${esc(subject)}

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_151":152,"_153":154},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_114":-5,"_20":115,"_22":116,"_117":118,"_119":120,"_25":121,"_24":-5,"_122":-5,"_123":-5,"_124":53,"_125":126,"_127":44,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","bibtool","name","bibBundle","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","05328f88-45bb-4868-8a9d-590a8813f4b5","main.ts","fileId","555b76c6-7f1d-11f1-8dc2-1607ee4eb77e","parentId","branchId","eb1afc55-4aa9-4393-a24a-f8f1a1401371","branchVersion",4,"latest",true,"createdAt",["D",1783989972094],3,"fileType","http","content","// BiB Bundle Server — one domain for every fixed briefing fetch\n// Trigger type: HTTP\n//\n// PURPOSE: Cowork raises one permission dialog per DOMAIN per session, and\n// approvals do not persist between sessions. This val proxies the briefing's\n// fixed, pre-authorised sources through a single val.town domain, so the\n// daily click-through shrinks. It is NOT an open proxy: only the allowlisted\n// routes below can be fetched — every upstream is a source Andrew already\n// approves by hand on every run.\n//\n// Env vars: uses BIB_BUNDLE_SECRET if set, otherwise falls back to the\n// existing BIB_FEED_SECRET (same one the newsletter feed uses).\n//\n// Base URL (store in bundle-feed-url.txt, one line, treat as credential):\n// https://-bibbundle.web.val.run/bundle/\n//\n// Routes (append to base URL):\n// /index — JSON list of routes (cheap warm-up / health ping)\n// /bbc — BBC Business RSS (cb param passed upstream)\n// /investing-14 — Investing.com economy RSS (news_14)\n// /investing-25 — Investing.com markets RSS (news_25)\n// /investing-1 — Investing.com top news RSS (news_1)\n// /investing-11 — Investing.com commodities RSS (news_11)\n// /ff-calendar — Forex Factory this-week calendar JSON\n// /treasury — TreasuryDirect upcoming auctions JSON\n// /substack-krugman | -elerian | -noahpinion | -slowboring | -delong\n// — latest posts JSON (limit=2)\n// /bsky?actor=&limit=5 — Bluesky getAuthorFeed for one handle\n// /newsletter — the newsletter Atom feed (read from shared SQLite,\n// same output as bibFeedServer — old val stays live as fallback)\n// /earnings — the earnings JSON (read from shared SQLite,\n// same output as earningsServer — old val stays live as fallback)\n//\n// Cache-busting: ?cb= works on every route — auth uses\n// pathname only, and cb is passed through to upstreams that need it (BBC).\n//\n// Upstream failures return HTTP 502 with a JSON body:\n// { \"bundle_error\": \"...\", \"route\": \"...\", \"upstream_status\": ... }\n// The skill treats that as a source failure and falls back to the direct URL.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst SECRET = Deno.env.get(\"BIB_BUNDLE_SECRET\") ??\n Deno.env.get(\"BIB_FEED_SECRET\") ?? \"\";\n\nconst UA =\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) BiBBundle/1.0 (+val.town)\";\n\n// Fixed route → upstream map. Add routes here only; never accept arbitrary URLs.\nconst ROUTES: Record = {\n \"bbc\": \"https://feeds.bbci.co.uk/news/business/rss.xml\",\n \"investing-14\": \"https://www.investing.com/rss/news_14.rss\",\n \"investing-25\": \"https://www.investing.com/rss/news_25.rss\",\n \"investing-1\": \"https://www.investing.com/rss/news_1.rss\",\n \"investing-11\": \"https://www.investing.com/rss/news_11.rss\",\n \"ff-calendar\": \"https://nfs.faireconomy.media/ff_calendar_thisweek.json\",\n \"treasury\":\n \"https://www.treasurydirect.gov/TA_WS/securities/upcoming?format=json\",\n \"substack-krugman\": \"https://paulkrugman.substack.com/api/v1/posts?limit=2\",\n \"substack-elerian\":\n \"https://mohamedelerian.substack.com/api/v1/posts?limit=2\",\n \"substack-noahpinion\": \"https://noahpinion.substack.com/api/v1/posts?limit=2\",\n \"substack-slowboring\": \"https://www.slowboring.com/api/v1/posts?limit=2\",\n \"substack-delong\": \"https://braddelong.substack.com/api/v1/posts?limit=2\",\n};\n\nfunction err(route: string, msg: string, upstreamStatus?: number): Response {\n return new Response(\n JSON.stringify({\n bundle_error: msg,\n route,\n upstream_status: upstreamStatus ?? null,\n }),\n { status: 502, headers: { \"Content-Type\": \"application/json\" } },\n );\n}\n\nasync function proxy(route: string, upstream: string, cb: string | null) {\n let url = upstream;\n if (cb && route === \"bbc\") {\n url += (url.includes(\"?