${escapeHtml(opts.title)}

` → renders as\r\n literal text on the card and detail page.\r\n7. `PATCH` a book's `goodreads_url` to `javascript:alert(1)` → 400.\r\n8. Chrome DevTools device toolbar + Slow 4G throttling: fast first paint\r\n (CSS/JS are same-origin, no build step to wait on), no auto-zoom on input\r\n focus (all inputs are `font-size: 16px`), \"Add to Home Screen\" installs\r\n using `manifest.webmanifest` + the generated PNG icons.\r\n\r\n## Dropping the custom font entirely\r\n\r\nEverything routes through one `@font-face` in `frontend/styles.ts` pointing\r\nat `/static/fonts/RedOctoberLight.otf`. To remove it: delete that\r\n`@font-face` block, delete the `/static/fonts/RedOctoberLight.otf` route in\r\n`index.http.tsx`, delete `FONT_OTF_BASE64` from\r\n`frontend/assets.generated.ts`, and change the heading font stack (the\r\n`h1, h2, .stamp, .wax-seal, .admin-star, .card__title` selector) to drop\r\n`'RedOctober'` — it already falls back to the Oswald webfont link in\r\n`frontend/layout.ts`'s ``, then `'Arial Narrow Bold'`/`Impact`.\r\n",[],[198],"2b47d755-13c2-4bb9-a054-7c9292dabf4d",".vtignore","15b3153a-adce-11f1-bc86-1607ee4eb77e",19,["D",1789123605016],".git\r\n.vt\r\nscripts\r\nRedOctoberLight-3nd6.otf\r\nnode_modules\r\n",[],[206],"006da7ca-7517-4cb7-879e-0044e83f6674","styles.ts","1599424a-adce-11f1-b099-1607ee4eb77e",44,["D",1789375639450],8,"// Exported as a string and served at /static/app.css with immutable caching —\n// no bundler, no build step, just a route in index.http.tsx.\nexport const styles = `\n:root {\n --red: #C0392B;\n --cream: #F0E6D2;\n --ink: #1C1C1C;\n --gold: #D4A017;\n --nav-height: 64px;\n color-scheme: light;\n}\n\n@font-face {\n font-family: 'RedOctober';\n src: url('/static/fonts/RedOctoberLight.otf') format('opentype');\n font-weight: 300;\n font-display: swap;\n}\n\n* { box-sizing: border-box; }\n\nhtml, body {\n margin: 0;\n padding: 0;\n background: var(--cream);\n color: var(--ink);\n font-family: 'RedOctober', 'Oswald', 'Arial Narrow Bold', Impact, 'Arial Narrow', sans-serif;\n font-size: 16px;\n line-height: 1.4;\n}\n\nbody {\n background-image:\n radial-gradient(rgba(28, 28, 28, 0.05) 1px, transparent 1px);\n background-size: 6px 6px;\n}\n\nh1, h2, .stamp, .wax-seal, .admin-star, .card__title {\n letter-spacing: 0.02em;\n}\n\na { color: inherit; }\n\n.page {\n max-width: 960px;\n margin: 0 auto;\n padding: 12px 12px calc(var(--nav-height) + 56px);\n}\n\n/* ---------- admin bar ---------- */\n\n.admin-bar {\n display: flex;\n align-items: center;\n gap: 12px;\n padding: 8px 0 16px;\n}\n\n.admin-star {\n width: 44px;\n height: 44px;\n min-width: 44px;\n border-radius: 50%;\n border: 2px solid var(--ink);\n background: var(--cream);\n color: var(--gold);\n font-size: 22px;\n cursor: pointer;\n}\n\n.admin-star[aria-pressed=\"true\"] {\n background: var(--gold);\n color: var(--ink);\n}\n\n.admin-countdown {\n font-variant-numeric: tabular-nums;\n font-weight: bold;\n}\n\n#add-book-btn {\n margin-left: auto;\n border: 2px solid var(--ink);\n background: var(--red);\n color: var(--cream);\n border-radius: 8px;\n padding: 10px 14px;\n font-size: 16px;\n cursor: pointer;\n}\n\nbody:not(.admin) .admin-only,\n.admin-only[hidden] { display: none !important; }\n\nbody.admin .admin-only { display: revert; }\nbody.admin #add-book-btn { display: inline-block; }\nbody.admin .card__admin { display: flex; }\n\n/* ---------- shelf / cards ---------- */\n\n.shelf {\n display: grid;\n grid-template-columns: repeat(auto-fill, minmax(185px, 1fr));\n gap: 20px;\n}\n\n.empty-state {\n grid-column: 1 / -1;\n text-align: center;\n padding: 48px 0;\n opacity: 0.6;\n}\n\n.card {\n position: relative;\n border: 3px solid var(--ink);\n background: #fff;\n border-radius: 4px;\n overflow: hidden;\n display: flex;\n flex-direction: column;\n box-shadow: 4px 4px 0 rgba(28, 28, 28, 0.15);\n}\n\n.card__cover-link { position: relative; display: block; }\n\n.card__cover, .detail__cover {\n width: 100%;\n aspect-ratio: 2 / 3;\n object-fit: contain;\n object-position: center;\n display: block;\n background: var(--cream);\n}\n\n.card__cover--placeholder, .detail__cover--placeholder {\n aspect-ratio: 2 / 3;\n display: flex;\n align-items: center;\n justify-content: center;\n font-size: 48px;\n color: var(--ink);\n background:\n repeating-linear-gradient(45deg, rgba(28,28,28,0.06) 0 8px, transparent 8px 16px),\n var(--cream);\n}\n\n.flag--priority {\n position: absolute;\n top: -6px;\n right: 8px;\n width: 34px;\n height: 44px;\n background: var(--gold);\n color: var(--ink);\n display: flex;\n align-items: flex-start;\n justify-content: center;\n padding-top: 4px;\n font-size: 18px;\n clip-path: polygon(0 0, 100% 0, 100% 100%, 50% 78%, 0 100%);\n z-index: 2;\n}\n\n.stamp {\n position: absolute;\n bottom: 10px;\n left: 10px;\n border: 2px dashed currentColor;\n border-radius: 6px;\n padding: 2px 8px;\n font-size: 12px;\n font-weight: bold;\n text-transform: uppercase;\n transform: rotate(-8deg);\n background: rgba(240, 230, 210, 0.85);\n z-index: 2;\n}\n\n.stamp--reading { color: var(--red); }\n.stamp--backlog { color: #5b6b8c; }\n.stamp--finished { color: #3a7d44; }\n\n.card__body {\n padding: 8px 10px 10px;\n display: flex;\n flex-direction: column;\n gap: 4px;\n flex: 1;\n}\n\n.card__title {\n font-size: 15px;\n text-decoration: none;\n font-weight: bold;\n}\n\n.card__author {\n margin: 0;\n font-size: 12px;\n opacity: 0.75;\n}\n\n.card__admin {\n display: none;\n flex-wrap: wrap;\n gap: 6px;\n padding: 0 10px 10px;\n}\n\n.icon-btn {\n width: 32px;\n height: 32px;\n border: 2px solid var(--ink);\n background: var(--cream);\n border-radius: 4px;\n cursor: pointer;\n font-size: 14px;\n}\n\n.icon-btn:disabled {\n opacity: 0.3;\n cursor: not-allowed;\n}\n\n.icon-btn--danger, .danger {\n color: var(--red);\n border-color: var(--red);\n}\n\n.icon-btn--advance {\n flex: 1 0 100%;\n width: auto;\n height: auto;\n padding: 8px;\n font-size: 12px;\n font-weight: bold;\n white-space: nowrap;\n text-align: center;\n}\n\n/* ---------- wax seal button ---------- */\n\n.wax-seal {\n display: inline-block;\n align-self: flex-start;\n margin-top: 4px;\n padding: 6px 14px;\n border-radius: 999px;\n background: radial-gradient(circle at 30% 30%, #d9483a, var(--red) 70%);\n color: var(--cream);\n text-decoration: none;\n font-size: 13px;\n font-weight: bold;\n box-shadow: inset 0 -3px 4px rgba(0,0,0,0.35), 0 2px 3px rgba(0,0,0,0.3);\n border: 1px solid #7a2015;\n}\n\n.wax-seal--small { font-size: 11px; padding: 4px 10px; }\n\n/* ---------- detail page ---------- */\n\n.back-link {\n display: inline-block;\n margin-bottom: 12px;\n text-decoration: none;\n font-weight: bold;\n}\n\n.detail {\n position: relative;\n background: #fff;\n border: 