TSHC APP FOUNDRY MVP

\\${product.name}

\\${product.problem}

TARGET CUSTOMER

\\${product.customer}

MONETIZATION

\\${product.priceModel}

ACQUISITION

\\${product.acquisition}

COMMERCIAL SCORE

\\${product.score}/100

\\${product.verdict}

Generated and deployed by TSHC App Foundry.

\\`));\napp.onError((err) => Promise.reject(err));\nexport default app.fetch;`;\n}\n\napp.get(\"/\", (c) => c.html(Root()));\nfor (const path of [\"/apps\",\"/build\",\"/tools\",\"/pricing\",\"/partners\",\"/account\",\"/admin-orders\",\"/resources\",\"/about\",\"/contact\",\"/privacy\",\"/terms\",\"/refunds\",\"/data-explorer\",\"/property-scanner\",\"/business-toolkit\"]) {\n app.get(path, (c) => c.html(Root()));\n}\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/assets/forge-home.webp\", async () => {\n const asset = await blob.get(\"assets/forge-home.webp\");\n return new Response(asset.body, { headers: { \"Content-Type\": \"image/webp\", \"Cache-Control\": \"public, max-age=86400\" } });\n});\napp.get(\"/robots.txt\", (c) => c.text(`User-agent: GPTBot\\nDisallow: /\\nUser-agent: Google-Extended\\nDisallow: /\\nUser-agent: ClaudeBot\\nDisallow: /\\nUser-agent: CCBot\\nDisallow: /\\nUser-agent: Bytespider\\nDisallow: /\\nUser-agent: Applebot-Extended\\nDisallow: /\\nUser-agent: *\\nAllow: /\\n`));\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.get(\"/api/health\", (c) => c.json({ ok: true, service: \"TSHC Sovereign Forge\", version: 3, sdgFirst: true, paymentGateway: true, entitlementGate: true, deployBridge: true }));\n\napp.get(\"/api/session\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n return c.json({ ok: true, authenticated: !!session?.user, user: session?.user ? { username: session.user.username, type: session.user.type } : null });\n});\n\napp.get(\"/api/ideas\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok:false, error:\"Owner access required\" }, 401);\n const result = await sqlite.execute(\"SELECT * FROM app_ideas ORDER BY id DESC LIMIT 50\");\n return c.json({ ok: true, ideas: result.rows });\n});\n\napp.post(\"/api/ideas\", async (c) => {\n try {\n const body = await c.req.json();\n const requesterName = requiredText(body.requester_name, \"Your name\").slice(0,120);\n const requesterEmail = requiredText(body.requester_email, \"Your email\").slice(0,200);\n if (!/^\\S+@\\S+\\.\\S+$/.test(requesterEmail)) return c.json({ok:false,error:\"Valid email required\"},400);\n const name = requiredText(body.name, \"App name\");\n const customer = requiredText(body.customer, \"Customer\");\n const problem = requiredText(body.problem, \"Problem\");\n const priceModel = requiredText(body.price_model, \"Price model\");\n const acquisition = requiredText(body.acquisition, \"Acquisition route\");\n const sdgGoals = Array.isArray(body.sdg_goals) ? [...new Set(body.sdg_goals.map((x:any)=>Number(x)).filter((x:number)=>Number.isInteger(x)&&x>=1&&x<=17))].sort((a:number,b:number)=>a-b) : [];\n const s = scoreIdea(body);\n const result = await sqlite.execute({\n sql: `INSERT INTO app_ideas (requester_name, requester_email, sdg_goals, name, customer, problem, price_model, acquisition, pain, buyer, speed, recurring, distribution, defensibility, score, verdict, status)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'queued')`,\n args: [requesterName, requesterEmail, JSON.stringify(sdgGoals), name, customer, problem, priceModel, acquisition, s.pain, s.buyer, s.speed, s.recurring, s.distribution, s.defensibility, s.score, s.verdict],\n });\n const row = await sqlite.execute({ sql: \"SELECT * FROM app_ideas WHERE id = ?\", args: [Number(result.lastInsertRowid)] });\n return c.json({ ok: true, idea: row.rows[0] }, 201);\n } catch (err) {\n return c.json({ ok: false, error: err instanceof Error ? err.message : \"Invalid request\" }, 400);\n }\n});\n\napp.patch(\"/api/ideas/:id/status\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok:false, error:\"Owner access required\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const body = await c.req.json();\n const allowed = new Set([\"queued\", \"validating\", \"building\", \"testing\", \"live\", \"paused\", \"rejected\"]);\n const status = String(body.status ?? \"\");\n if (!Number.isInteger(id) || !allowed.has(status)) return c.json({ ok: false, error: \"Invalid id or status\" }, 400);\n await sqlite.execute({ sql: \"UPDATE app_ideas SET status = ? WHERE id = ?\", args: [status, id] });\n const row = await sqlite.execute({ sql: \"SELECT * FROM app_ideas WHERE id = ?\", args: [id] });\n if (!row.rows[0]) return c.json({ ok: false, error: \"Not found\" }, 404);\n return c.json({ ok: true, idea: row.rows[0] });\n});\n\napp.get(\"/api/ideas/:id/brief\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok:false, error:\"Owner access required\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const row = await sqlite.execute({ sql: \"SELECT * FROM app_ideas WHERE id = ?