\") ? \"&\" : \"?\") + \"cb=\" + encodeURIComponent(cb);\n }\n const ctrl = new AbortController();\n const timer = setTimeout(() => ctrl.abort(), 25_000);\n try {\n const r = await fetch(url, {\n headers: { \"User-Agent\": UA, \"Accept\": \"*/*\" },\n signal: ctrl.signal,\n });\n if (!r.ok) return err(route, \"upstream returned non-OK status\", r.status);\n const body = await r.text();\n if (body.trim() === \"\") {\n return err(route, \"upstream returned empty body\", r.status);\n }\n return new Response(body, {\n headers: {\n \"Content-Type\": r.headers.get(\"Content-Type\") ??\n \"text/plain; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n \"X-BiB-Upstream\": upstream,\n \"X-BiB-Upstream-Status\": String(r.status),\n \"X-BiB-Fetched-At\": new Date().toISOString(),\n },\n });\n } catch (e) {\n return err(route, `fetch failed: ${String(e).slice(0, 200)}`);\n } finally {\n clearTimeout(timer);\n }\n}\n\n// ---------- /newsletter — same output as bibFeedServer ----------\n\nconst esc = (s: unknown) =>\n String(s ?? \"\")\n .replace(/&/g, \"&\")\n .replace(//g, \">\");\n\nconst stripTags = (s: string) =>\n s.replace(/<[^>]+>/g, \" \")\n .replace(/ /gi, \" \").replace(/&/gi, \"&\")\n .replace(/</gi, \"<\").replace(/>/gi, \">\")\n .replace(/"/gi, '\"').replace(/'/gi, \"'\")\n .replace(/—/gi, \"—\").replace(/–/gi, \"–\")\n .replace(/[-‍‌]/g, \"\")\n .replace(/[^\\S\\n]+/g, \" \").trim();\n\nfunction extractStoryContent(html: string): string {\n const results: string[] = [];\n const seenUrls = new Set();\n const boilerplateUrl =\n /unsubscri|optout|preference|manage|forward|mailto:|tracking\\.|click\\.|utm_|\\/r\\//i;\n const boilerplateText =\n /unsubscri|manage pref|view in browser|privacy|terms of use|follow us|©|all rights reserved|^read more$|^click here$|^find out more$/i;\n const blockRe =\n /<(?:p|td|th|li|h[1-6])(?:\\s[^>]*)?>[\\s\\S]*?<\\/(?:p|td|th|li|h[1-6])>/gi;\n let m: RegExpExecArray | null;\n const cleaned = html\n .replace(/]*>[\\s\\S]*?<\\/style>/gi, \"\")\n .replace(/]*>[\\s\\S]*?<\\/script>/gi, \"\");\n while ((m = blockRe.exec(cleaned)) !== null) {\n const block = m[0];\n const linkM = block.match(/href=[\"'](https?:\\/\\/[^\"'\\s>]{10,})[\"']/i);\n if (!linkM) continue;\n const url = linkM[1];\n if (boilerplateUrl.test(url)) continue;\n if (seenUrls.has(url)) continue;\n seenUrls.add(url);\n const text = stripTags(block);\n if (text.length < 25) continue;\n if (boilerplateText.test(text)) continue;\n results.push(`${text}\\n → ${url}`);\n }\n if (results.length === 0) {\n return stripTags(cleaned).replace(/\\s{2,}/g, \" \").slice(0, 8000);\n }\n return results.join(\"\\n\\n\");\n}\n\nasync function newsletterFeed(): Promise {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS bib_newsletters (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n received_at TEXT NOT NULL,\n sender TEXT,\n subject TEXT,\n html TEXT,\n body TEXT\n )\n `);\n const result = await sqlite.execute(`\n SELECT id, received_at, sender, subject, html, body\n FROM bib_newsletters\n ORDER BY received_at DESC\n LIMIT 50\n `);\n const entries = result.rows.map((\n [id, received_at, sender, subject, html, body],\n ) =>\n ` \n urn:bib:${id}\n ${esc(subject)}\n ${esc(sender)}\n ${new Date(String(received_at)).toISOString()}\n \n `\n );\n const feedUpdated = result.rows.length > 0\n ? new Date(String(result.rows[0][1])).toISOString()\n : new Date(0).toISOString();\n const feed = `\n\n BiB Newsletters\n urn:bib:newsletters\n ${feedUpdated}\n${entries.join(\"\\n\")}\n`;\n return new Response(feed, {\n headers: {\n \"Content-Type\": \"text/xml; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n}\n\n// ---------- /earnings — same output as earningsServer ----------\n\nasync function earningsFeed(): Promise {\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS bib_earnings (\n report_date TEXT NOT NULL,\n