3px solid var(--ink);\n border-radius: 6px;\n padding: 20px;\n box-shadow: 6px 6px 0 rgba(28, 28, 28, 0.15);\n}\n\n.detail__cover-frame {\n position: relative;\n display: block;\n width: 100%;\n max-width: 240px;\n margin-bottom: 12px;\n}\n\n.detail__cover {\n border: 2px solid var(--ink);\n}\n\n.detail__title { margin: 8px 0 0; font-size: 28px; }\n.detail__author { opacity: 0.75; margin-top: 0; }\n.detail__pitch { font-style: italic; }\n.detail__description { line-height: 1.6; }\n.detail__description p { margin: 0 0 12px; }\n.detail__description p:last-child { margin-bottom: 0; }\n.detail__tags { list-style: none; padding: 0; display: flex; gap: 8px; flex-wrap: wrap; }\n.detail__tags li {\n border: 1px solid var(--ink);\n border-radius: 999px;\n padding: 2px 10px;\n font-size: 12px;\n background: repeating-linear-gradient(-45deg, rgba(28,28,28,0.04) 0 6px, transparent 6px 12px);\n}\n.detail__meta { font-size: 12px; opacity: 0.6; }\n\n.edit-panel {\n margin-top: 16px;\n border: 2px dashed var(--ink);\n border-radius: 6px;\n padding: 16px;\n display: flex;\n flex-direction: column;\n gap: 10px;\n background: rgba(212, 160, 23, 0.08);\n}\n\n/* ---------- forms / dialogs ---------- */\n\nlabel {\n display: flex;\n flex-direction: column;\n gap: 4px;\n font-size: 14px;\n font-weight: bold;\n}\n\ninput, select, textarea, button {\n font-size: 16px;\n font-family: inherit;\n}\n\ninput, select, textarea {\n padding: 10px;\n border: 2px solid var(--ink);\n border-radius: 4px;\n background: #fff;\n color: var(--ink);\n}\n\nbutton {\n cursor: pointer;\n}\n\ndialog {\n border: 3px solid var(--ink);\n border-radius: 8px;\n padding: 20px;\n max-width: 420px;\n width: calc(100% - 32px);\n background: var(--cream);\n}\n\ndialog::backdrop {\n background: rgba(28, 28, 28, 0.5);\n}\n\n.dialog-actions {\n display: flex;\n justify-content: flex-end;\n gap: 8px;\n margin-top: 8px;\n}\n\n.dialog-actions button {\n border: 2px solid var(--ink);\n border-radius: 6px;\n padding: 8px 14px;\n background: var(--cream);\n}\n\n.dialog-actions button[type=\"submit\"] {\n background: var(--red);\n color: var(--cream);\n}\n\n.form-error {\n color: var(--red);\n font-size: 13px;\n font-weight: bold;\n}\n\n#search-results {\n display: flex;\n flex-direction: column;\n gap: 6px;\n max-height: 220px;\n overflow-y: auto;\n}\n\n.search-result {\n display: flex;\n gap: 8px;\n align-items: center;\n border: 1px solid var(--ink);\n border-radius: 4px;\n padding: 6px;\n cursor: pointer;\n background: #fff;\n text-align: left;\n}\n\n.search-result img { width: 32px; height: 48px; object-fit: cover; }\n.search-result[aria-selected=\"true\"] { outline: 3px solid var(--gold); }\n\n/* ---------- nav / footer ---------- */\n\n.tab-nav {\n position: fixed;\n bottom: 0;\n left: 0;\n right: 0;\n display: flex;\n background: var(--ink);\n border-top: 3px solid var(--gold);\n padding-bottom: env(safe-area-inset-bottom);\n z-index: 10;\n}\n\n.nav__item {\n flex: 1;\n text-align: center;\n padding: 16px 0;\n color: var(--cream);\n text-decoration: none;\n font-size: 14px;\n text-transform: uppercase;\n letter-spacing: 0.05em;\n}\n\n.nav__item--active {\n color: var(--gold);\n border-top: 3px solid var(--gold);\n margin-top: -3px;\n}\n\n.shelves-footer {\n position: fixed;\n bottom: calc(var(--nav-height) + env(safe-area-inset-bottom));\n left: 0;\n right: 0;\n background: repeating-linear-gradient(135deg, var(--red) 0 10px, #a5311f 10px 20px);\n color: var(--cream);\n font-size: 12px;\n padding: 6px 12px;\n display: flex;\n gap: 8px;\n flex-wrap: wrap;\n z-index: 9;\n}\n\n.shelves-footer a { color: var(--cream); }\n\n@media (min-width: 640px) {\n .shelf { grid-template-columns: repeat(auto-fill, minmax(170px, 1fr)); }\n}\n`;\n",[],[155,214],"c79da03c-ee04-41f2-890a-20355191ec4a","manifest.ts","157c5676-adce-11f1-9ec7-1607ee4eb77e",16,["D",1789123605994],"export const manifestJson = JSON.stringify(\n {\n name: \"The People's Reading Club\",\n short_name: \"Reading Club\",\n description:\n \"A shared shelf of what we're reading, backlogged, and finished.\",\n start_url: \"/reading\",\n scope: \"/\",\n display: \"standalone\",\n background_color: \"#F0E6D2\",\n theme_color: \"#C0392B\",\n icons: [\n { src: \"/icon.svg\", sizes: \"any\", type: \"image/svg+xml\", purpose: \"any\" },\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"any\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"any\",\n },\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"maskable\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"maskable\",\n },\n ],\n },\n null,\n 2,\n);\n\n// Hand-authored vector twin of the generated PNGs (see scripts/gen_icons.py).\nexport const iconSvg =\n ``;\n",[],[155,223],"c463e76c-6e75-4246-bdc2-e31dcfe17f61","layout.ts","1557fd1c-adce-11f1-a9cc-1607ee4eb77e",35,["D",1789127191321],2,"import type { BookStatus } from \"../backend/types.ts\";\nimport { adminBar, escapeHtml } from \"./components.ts\";\nimport { styles } from \"./styles.ts\";\nimport { clientJs } from \"./client.ts\";\n\ninterface GoodreadsProfile {\n name: string;\n url: string;\n}\n\n// GOODREADS_PROFILES env var is a JSON array like:\n// [{\"name\":\"Alex\",\"url\":\"https://www.goodreads.com/user/show/123-alex\"}]\nfunction parseGoodreadsProfiles(): GoodreadsProfile[] {\n const raw = Deno.env.get(\"GOODREADS_PROFILES\");\n if (!raw) return [];\n try {\n const parsed = JSON.parse(raw);\n if (!Array.isArray(parsed)) return [];\n return parsed.filter((p): p is GoodreadsProfile => {\n if (typeof p?.name !== \"string\" || typeof p?.url !== \"string\") {\n return false;\n }\n try {\n const url = new URL(p.url);\n return url.protocol === \"https:\" &&\n url.hostname.endsWith(\"goodreads.com\");\n } catch {\n return false;\n }\n });\n } catch {\n return [];\n }\n}\n\nconst TABS: { key: BookStatus; label: string }[] = [\n { key: \"backlog\", label: \"Backlog\" },\n { key: \"reading\", label: \"Reading\" },\n { key: \"finished\", label: \"Finished\" },\n];\n\n// The static routes serve app.css/client.js with an immutable, 1-year cache\n// header. Tagging their URL with a content hash means every deploy that\n// changes either file gets a brand-new URL, so browsers fetch it immediately\n// instead of serving a stale cached copy until a manual hard refresh.\nfunction contentVersion(input: string): string {\n let hash = 5381;\n for (let i = 0; i < input.length; i++) {\n hash = ((hash << 5) + hash + input.charCodeAt(i)) | 0;\n }\n return (hash >>> 0).toString(36);\n}\n\nconst STYLES_VERSION = contentVersion(styles);\nconst CLIENT_JS_VERSION = contentVersion(clientJs);\n\nexport function renderLayout(\n opts: { title: string; activeTab: BookStatus; bodyHtml: string },\n): string {\n const profiles = parseGoodreadsProfiles();\n const shelvesRow = profiles.length\n ? ``\n : \"\";\n\n const navItems = TABS.map(\n (tab) =>\n `${tab.label}`,\n ).join(\"\");\n\n return `\n\n\n \n \n ${escapeHtml(opts.title)}\n \n \n \n \n \n \n \n \n\n\n