\", args: [id] });\n const idea: any = row.rows[0];\n if (!idea) return c.json({ ok: false, error: \"Not found\" }, 404);\n const brief = {\n product: idea.name,\n target_customer: idea.customer,\n problem: idea.problem,\n monetization: idea.price_model,\n acquisition: idea.acquisition,\n sdg_goals: (()=>{try{return JSON.parse(idea.sdg_goals||'[]')}catch{return []}})(),\n commercial_score: idea.score,\n verdict: idea.verdict,\n mvp: [\"Single clear core workflow\", \"Persistent data model\", \"Mobile-friendly UI\", \"Analytics-ready events\", \"Production health endpoint\"],\n launch_gate: idea.score >= 65 ? \"Proceed to validation/build\" : \"Run demand test before build\",\n };\n return c.json({ ok: true, brief });\n});\n\napp.post(\"/api/ideas/:id/deploy\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || !session.accessToken || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok: false, error: \"Owner sign-in required\", login: \"/auth/login\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const row = await sqlite.execute({ sql: \"SELECT * FROM app_ideas WHERE id = ?\", args: [id] });\n const idea: any = row.rows[0];\n if (!idea) return c.json({ ok: false, error: \"Not found\" }, 404);\n if (idea.deployment_url) return c.json({ ok: true, idea, reused: true });\n\n const client = new ValTown({ bearerToken: session.accessToken });\n let createdVal: any = null;\n try {\n const name = slugify(idea.name, idea.id);\n createdVal = await client.vals.create({ name, privacy: \"public\", description: `MVP generated by TSHC App Foundry: ${idea.name}`.slice(0, 120) });\n const file = await client.vals.files.create(createdVal.id, { path: \"main.ts\", type: \"http\", content: generatedAppSource(idea) });\n const endpoint = file.links.endpoint;\n if (!endpoint) throw new Error(\"Val Town did not return a deployed endpoint\");\n await sqlite.execute({ sql: \"UPDATE app_ideas SET status = 'live', deployment_url = ?, deployment_val_id = ?, deployed_at = CURRENT_TIMESTAMP WHERE id = ?\", args: [endpoint, createdVal.id, id] });\n const updated = await sqlite.execute({ sql: \"SELECT * FROM app_ideas WHERE id = ?\", args: [id] });\n return c.json({ ok: true, idea: updated.rows[0], deployment_url: endpoint }, 201);\n } catch (err) {\n if (createdVal?.id) { try { await client.vals.delete(createdVal.id); } catch (_) {} }\n return c.json({ ok: false, error: err instanceof Error ? err.message : \"Deployment failed\" }, 500);\n }\n});\n\nconst FREE_SDG_COUNTRIES = new Set([\"USA\",\"CAN\",\"GBR\",\"NGA\",\"FRA\",\"ARE\"]);\n\napp.get(\"/api/countries\", async (c) => {\n const ent = await entitlementFromRequest(c.req.raw);\n const session = await getOAuthUserData(c.req.raw);\n const owner = session?.user?.username === \"trinlahsovereignholdingscompl\";\n if (!owner && (!ent || ent.rank < 1)) return c.json({ok:false,error:\"Impact Pro or higher is required for the full country directory\"},401);\n try {\n const r = await fetch(\"https://api.worldbank.org/v2/country?format=json&per_page=400\");\n const j:any = await r.json();\n const countries = (Array.isArray(j?.[1]) ? j[1] : [])\n .filter((x:any)=>x?.region?.value && x.region.value !== \"Aggregates\" && x.id)\n .map((x:any)=>({code:String(x.id),name:String(x.name),region:String(x.region?.value||\"\"),incomeLevel:String(x.incomeLevel?.value||\"\")}))\n .sort((a:any,b:any)=>a.name.localeCompare(b.name));\n return c.json({ok:true,count:countries.length,countries,source:\"World Bank country directory\"});\n } catch (_) {\n return c.json({ok:false,error:\"Country directory is temporarily unavailable\"},502);\n }\n});\n\napp.get(\"/api/sdg/:country\", async (c) => {\n c.header(\"Cache-Control\",\"no-store, no-cache, must-revalidate\");\n c.header(\"Pragma\",\"no-cache\");\n const country = (c.req.param(\"country\") || \"USA\").toUpperCase();\n if (!FREE_SDG_COUNTRIES.has(country)) {\n const ent = await entitlementFromRequest(c.req.raw);\n const session = await getOAuthUserData(c.req.raw);\n const owner = session?.user?.username === \"trinlahsovereignholdingscompl\";\n if (!owner && (!ent || ent.rank < 1)) return c.json({ok:false,error:\"Free access is limited to USA, Canada, United Kingdom, Nigeria, France and United Arab Emirates. Impact Pro unlocks the full country directory.