,"_18":424},{"_36":265,"_13":266,"_63":267,"_71":214,"_61":62,"_74":268,"_88":89,"_38":269,"_17":70,"_68":69,"_66":270,"_94":51,"_76":-5,"_95":421,"_18":422},{"_36":256,"_13":257,"_63":258,"_71":214,"_61":62,"_74":259,"_88":89,"_38":260,"_17":149,"_68":261,"_66":262,"_94":51,"_76":-5,"_95":419,"_18":420},{"_36":248,"_13":249,"_63":250,"_71":214,"_61":62,"_74":251,"_88":89,"_38":252,"_17":109,"_68":69,"_66":253,"_94":51,"_76":-5,"_95":417,"_18":418},{"_36":240,"_13":241,"_63":242,"_71":214,"_61":62,"_74":243,"_88":89,"_38":244,"_17":34,"_68":69,"_66":245,"_94":51,"_76":-5,"_95":415,"_18":416},{"_36":233,"_13":234,"_63":235,"_71":214,"_61":62,"_74":34,"_88":89,"_38":236,"_17":70,"_68":69,"_66":237,"_94":51,"_76":-5,"_95":413,"_18":414},{"_36":224,"_13":225,"_63":226,"_71":214,"_61":62,"_74":227,"_88":89,"_38":228,"_17":229,"_68":69,"_66":230,"_94":51,"_76":-5,"_95":411,"_18":412},{"_36":122,"_13":78,"_63":72,"_71":-5,"_61":62,"_74":75,"_88":89,"_38":123,"_17":70,"_68":124,"_66":-5,"_94":51,"_76":-5,"_95":409,"_18":410},{"_36":160,"_13":161,"_63":162,"_71":72,"_61":62,"_74":75,"_88":89,"_38":163,"_17":70,"_68":124,"_66":-5,"_94":51,"_76":-5,"_95":407,"_18":408},{"_36":204,"_13":205,"_63":206,"_71":162,"_61":62,"_74":207,"_88":89,"_38":208,"_17":70,"_68":69,"_66":209,"_94":51,"_76":-5,"_95":405,"_18":406},{"_36":195,"_13":196,"_63":197,"_71":162,"_61":62,"_74":198,"_88":89,"_38":199,"_17":200,"_68":69,"_66":201,"_94":51,"_76":-5,"_95":403,"_18":404},{"_36":187,"_13":188,"_63":189,"_71":162,"_61":62,"_74":190,"_88":89,"_38":191,"_17":34,"_68":69,"_66":192,"_94":51,"_76":-5,"_95":401,"_18":402},{"_36":179,"_13":180,"_63":181,"_71":162,"_61":62,"_74":182,"_88":89,"_38":183,"_17":149,"_68":69,"_66":184,"_94":51,"_76":-5,"_95":399,"_18":400},{"_36":171,"_13":172,"_63":173,"_71":162,"_61":62,"_74":174,"_88":89,"_38":175,"_17":70,"_68":69,"_66":176,"_94":51,"_76":-5,"_95":397,"_18":398},{"_36":153,"_13":154,"_63":155,"_71":72,"_61":62,"_74":75,"_88":89,"_38":156,"_17":70,"_68":24,"_66":157,"_94":51,"_76":-5,"_95":395,"_18":396},{"_36":144,"_13":145,"_63":146,"_71":72,"_61":62,"_74":147,"_88":89,"_38":148,"_17":149,"_68":24,"_66":150,"_94":51,"_76":-5,"_95":393,"_18":394},{"_36":60,"_13":65,"_63":64,"_71":72,"_61":62,"_74":75,"_88":89,"_38":141,"_17":70,"_68":69,"_66":67,"_94":51,"_76":-5,"_95":391,"_18":392},{"_36":132,"_13":133,"_63":134,"_71":72,"_61":62,"_74":135,"_88":89,"_38":136,"_17":137,"_68":69,"_66":138,"_94":51,"_76":-5,"_95":389,"_18":390},{"_36":114,"_13":115,"_63":116,"_71":-5,"_61":62,"_74":117,"_88":89,"_38":118,"_17":75,"_68":24,"_66":119,"_94":51,"_76":-5,"_95":387,"_18":388},{"_36":106,"_13":107,"_63":108,"_71":-5,"_61":62,"_74":109,"_88":89,"_38":110,"_17":34,"_68":24,"_66":111,"_94":51,"_76":-5,"_95":385,"_18":386},{"_36":98,"_13":99,"_63":100,"_71":-5,"_61":62,"_74":101,"_88":89,"_38":102,"_17":75,"_68":24,"_66":103,"_94":51,"_76":-5,"_95":383,"_18":384},{"_36":85,"_13":86,"_63":87,"_71":-5,"_61":62,"_74":32,"_88":89,"_38":90,"_17":91,"_68":92,"_66":93,"_94":51,"_76":14,"_95":381,"_18":382},[],[86],[],[99],[],[107],[],[115],[],[78,133],[],[78,65],[],[78,145],[],[78,154],[],[78,161,172],[],[78,161,180],[],[78,161,188],[],[78,161,196],[],[78,161,205],[368,369,370,371,372],[78,161],[367,373,374,375,376],[78],[],[213,225],[],[213,234],[],[213,241],[],[213,249],[],[213,257],[],[213,266],[360,361,362,363,364,365],[213],["D",1783712246617],["D",1789525245864],{"_11":12,"_321":-5},{"_11":12,"_315":316,"_317":-5,"_281":-5,"_318":319,"_320":89},{"_17":198,"_13":16,"_36":62,"_42":273,"_45":37,"_46":311,"_312":53,"_313":43,"_314":57,"_58":14,"_54":12},"ctx",{"_305":-5,"_340":463,"_464":465,"_466":467,"_468":51,"_469":51,"_470":51,"_471":89,"_472":-5,"_473":-7,"_474":-7,"_475":70,"_476":51,"_477":51,"_478":-5,"_479":51,"_480":51,"_481":51,"_482":-5},"ENV",{"_434":435,"_436":437,"_438":16,"_439":440,"_441":442,"_443":444,"_445":446,"_447":448,"_449":450,"_451":452,"_453":454,"_455":456,"_457":458,"_459":460,"_461":462},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]