\n ${adminBar(opts.activeTab === \"backlog\")}\n ${opts.bodyHtml}\n

\n \n ${shelvesRow}\n \n\n`;\n}\n",[],[155,231],"2bfadf15-d82b-4ac7-9c67-5a434386988b","components.ts","153b861e-adce-11f1-b099-1607ee4eb77e",["D",1789375639445],5,"import type { Book, BookStatus, Priority } from \"../backend/types.ts\";\n\n// Every DB-sourced string passes through this before hitting HTML.\nexport function escapeHtml(value: string | null | undefined): string {\n if (value == null) return \"\";\n return value\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nconst STATUS_LABEL: Record = {\n reading: \"Reading\",\n backlog: \"Backlog\",\n finished: \"Finished\",\n};\n\nexport function stampBadge(status: BookStatus): string {\n return `${STATUS_LABEL[status]}`;\n}\n\nfunction priorityFlag(priority: Priority): string {\n if (priority !== \"high\") return \"\";\n return `★`;\n}\n\n// Shelf order is Backlog -> Reading -> Finished; Finished has no next step.\nconst NEXT_STATUS: Partial> = {\n backlog: \"reading\",\n reading: \"finished\",\n};\n\nfunction advanceButton(book: Book, cssClass: string): string {\n const next = NEXT_STATUS[book.status];\n if (!next) return \"\";\n const label = `Move to ${STATUS_LABEL[next]}`;\n return ``;\n}\n\n// Google Books descriptions are an HTML fragment. Escape everything, then\n// selectively re-open a small formatting allowlist (bare tags only, no\n// attributes survive) so markup like //
renders instead of showing\n// up as literal text, without letting any other tag or attribute through.\nconst ALLOWED_DESCRIPTION_TAGS = [\n \"b\",\n \"strong\",\n \"i\",\n \"em\",\n \"u\",\n \"p\",\n \"ul\",\n \"ol\",\n \"li\",\n];\n\nfunction sanitizeDescriptionHtml(html: string): string {\n let escaped = escapeHtml(html);\n for (const tag of ALLOWED_DESCRIPTION_TAGS) {\n escaped = escaped\n .replace(new RegExp(`<${tag}>`, \"gi\"), `<${tag}>`)\n .replace(new RegExp(`</${tag}>`, \"gi\"), ``);\n }\n return escaped.replace(/<br\\s*\\/?>/gi, \"
\");\n}\n\nfunction coverImg(\n book: Book,\n width: number,\n height: number,\n cssClass: string,\n): string {\n if (book.coverUrl) {\n return ` $\"Cover$ `;\n }\n const initial = escapeHtml(book.title.trim().charAt(0).toUpperCase() || \"?\");\n return `
${initial}
`;\n}\n\nexport function bookCard(\n book: Book,\n boundary?: { atTop: boolean; atBottom: boolean },\n): string {\n const goodreadsCta = book.goodreadsUrl\n ? `Goodreads`\n : \"\";\n const disabledUp = boundary?.atTop ? \"disabled\" : \"\";\n const disabledDown = boundary?.atBottom ? \"disabled\" : \"\";\n\n return `\n
\n ${priorityFlag(book.priority)}\n \n ${coverImg(book, 220, 330, \"card__cover\")}\n ${stampBadge(book.status)}\n \n
\n ${\n escapeHtml(book.title)\n }\n
${escapeHtml(book.author)}
\n ${goodreadsCta}\n
\n
\n ${advanceButton(book, \"icon-btn icon-btn--advance\")}\n \n \n \n
\n
`;\n}\n\n// Reorder only ever swaps within the same priority group, so up/down at a\n// priority boundary is ambiguous — those buttons render disabled at the ends.\nexport function bookListView(status: BookStatus, books: Book[]): string {\n const cards = books\n .map((book, i) =>\n bookCard(book, {\n atTop: i === 0 || books[i - 1].priority !== book.priority,\n atBottom: i === books.length - 1 ||\n books[i + 1].priority !== book.priority,\n })\n )\n .join(\"\\n\");\n return `\n