\"},403);\n }\n const goals:any[] = [\n {goal:1,name:\"No Poverty\",candidates:[[\"SI.POV.NAHC\",\"Poverty headcount at national poverty lines\",\"%\"],[\"SI.POV.GINI\",\"Income inequality (poverty-risk proxy)\",\"Gini\"]]},\n {goal:2,name:\"Zero Hunger\",candidates:[[\"SN.ITK.DEFC.ZS\",\"Prevalence of undernourishment\",\"%\"],[\"SH.STA.STNT.ZS\",\"Child stunting\",\"%\"]]},\n {goal:3,name:\"Good Health & Well-being\",candidates:[[\"SP.DYN.LE00.IN\",\"Life expectancy\",\"years\"],[\"SH.XPD.CHEX.GD.ZS\",\"Current health expenditure\",\"% GDP\"]]},\n {goal:4,name:\"Quality Education\",candidates:[[\"SE.TER.ENRR\",\"Tertiary school enrollment\",\"% gross\"],[\"SE.PRM.CMPT.ZS\",\"Primary completion rate\",\"%\"]]},\n {goal:5,name:\"Gender Equality\",candidates:[[\"SL.TLF.CACT.FE.ZS\",\"Female labor force participation\",\"%\"],[\"SG.GEN.PARL.ZS\",\"Women in national parliaments\",\"% seats\"]]},\n {goal:6,name:\"Clean Water & Sanitation\",candidates:[[\"SH.H2O.SMDW.ZS\",\"Safely managed drinking water\",\"% population\"],[\"SH.STA.SMSS.ZS\",\"Safely managed sanitation\",\"% population\"]]},\n {goal:7,name:\"Affordable & Clean Energy\",candidates:[[\"EG.ELC.ACCS.ZS\",\"Access to electricity\",\"% population\"],[\"EG.FEC.RNEW.ZS\",\"Renewable energy consumption\",\"% final energy\"]]},\n {goal:8,name:\"Decent Work & Economic Growth\",candidates:[[\"NY.GDP.PCAP.KD.ZG\",\"GDP per capita growth\",\"% annual\"],[\"SL.UEM.TOTL.ZS\",\"Unemployment\",\"% labor force\"]]},\n {goal:9,name:\"Industry, Innovation & Infrastructure\",candidates:[[\"IT.NET.USER.ZS\",\"Individuals using the internet\",\"% population\"],[\"NV.IND.MANF.ZS\",\"Manufacturing value added\",\"% GDP\"]]},\n {goal:10,name:\"Reduced Inequalities\",candidates:[[\"SI.POV.GINI\",\"Gini index\",\"index\"],[\"SI.DST.FRST.20\",\"Income share held by lowest 20%\",\"% income\"]]},\n {goal:11,name:\"Sustainable Cities & Communities\",candidates:[[\"SP.URB.TOTL.IN.ZS\",\"Urban population\",\"% population\"],[\"EN.POP.SLUM.UR.ZS\",\"Urban population living in slums\",\"% urban\"]]},\n {goal:12,name:\"Responsible Consumption & Production\",candidates:[[\"EN.ATM.PM25.MC.M3\",\"PM2.5 exposure\",\"µg/m³\"],[\"EG.USE.COMM.FO.ZS\",\"Fossil-fuel energy consumption\",\"% energy\"]]},\n {goal:13,name:\"Climate Action\",candidates:[[\"EN.ATM.CO2E.PC\",\"CO2 emissions per capita\",\"t/person\"],[\"EN.GHG.ALL.PC.CE.AR5\",\"Greenhouse-gas emissions per capita\",\"tCO2e/person\"]]},\n {goal:14,name:\"Life Below Water\",candidates:[[\"ER.MRN.PTMR.ZS\",\"Marine protected areas\",\"% territorial waters\"],[\"ER.H2O.FWTL.ZS\",\"Annual freshwater withdrawals\",\"% internal resources\"]]},\n {goal:15,name:\"Life on Land\",candidates:[[\"AG.LND.FRST.ZS\",\"Forest area\",\"% land area\"],[\"ER.LND.PTLD.ZS\",\"Terrestrial protected areas\",\"% land area\"]]},\n {goal:16,name:\"Peace, Justice & Strong Institutions\",candidates:[[\"VC.IHR.PSRC.P5\",\"Intentional homicides\",\"per 100k\"],[\"GE.EST\",\"Government effectiveness\",\"index\"]]},\n {goal:17,name:\"Partnerships for the Goals\",candidates:[[\"NE.TRD.GNFS.ZS\",\"Trade and global economic connectedness\",\"% GDP\"],[\"BX.KLT.DINV.WD.GD.ZS\",\"Foreign direct investment inflows\",\"% GDP\"]]},\n ];\n async function latest(candidate:any){\n const [id,label,unit]=candidate;\n try{\n const sourceUrl=`https://api.worldbank.org/v2/country/${country}/indicator/${id}?format=json&date=2010:2026&per_page=50`;\n const r=await fetch(sourceUrl,{cache:\"no-store\",headers:{\"Cache-Control\":\"no-cache\"}});\n const j:any=await r.json();\n const row=Array.isArray(j?.[1])?j[1].find((x:any)=>x?.value!==null):null;\n if(!row) return null;\n const currentYear=new Date().getUTCFullYear();\n const observationYear=Number(row.date);\n const noNewer=Number.isFinite(observationYear) && observationYear < currentYear;\n const freshnessNote=noNewer ? `Latest available source observation is ${row.date}; no newer observation was returned by the source as of this request.` : `Latest available source observation is ${row.date}.`;\n return {id,label,unit,value:Number(row.value),year:String(row.date),source:row?.indicator?.value||label,sourceUrl,freshnessNote,noNewer};\n }catch(_){return null}\n }\n const indicators=await Promise.all(goals.map(async g=>{\n const results=await Promise.all(g.candidates.map((x:any)=>latest(x)));\n const picked=results.find(Boolean);\n return {goal:`SDG ${g.goal}`,goalNumber:g.goal,goalName:g.name,id:picked?.id||g.candidates[0][0],label:picked?.label||g.candidates[0][1],unit:picked?.unit||g.candidates[0][2],value:picked?.value??null,year:picked?.year??null,dataSource:picked?.source||null,sourceUrl:picked?.sourceUrl||null,freshnessNote:picked?.freshnessNote||\"No published observation was returned by the source for the configured indicator set.\",noNewer:picked?.noNewer??true};\n }));\n const available=indicators.filter(x=>x.value!