symbol TEXT NOT NULL,\n name TEXT,\n estimate TEXT,\n currency TEXT\n )\n `);\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS bib_earnings_meta (\n k TEXT PRIMARY KEY,\n v TEXT\n )\n `);\n const meta = await sqlite.execute(\n `SELECT v FROM bib_earnings_meta WHERE k = 'fetched_at'`,\n );\n const fetchedAt = meta.rows.length > 0 ? String(meta.rows[0][0]) : null;\n const result = await sqlite.execute(`\n SELECT report_date, symbol, name, estimate, currency\n FROM bib_earnings\n ORDER BY report_date ASC, symbol ASC\n `);\n const days: Record<\n string,\n {\n symbol: string;\n name: string;\n estimate: string | null;\n currency: string;\n }[]\n > = {};\n for (const [report_date, symbol, name, estimate, currency] of result.rows) {\n const d = String(report_date);\n (days[d] ??= []).push({\n symbol: String(symbol),\n name: String(name ?? \"\"),\n estimate: estimate === null ? null : String(estimate),\n currency: String(currency ?? \"USD\"),\n });\n }\n const payload = {\n source: \"alphavantage EARNINGS_CALENDAR (US-listed only)\",\n fetched_at: fetchedAt,\n generated_at: new Date().toISOString(),\n total_companies: result.rows.length,\n days,\n };\n return new Response(JSON.stringify(payload, null, 1), {\n headers: {\n \"Content-Type\": \"application/json; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n },\n });\n}\n\n// ---------- router ----------\n\nexport default async function (req: Request): Promise {\n const u = new URL(req.url);\n const prefix = `/bundle/${SECRET}/`;\n if (SECRET === \"\" || !u.pathname.startsWith(prefix)) {\n return new Response(\"Not found\", { status: 404 });\n }\n const route = u.pathname.slice(prefix.length).replace(/\\/+$/, \"\");\n const cb = u.searchParams.get(\"cb\");\n\n if (route === \"index\") {\n return new Response(\n JSON.stringify(\n {\n service: \"BiB bundle server\",\n generated_at: new Date().toISOString(),\n routes: [\n \"index\",\n ...Object.keys(ROUTES),\n \"bsky?actor=&limit=5\",\n \"newsletter\",\n \"earnings\",\n ],\n },\n null,\n 1,\n ),\n { headers: { \"Content-Type\": \"application/json; charset=utf-8\" } },\n );\n }\n\n if (route === \"newsletter\") return await newsletterFeed();\n if (route === \"earnings\") return await earningsFeed();\n\n if (route === \"bsky\") {\n const actor = u.searchParams.get(\"actor\") ?? \"\";\n const limit = u.searchParams.get(\"limit\") ?? \"5\";\n if (!/^[a-z0-9][a-z0-9.-]{2,100}$/i.test(actor)) {\n return err(\"bsky\", \"missing or invalid actor param\");\n }\n if (!/^\\d{1,2}$/.test(limit)) return err(\"bsky\", \"invalid limit param\");\n const upstream =\n `https://public.api.bsky.app/xrpc/app.bsky.feed.getAuthorFeed?actor=${\n encodeURIComponent(actor)\n }&limit=${limit}`;\n return await proxy(\"bsky\", upstream, null);\n }\n\n const upstream = ROUTES[route];\n if (!upstream) return new Response(\"Not found\", { status: 404 });\n return await proxy(route, upstream, cb);\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1783989972094],"children",[],[35],"158424b5-9e98-4038-a772-bfc233753585",["D",1783989938779],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","4f3e5766-db71-43ab-8d6b-8959207c9f91","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ec05c-5d19-7488-b0d3-0c6697faad30","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_113":19},"org",{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":147,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":148,"_95":149,"_97":150,"_99":53},[144],"files",[144],"counts",{"_134":77,"_135":136,"_137":77,"_31":138,"_139":140},[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":133},[35],"pulls","branches",1,"forks",{"_141":136,"_143":77},"connections",{"_141":77,"_142":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":145,"_18":146},[],[35],["D",1783989938779],{"_11":12,"_113":19},{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_129":184,"_185":186,"_187":188,"_189":53,"_190":53,"_191":53,"_192":44,"_193":-5,"_194":-7,"_195":-7,"_196":77,"_197":53,"_198":53,"_199":-5,"_200":53,"_201":53,"_202":53,"_203":-5},"ENV",{"_155":156,"_157":158,"_159":16,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code