\n ${books.length ? cards : `
No books here yet.
`}\n
`;\n}\n\nexport function adminEditPanel(book: Book): string {\n const statusOption = (value: BookStatus, label: string) =>\n ``;\n const priorityOption = (value: Priority, label: string) =>\n ``;\n\n return `\n
\n
Edit
\n Status\n \n \n Priority\n \n \n Tags (comma separated) \n Added by \n Pitch ${\n escapeHtml(book.pitch ?? \"\")\n }\n Goodreads URL \n Cover image URL \n \n
\n ${advanceButton(book, \"\")}\n \n \n \n
\n
`;\n}\n\nexport function detailPageView(book: Book): string {\n const pitch = book.pitch\n ? `
“${escapeHtml(book.pitch)}”
`\n : \"\";\n const description = book.description\n ? `
${\n sanitizeDescriptionHtml(book.description)\n }
`\n : \"\";\n const goodreadsCta = book.goodreadsUrl\n ? `View on Goodreads`\n : `
No Goodreads link yet.
`;\n const tags = book.tags.length\n ? `
${\n book.tags.map((t) => `
${escapeHtml(t)}
`).join(\"\")\n }
`\n : \"\";\n\n return `\n ← Back to ${\n STATUS_LABEL[book.status]\n }\n
\n ${priorityFlag(book.priority)}\n
\n ${coverImg(book, 300, 450, \"detail__cover\")}\n ${stampBadge(book.status)}\n
\n
${escapeHtml(book.title)}
\n
${escapeHtml(book.author)}
\n ${pitch}\n ${description}\n ${tags}\n ${goodreadsCta}\n
Added by ${\n escapeHtml(book.addedBy) || \"the club\"\n }
\n
\n ${adminEditPanel(book)}`;\n}\n\nexport function adminBar(showAddBook: boolean): string {\n const addBookBtn = showAddBook\n ? ``\n : \"\";\n const addBookDialog = showAddBook\n ? `\n
\n
Add a book
\n Search Google Books \n
\n \n \n Priority\n \n \n Tags (comma separated) \n Added by \n Pitch \n \n
\n \n \n
\n
\n `\n : \"\";\n\n return `\n
\n \n \n ${addBookBtn}\n
\n \n
\n
Admin mode
\n Password \n \n
\n \n \n
\n
\n \n ${addBookDialog}`;\n}\n",[],[155,240],"5e78bf3c-2e2f-4891-a721-c41fe2213a97","client.ts","154bad1e-adce-11f1-aefb-1607ee4eb77e",43,["D",1789375639422],7,"// Vanilla JS, no framework, no bundler — served as text/javascript from a\n// route. DOM nodes are built with createElement/textContent for untrusted\n// data; book detail markup (description, tags, etc.) is always rendered\n// server-side in components.ts, never re-built client-side.\nexport const clientJs = `(function () {\n \"use strict\";\n\n var TOKEN_KEY = \"prc_token\";\n var EXP_KEY = \"prc_exp\";\n var countdownTimer = null;\n\n function getSession() {\n var token = sessionStorage.getItem(TOKEN_KEY);\n var exp = Number(sessionStorage.getItem(EXP_KEY));\n if (!token || !exp || exp <= Date.now()) return null;\n return { token: token, exp: exp };\n }\n\n function setSession(token, exp) {\n sessionStorage.setItem(TOKEN_KEY, token);\n sessionStorage.setItem(EXP_KEY, String(exp));\n }\n\n function clearSession() {\n sessionStorage.removeItem(TOKEN_KEY);\n sessionStorage.removeItem(EXP_KEY);\n document.body.classList.remove(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"false\");\n if (countdownTimer) { clearInterval(countdownTimer); countdownTimer = null; }\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdown) countdown.textContent = \"\";\n }\n\n function formatRemaining(ms) {\n var totalSeconds = Math.max(0, Math.floor(ms / 1000));\n var m = Math.floor(totalSeconds / 60);\n var s = totalSeconds % 60;\n return \"Admin \\\\u00b7 \" + m + \":\" + (s < 10 ? \"0\" : \"\") + s;\n }\n\n function startCountdown(exp) {\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdownTimer) clearInterval(countdownTimer);\n function tick() {\n var remaining = exp - Date.now();\n if (remaining <= 0) { clearSession(); return; }\n if (countdown) countdown.textContent = formatRemaining(remaining);\n }\n tick();\n countdownTimer = setInterval(tick, 1000);\n }\n\n function enterAdminMode(token, exp) {\n setSession(token, exp);\n document.body.classList.add(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"true\");\n startCountdown(exp);\n }\n\n // Wraps fetch with the bearer token; any 401 immediately drops admin mode.\n function adminFetch(url, options) {\n var session = getSession();\n options = options || {};\n options.headers = options.headers || {};\n if (session) options.headers[\"Authorization\"] = \"Bearer \" + session.token;\n return fetch(url, options).then(function (res) {\n if (res.status === 401) clearSession();\n return res;\n });\n }\n\n function showError(id, message) {\n var el = document.getElementById(id);\n if (!el) return;\n el.textContent = message;\n el.hidden = !message;\n }\n\n function setupDialogClosers() {\n document.querySelectorAll(\"dialog [data-close]\").forEach(function (btn) {\n btn.addEventListener(\"click\", function () {\n var dialog = btn.closest(\"dialog\");\n if (dialog) dialog.close();\n });\n });\n }\n\n function setupAdminToggle() {\n var toggle = document.getElementById(\"admin-toggle\");\n var loginDialog = document.getElementById(\"login-dialog\");\n var loginForm = document.getElementById(\"login-form\");\n if (!toggle || !loginDialog || !loginForm) return;\n\n var session = getSession();\n if (session) enterAdminMode(session.token, session.exp);\n\n toggle.addEventListener(\"click\", function () {\n if (document.body.classList.contains(\"admin\")) {\n clearSession();\n return;\n }\n showError(\"login-error\", \"\");\n loginForm.reset();\n loginDialog.showModal();\n });\n\n loginForm.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var password = new FormData(loginForm).get(\"password\");\n fetch(\"/api/auth/login\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password: password }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"login-error\", result.body.error || \"Wrong password.\"); return; }\n enterAdminMode(result.body.token, result.body.expiresAt);\n loginDialog.close();\n })\n .catch(function () { showError(\"login-error\", \"Network error. Try again.\"); });\n });\n }\n\n function renderSearchResults(container, hiddenInput, submitBtn, results) {\n container.textContent = \"\";\n results.forEach(function (book) {\n var item = document.createElement(\"button\");\n item.type = \"button\";\n item.className = \"search-result\";\n item.setAttribute(\"role\", \"option\");\n item.setAttribute(\"aria-selected\", \"false\");\n\n if (book.coverUrl) {\n var img = document.createElement(\"img\");\n img.src = book.coverUrl;\n img.alt = \"\";\n item.appendChild(img);\n }\n var text = document.createElement(\"span\");\n text.textContent = book.title + (book.author ? \" \\\\u2014 \" + book.author : \"\");\n item.appendChild(text);\n\n item.addEventListener(\"click\", function () {\n container.querySelectorAll(\".search-result\").forEach(function (el) { el.setAttribute(\"aria-selected\", \"false\"); });\n