==null).length;\n return c.json({ok:true,country,source:\"World Bank API\",retrievedAt:new Date().toISOString(),available,total:17,coverage:Math.round(available/17*100),freeCountries:[\"USA\",\"CAN\",\"GBR\",\"NGA\",\"FRA\",\"ARE\"],indicators,methodology:\"Forge requests the latest available public World Bank observations at query time and selects a relevant signal for each SDG. When a newer observation is not available, the displayed source year is explicitly identified. These are decision-support signals, not official UN SDG scores.\"});\n});\n\nconst stateFips:Record={AL:'01',AK:'02',AZ:'04',AR:'05',CA:'06',CO:'08',CT:'09',DE:'10',DC:'11',FL:'12',GA:'13',HI:'15',ID:'16',IL:'17',IN:'18',IA:'19',KS:'20',KY:'21',LA:'22',ME:'23',MD:'24',MA:'25',MI:'26',MN:'27',MS:'28',MO:'29',MT:'30',NE:'31',NV:'32',NH:'33',NJ:'34',NM:'35',NY:'36',NC:'37',ND:'38',OH:'39',OK:'40',OR:'41',PA:'42',RI:'44',SC:'45',SD:'46',TN:'47',TX:'48',UT:'49',VT:'50',VA:'51',WA:'53',WV:'54',WI:'55',WY:'56'};\nfunction n(v:any){const x=Number(v);return Number.isFinite(x)?x:0}\nfunction cap(v:number){return Math.max(0,Math.min(100,Math.round(v)))}\napp.get(\"/api/property-sources\", async (c) => {\n const country = String(c.req.query(\"country\") || \"USA\").toUpperCase();\n const state = String(c.req.query(\"state\") ?? ((country === 'USA' || country === 'US') ? \"VA\" : \"\")).toUpperCase();\n const county = String(c.req.query(\"county\") || \"\").trim();\n const q = country === 'USA' || country === 'US' ? (county ? `${county} County ${state}` : state) : (county ? `${county}, ${country}` : country);\n const enc = encodeURIComponent(q);\n if(country !== 'USA' && country !== 'US'){\n const sources=[\n {type:'Global',name:'Government Property / Surplus Search',url:`https://www.google.com/search?q=${enc}+government+surplus+property+auction`},\n {type:'Global',name:'Tax / Distressed Property Search',url:`https://www.google.com/search?q=${enc}+tax+delinquent+distressed+property+auction`},\n {type:'Global',name:'Bank / Receiver Property Search',url:`https://www.google.com/search?q=${enc}+bank+owned+receiver+property+sale`},\n {type:'Global',name:'Land / Development Authority Search',url:`https://www.google.com/search?q=${enc}+land+authority+property+sale`},\n ];\n const ids=[['SI.POV.GINI',10,'Reduced Inequalities','Gini index'],['NY.GDP.PCAP.KD.ZG',8,'Decent Work & Economic Growth','GDP per capita growth %'],['EG.ELC.ACCS.ZS',7,'Affordable & Clean Energy','Electricity access %'],['SP.DYN.LE00.IN',3,'Good Health & Well-being','Life expectancy'],['SE.PRM.CMPT.ZS',4,'Quality Education','Primary completion %']];\n const metrics=(await Promise.all(ids.map(async ([id,goal,label,unit])=>{try{const r=await fetch(`https://api.worldbank.org/v2/country/${country}/indicator/${id}?format=json&per_page=8`);const j:any=await r.json();const row=Array.isArray(j?.[1])?j[1].find((x:any)=>x?.value!==null):null;return row?{goal,label,value:row.value,unit,score:null,year:row.date}:null}catch(_){return null}}))).filter(Boolean);\n return c.json({ok:true,country,state,county,sources,sdg:{available:metrics.length>0,area:q,source:'World Bank API',metrics,overall:null,note:'International scans use public country indicators as context. No official UN or property valuation score is implied.'},note:'Global property discovery uses public search routes because auction and distressed-property systems vary by country and jurisdiction.'});\n }\n const sources = [\n { type: \"Federal\", name: \"GSA Real Property Disposal\", url: \"https://disposal.gsa.gov/s/\" },\n { type: \"Federal\", name: \"HUD Home Store\", url: \"https://www.hudhomestore.gov/\" },\n { type: \"Federal\", name: \"USDA Rural Development Properties\", url: \"https://properties.sc.egov.usda.gov/resales/public/home\" },\n { type: \"Federal\", name: \"Treasury Real Property Auctions\", url: \"https://www.treasury.gov/auctions/treasury/rp/\" },\n { type: \"Local\", name: \"Tax Sale / Delinquent Tax Search\", url: `https://www.google.com/search?q=${enc}+tax+sale+delinquent+property` },\n { type: \"Local\", name: \"Land Bank Search\", url: `https://www.google.com/search?q=${enc}+land+bank+properties` },\n { type: \"Local\", name: \"Sheriff / Foreclosure Sale Search\", url: `https://www.google.com/search?q=${enc}+sheriff+foreclosure+sale+property` },\n { type: \"Local\", name: \"County Surplus Property Search\", url: `https://www.google.com/search?q=${enc}+county+surplus+real+estate` },\n ];\n let sdg:any={available:false,area:q,source:'U.S. Census ACS 5-year',metrics:[],overall:null};\n try{\n const sf=stateFips[state];\n if(sf){\n let countyFips='';\n if(county){\n const csv=await (await fetch('https://raw.githubusercontent.com/kjhealy/fips-codes/master/state_and_county_fips_master.csv')).text();\n const lines=csv.split(/\\r?\\n/).slice(1);\n const hit=lines.find(line=>{const parts=line.split(',');const fips=String(parts[0]||'').replaceAll('\"','').padStart(5,'0');const name=String(parts[1]||'').replaceAll('\"','').toLowerCase();const st=String(parts[2]||'').replaceAll('\"','').trim().toUpperCase();return st===state&&fips.startsWith(sf)&&name.includes(county.toLowerCase())});\n if(hit) countyFips=String(hit.split(',')[0]||'').replaceAll('\"','').padStart(5,'0').slice(2);\n }\n const geoid=countyFips?`05000US${sf}${countyFips}`:`04000US${sf}`;\n const cr:any=await (await fetch(`https://api.censusreporter.org/1.0/data/show/latest?table_ids=B17001,B19013,B19083,B23025,B25003,B15003&geo_ids=${geoid}`)).json();\n const d=cr?.data?.[geoid];\n if(d){\n const e=(table:string,key:string)=>n(d?.[table]?.estimate?.[key]);\n const poverty=e('B17001','B17001002')/Math.max(1,e('B17001','B17001001'))*100;\n const unemployment=e('B23025','B23025005')/Math.max(1,e('B23025','B23025003'))*100;\n const ownership=e('B25003','B25003002')/Math.max(1,e('B25003','B25003001'))*100;\n const degree=(e('B15003','B15003022')+e('B15003','B15003023')+e('B15003','B15003024')+e('B15003','B15003025'))/Math.max(1,e('B15003','B15003001'))*100;\n const gini=e('B19083','B19083001'),income=e('B19013','B19013001');\n const metrics=[\n {goal:1,label:'No Poverty',value:poverty,unit:'% below poverty',score:cap(100-poverty*4.5)},\n {goal:4,label:'Quality Education',value:degree,unit:'% bachelor degree or higher',score:cap(degree*2.4)},\n {goal:8,label:'Decent Work & Economic Growth',value:unemployment,unit:'% unemployment',score:cap(100-unemployment*7)},\n {goal:10,label:'Reduced Inequalities',value:gini,unit:'Gini index (0–1)',score:cap((1-gini)*100)},\n {goal:11,label:'Sustainable Cities & Communities',value:ownership,unit:'% owner-occupied housing',score:cap(ownership*1.2)},\n {goal:17,label:'Partnerships / Economic Capacity',value:income,unit:'median household income',score:cap(income/1000)},\n ];\n sdg={available:true,area:cr?.geography?.[geoid]?.name||q,source:cr?.release?.name||'American Community Survey',metrics,overall:Math.round(metrics.reduce((a:any,m:any)=>a+m.score,0)/metrics.length),note:'Directional local SDG alignment score built from public socioeconomic indicators; it is not an official UN SDG score.'};\n }\n }\n }catch(e){sdg.error='Local SDG data unavailable for this scan.'}\n return c.json({ ok: true, state, county, sources, sdg, note: \"Property discovery plus local SDG context. Listing-level aggregation varies by jurisdiction and provider access.\" });\n});\n\napp.post(\"/api/purchase-intents\", async (c) => {\n try {\n const body = await c.req.json();\n const name = requiredText(body.name, \"Name\").slice(0, 120);\n const email = requiredText(body.email, \"Email\").slice(0, 200);\n if (!/^\\S+@\\S+\\.\\S+$/.test(email)) return c.json({ ok:false, error:\"Valid email required\" }, 400);\n const catalog:any = {\n \"Impact Pro\": { amount:79, billing:\"monthly\" },\n \"Property Intelligence\": { amount:149, billing:\"monthly\" },\n \"Forge Pro\": { amount:249, billing:\"monthly\" },\n \"Enterprise\": { amount:999, billing:\"monthly\" },\n \"SDG Validation Sprint\": { amount:500, billing:\"one-time\" },\n \"SDG MVP Build Sprint\": { amount:2500, billing:\"one-time\" },\n };\n const plan = String(body.plan || \"\");\n const item = catalog[plan];\n if (!item) return c.json({ ok:false, error:\"Unknown plan\" }, 400);\n const r = await sqlite.execute({ sql:\"INSERT INTO purchase_intents (name,email,plan,amount,billing,status) VALUES (?,?,?,?,?,'creating_paypal')\", args:[name,email,plan,item.amount,item.billing] });\n const orderId = Number(r.lastInsertRowid);\n const origin = new URL(c.req.url).origin;\n const gateway = await fetch(\"https://tshc-payments-gateway.floot.app/_api/paypal/create-order\", {\n method:\"POST\",\n headers:{\"Content-Type\":\"application/json\"},\n body:JSON.stringify({ plan, forgeOrderId:orderId, returnUrl:`${origin}/pricing?paypal=return`, cancelUrl:`${origin}/pricing?paypal=cancel` }),\n });\n const payment:any = await gateway.json();\n if (!gateway.ok || !payment.ok) {\n await sqlite.execute({ sql:\"UPDATE purchase_intents SET status='payment_error' WHERE id=?\", args:[orderId] });\n return c.json({ ok:false, error:payment.error || \"Unable to create PayPal checkout\" }, 502);\n }\n await sqlite.execute({ sql:\"UPDATE purchase_intents SET status='pending_paypal', paypal_order_id=?, paypal_mode=? WHERE id=?\", args:[payment.orderId,payment.mode,orderId] });\n return c.json({ ok:true, order_id:orderId, plan, amount:item.amount, billing:item.billing, status:\"pending_paypal\", paypal_order_id:payment.orderId, approval_url:payment.approvalUrl, paypal_mode:payment.mode }, 201);\n } catch (err) { return c.json({ ok:false, error:err instanceof Error?err.message:\"Invalid request\" }, 400); }\n});\n\napp.post(\"/api/paypal/capture\", async (c) => {\n try {\n const body = await c.req.json();\n const paypalOrderId = requiredText(body.orderId, \"PayPal order ID\").slice(0, 120);\n const gateway = await fetch(\"https://tshc-payments-gateway.floot.app/_api/paypal/capture-order\", {\n method:\"POST\",\n headers:{\"Content-Type\":\"application/json\"},\n body:JSON.stringify({ orderId:paypalOrderId }),\n });\n const paid:any = await gateway.json();\n if (!gateway.ok || !paid.ok || paid.status !== \"COMPLETED\") return c.json({ ok:false, error:paid.error || \"Payment was not completed\" }, 402);\n const order = await sqlite.execute({ sql:\"SELECT * FROM purchase_intents WHERE id=? AND paypal_order_id=?\", args:[paid.forgeOrderId,paypalOrderId] });\n const row:any = order.rows[0];\n if (!row) return c.json({ ok:false, error:\"Forge order does not match PayPal order\" }, 409);\n if (row.plan !== paid.plan || Number(row.amount).toFixed(2) !== Number(paid.amount).toFixed(2)) return c.json({ ok:false, error:\"Payment verification mismatch\" }, 409);\n let ent = await sqlite.execute({ sql:\"SELECT * FROM entitlements WHERE order_id=?\", args:[row.id] });\n if (!ent.rows[0]) {\n const accessKey = crypto.randomUUID().replaceAll(\"-\",\"\") + crypto.randomUUID().replaceAll(\"-\",\"\");\n const expiresAt = row.billing === 'monthly' ? new Date(Date.now()+30*24*60*60*1000).toISOString() : null;\n await sqlite.execute({ sql:\"INSERT INTO entitlements (order_id,email,plan,access_key,expires_at) VALUES (?,?,?,?,?)\", args:[row.id,row.email,row.plan,accessKey,expiresAt] });\n await sqlite.execute({ sql:\"UPDATE purchase_intents SET status='paid_active', paid_at=CURRENT_TIMESTAMP WHERE id=?\", args:[row.id] });\n ent = await sqlite.execute({ sql:\"SELECT * FROM entitlements WHERE order_id=?\", args:[row.id] });\n }\n const entitlement:any = ent.rows[0];\n return c.json({ ok:true, status:\"paid_active\", order_id:row.id, plan:row.plan, access_key:entitlement.access_key });\n } catch (err) { return c.json({ ok:false, error:err instanceof Error?err.message:\"Payment capture failed\" }, 400); }\n});\n\napp.get(\"/api/purchase-intents\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok:false, error:\"Owner sign in required\" }, 401);\n const r = await sqlite.execute(\"SELECT * FROM purchase_intents ORDER BY id DESC LIMIT 100\");\n return c.json({ ok:true, orders:r.rows });\n});\n\napp.post(\"/api/purchase-intents/:id/activate\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ ok:false, error:\"Owner sign in required\" }, 401);\n const id = Number(c.req.param(\"id\"));\n const order = await sqlite.execute({ sql:\"SELECT * FROM purchase_intents WHERE id = ?\", args:[id] });\n const row:any = order.rows[0];\n if (!row) return c.json({ ok:false, error:\"Order not found\" }, 404);\n let ent = await sqlite.execute({ sql:\"SELECT * FROM entitlements WHERE order_id = ?\", args:[id] });\n if (!ent.rows[0]) {\n const accessKey = crypto.randomUUID().replaceAll(\"-\",\"\") + crypto.randomUUID().replaceAll(\"-\",\"\");\n const expiresAt = row.billing === 'monthly' ? new Date(Date.now()+30*24*60*60*1000).toISOString() : null;\n await sqlite.execute({ sql:\"INSERT INTO entitlements (order_id,email,plan,access_key,expires_at) VALUES (?,?,?,?,?)\", args:[id,row.email,row.plan,accessKey,expiresAt] });\n await sqlite.execute({ sql:\"UPDATE purchase_intents SET status = 'paid_active' WHERE id = ?\", args:[id] });\n ent = await sqlite.execute({ sql:\"SELECT * FROM entitlements WHERE order_id = ?\", args:[id] });\n }\n return c.json({ ok:true, entitlement:ent.rows[0] });\n});\n\napp.post(\"/api/access/verify\", async (c) => {\n const body = await c.req.json().catch(()=>({}));\n const key = String(body.key||\"\").trim();\n if(!key) return c.json({ok:false,error:\"Access key required\"},400);\n const r = await sqlite.execute({ sql:\"SELECT plan, active, created_at, expires_at FROM entitlements WHERE access_key = ?\", args:[key] });\n const row:any = r.rows[0];\n if (!row || !row.active) return c.json({ ok:false, error:\"Invalid or inactive access key\" }, 404);\n if(row.expires_at && new Date(String(row.expires_at)).getTime(){\n const ent=await entitlementFromRequest(c.req.raw);\n if(!ent) return c.json({ok:false,error:\"Premium access required\"},401);\n return c.json({ok:true,...ent});\n});\napp.post(\"/api/contact\", async (c) => {\n try {\n const body = await c.req.json();\n const name = requiredText(body.name, \"Name\").slice(0,120);\n const email = requiredText(body.email, \"Email\").slice(0,200);\n if (!/^\\S+@\\S+\\.\\S+$/.test(email)) return c.json({ok:false,error:\"Valid email required\"},400);\n const organization = String(body.organization||\"\").trim().slice(0,160);\n const subject = requiredText(body.subject, \"Subject\").slice(0,160);\n const message = requiredText(body.message, \"Message\").slice(0,5000);\n const r = await sqlite.execute({sql:\"INSERT INTO contact_requests (name,email,organization,subject,message) VALUES (?,?,?,?,?)\",args:[name,email,organization,subject,message]});\n return c.json({ok:true,id:Number(r.lastInsertRowid),message:\"Request received. TSHC will review it.\"},201);\n } catch(err) { return c.json({ok:false,error:err instanceof Error?err.message:\"Invalid request\"},400); }\n});\napp.get(\"/api/contact\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ok:false,error:\"Owner access required\"},401);\n const r=await sqlite.execute(\"SELECT * FROM contact_requests ORDER BY id DESC LIMIT 100\");\n return c.json({ok:true,requests:r.rows});\n});\n\napp.post(\"/api/analytics/event\", async (c) => {\n try {\n const origin = c.req.header(\"Origin\");\n const ownOrigin = new URL(c.req.url).origin;\n if (origin && origin !== ownOrigin) return c.json({ok:false,error:\"Origin rejected\"},403);\n const body = await c.req.json();\n const allowed = new Set([\"page_view\",\"click\",\"outbound_click\",\"checkout_click\",\"partner_cta_click\",\"contact_cta_click\",\"build_cta_click\"]);\n const eventName = String(body.event_name || \"\");\n if (!allowed.has(eventName)) return c.json({ok:false,error:\"Invalid event\"},400);\n const clean = (value:unknown,max:number) => String(value || \"\").replace(/[\\r\\n\\t]+/g,\" \").trim().slice(0,max);\n const path = clean(body.path,200);\n const sessionId = clean(body.session_id,80);\n if (!path.startsWith(\"/\") || !/^[a-zA-Z0-9-]{16,80}$/.test(sessionId)) return c.json({ok:false,error:\"Invalid analytics payload\"},400);\n const target = clean(body.target,120);\n const destination = clean(body.destination,240);\n const referrerHost = clean(body.referrer_host,160);\n const utmSource = clean(body.utm_source,80);\n const utmMedium = clean(body.utm_medium,80);\n const utmCampaign = clean(body.utm_campaign,120);\n const utmContent = clean(body.utm_content,120);\n await sqlite.execute({\n sql:\"INSERT INTO analytics_events (event_name,path,target,destination,referrer_host,utm_source,utm_medium,utm_campaign,utm_content,session_id) VALUES (?,?,?,?,?,?,?,?,?,?)\",\n args:[eventName,path,target,destination,referrerHost,utmSource,utmMedium,utmCampaign,utmContent,sessionId]\n });\n mirrorForgeAnalytics(eventName, sessionId, {\n path,\n target: target || undefined,\n destination: destination || undefined,\n referrer_host: referrerHost || undefined,\n utm_source: utmSource || undefined,\n utm_medium: utmMedium || undefined,\n utm_campaign: utmCampaign || undefined,\n utm_content: utmContent || undefined,\n });\n return c.body(null,204);\n } catch (_) {\n return c.json({ok:false,error:\"Invalid analytics payload\"},400);\n }\n});\n\napp.get(\"/api/analytics/summary\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user || session.user.username !== \"trinlahsovereignholdingscompl\") return c.json({ok:false,error:\"Owner access required\"},401);\n const [totals,byEvent,byPath,bySource,byCampaign,daily,purchases,contacts,builds] = await Promise.all([\n sqlite.execute(`SELECT COUNT(*) AS events,\n COUNT(DISTINCT session_id) AS sessions,\n SUM(CASE WHEN event_name='page_view' THEN 1 ELSE 0 END) AS page_views,\n SUM(CASE WHEN event_name='checkout_click' THEN 1 ELSE 0 END) AS checkout_clicks,\n SUM(CASE WHEN event_name='partner_cta_click' THEN 1 ELSE 0 END) AS partner_clicks,\n SUM(CASE WHEN event_name='contact_cta_click' THEN 1 ELSE 0 END) AS contact_clicks,\n SUM(CASE WHEN event_name='build_cta_click' THEN 1 ELSE 0 END) AS build_clicks\n FROM analytics_events WHERE created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test'`),\n sqlite.execute(\"SELECT event_name,COUNT(*) AS count FROM analytics_events WHERE created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test' GROUP BY event_name ORDER BY count DESC\"),\n sqlite.execute(\"SELECT path,COUNT(*) AS page_views,COUNT(DISTINCT session_id) AS sessions FROM analytics_events WHERE event_name='page_view' AND created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test' GROUP BY path ORDER BY page_views DESC LIMIT 30\"),\n sqlite.execute(\"SELECT COALESCE(NULLIF(utm_source,''),'direct/unknown') AS source,COUNT(DISTINCT session_id) AS sessions FROM analytics_events WHERE created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test' GROUP BY source ORDER BY sessions DESC LIMIT 30\"),\n sqlite.execute(\"SELECT COALESCE(NULLIF(utm_campaign,''),'unattributed') AS campaign,COUNT(DISTINCT session_id) AS sessions FROM analytics_events WHERE created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test' GROUP BY campaign ORDER BY sessions DESC LIMIT 30\"),\n sqlite.execute(\"SELECT date(created_at) AS day,COUNT(DISTINCT session_id) AS sessions,SUM(CASE WHEN event_name='page_view' THEN 1 ELSE 0 END) AS page_views FROM analytics_events WHERE created_at >= datetime('now','-30 days') AND COALESCE(utm_source,'') <> 'codex_test' GROUP BY day ORDER BY day\"),\n sqlite.execute(\"SELECT COUNT(*) AS intents,SUM(CASE WHEN status='paid_active' THEN 1 ELSE 0 END) AS paid_orders,COALESCE(SUM(CASE WHEN status='paid_active' THEN amount ELSE 0 END),0) AS verified_revenue FROM purchase_intents WHERE created_at >= datetime('now','-30 days')\"),\n sqlite.execute(\"SELECT COUNT(*) AS contact_requests FROM contact_requests WHERE created_at >= datetime('now','-30 days')\"),\n sqlite.execute(\"SELECT COUNT(*) AS build_requests FROM app_ideas WHERE created_at >= datetime('now','-30 days')\")\n ]);\n return c.json({\n ok:true,window_days:30,privacy:\"Anonymous session-level analytics; no IP address, user agent or form content stored.\",\n totals:totals.rows[0],by_event:byEvent.rows,by_path:byPath.rows,by_source:bySource.rows,\n by_campaign:byCampaign.rows,daily:daily.rows,\n conversions:{...(purchases.rows[0] as any),...(contacts.rows[0] as any),...(builds.rows[0] as any)}\n });\n});\n\napp.onError((err) => Promise.reject(err));\nexport default oauthMiddleware(app.fetch);","children",[],[184],"471b5774-b9e9-4c92-80c4-9ae35b7ed57b","README.md","01a0931d-4f94-72bb-aad6-541ee31b495b",42,["D",1789177879936],"# TSHC Sovereign Forge\n\nMonetization-first digital product platform for TSHC.\n\n## PayPal checkout integration\n\nThe production checkout routes are designed to use PayPal Orders v2 server-side. Add these encrypted environment variables before enabling live checkout:\n\n- `PAYPAL_CLIENT_ID`\n- `PAYPAL_CLIENT_SECRET`\n- `PAYPAL_MODE` = `sandbox` or `live` (defaults to `sandbox` until explicitly changed)\n\nThe app should never expose the client secret to the browser. Order creation and capture must remain server-side. If credentials are not present, the Forge falls back to the existing invoice/order-intake flow rather than pretending checkout succeeded.\n\n## Revenue flow\n\nPricing -> order intake -> PayPal checkout or invoice -> payment confirmation -> entitlement activation -> member access.\n\n## Owner controls\n\nOwner-only paid-order activation remains available for invoice/manual-payment workflows. Automatic entitlement activation should occur only after a verified PayPal capture.\n",[],[193],"e0643d78-2ef4-49ea-9f86-375bb21412e4","CHANGELOG.md","01a0931d-4f94-72bb-aad6-519736a08e1a",["D",1789174566710],"# Changelog\n\n## 2026-07-30 — Immutable asset caching\n\nFrontend files are now served at version-addressed URLs\n(`/__immutable/45/frontend/index.tsx`) with\n`Cache-Control: public, max-age=31536000, immutable`, so repeat visits load the\nwhole client graph from the browser cache — roughly 3× faster (~665ms → ~157ms\nmeasured). Publishing your val bumps its version, which changes every URL, so\ncaches invalidate automatically. Old-version URLs return 404 after a publish\n(like Next.js build assets); a reload picks up the new version.\n\nWhat changed in the template:\n\n- `frontend/index.html` → [`frontend/root.tsx`](/frontend/root.tsx): the HTML\n shell is now JSX and stamps asset URLs with `immutableFileUrl()`\n- [`index.ts`](/index.ts): serves `Root()` at `/`, and one\n `app.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path))` route\n serves all frontend files\n\n### Upgrading an existing remix\n\nYour copy of this template doesn't update automatically. Two options:\n\n**Minimal (most of the benefit):** point both routes at `serveImmutableFile` —\nyour existing bare URLs redirect into versioned space, the new route serves\nthem, and the whole module graph gets cached (costs one redirect per page view):\n\n```ts\nimport { serveImmutableFile } from \"https://esm.town/v/std/utils/index.ts\";\n\napp.get(\"/__immutable/*\", (c) => serveImmutableFile(c.req.path));\napp.get(\"/frontend/**/*\", (c) => serveImmutableFile(c.req.path)); // was serveFile\n```\n\n**Full upgrade (also removes the redirect):** three self-contained steps —\nno other files needed. Adjust the ``, favicon, and body of `Root()` to\nmatch your app's existing `index.html`, and stamp anything else your shell\nreferences directly (images, css) with `immutableFileUrl()`.\n\n1. Create `frontend/root.tsx`:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\nimport { immutableFileUrl } from \"https://esm.town/v/std/utils/index.ts\";\n\n// The HTML shell for the app. It is never cached, so immutableFileUrl can stamp\n// the current val version into each asset URL — the browser caches those\n// immutably, and publishing the val changes the URLs, refetching exactly once.\nexport function Root() {\n return (\n <>\n {raw(\"<!DOCTYPE html>\")}\n <html lang=\"en\">\n <head>\n <meta charSet=\"UTF-8\" />\n <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n <title>React Hono Val Town Starter\n

History · index.tsx