item.setAttribute(\"aria-selected\", \"true\");\n hiddenInput.value = book.googleBooksId;\n submitBtn.disabled = false;\n });\n container.appendChild(item);\n });\n }\n\n function setupAddBook() {\n var addBtn = document.getElementById(\"add-book-btn\");\n var dialog = document.getElementById(\"add-book-dialog\");\n var form = document.getElementById(\"add-book-form\");\n if (!addBtn || !dialog || !form) return;\n\n var queryInput = form.querySelector(\"[name=query]\");\n var resultsBox = document.getElementById(\"search-results\");\n var hiddenId = form.querySelector(\"[name=googleBooksId]\");\n var submitBtn = document.getElementById(\"add-book-submit\");\n var searchTimer = null;\n\n addBtn.addEventListener(\"click\", function () {\n form.reset();\n resultsBox.textContent = \"\";\n hiddenId.value = \"\";\n submitBtn.disabled = true;\n showError(\"add-book-error\", \"\");\n dialog.showModal();\n });\n\n queryInput.addEventListener(\"input\", function () {\n var q = queryInput.value.trim();\n if (searchTimer) clearTimeout(searchTimer);\n if (!q) { resultsBox.textContent = \"\"; return; }\n searchTimer = setTimeout(function () {\n adminFetch(\"/api/google-books/search?q=\" + encodeURIComponent(q))\n .then(function (res) { return res.ok ? res.json() : []; })\n .then(function (results) { renderSearchResults(resultsBox, hiddenId, submitBtn, results); });\n }, 350);\n });\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n if (!hiddenId.value) { showError(\"add-book-error\", \"Pick a search result first.\"); return; }\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n googleBooksId: hiddenId.value,\n status: \"backlog\",\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"add-book-error\", result.body.error || \"Could not add book.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"add-book-error\", \"Network error. Try again.\"); });\n });\n }\n\n function setupCardActions() {\n document.addEventListener(\"click\", function (event) {\n var btn = event.target.closest ? event.target.closest(\"[data-action]\") : null;\n if (!btn) return;\n var id = btn.getAttribute(\"data-id\");\n var action = btn.getAttribute(\"data-action\");\n\n if (action === \"move-up\" || action === \"move-down\") {\n adminFetch(\"/api/books/\" + id + \"/move\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ direction: action === \"move-up\" ? \"up\" : \"down\" }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"advance\") {\n var nextStatus = btn.getAttribute(\"data-next-status\");\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ status: nextStatus }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"delete\") {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n }\n });\n }\n\n function setupEditPanel() {\n var form = document.getElementById(\"edit-book-form\");\n if (!form) return;\n var id = form.getAttribute(\"data-id\");\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n status: data.get(\"status\"),\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n goodreadsUrl: data.get(\"goodreadsUrl\") || null,\n coverUrl: data.get(\"coverUrl\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"edit-book-error\", result.body.error || \"Could not save.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"edit-book-error\", \"Network error. Try again.\"); });\n });\n\n var refreshBtn = document.getElementById(\"refresh-goodreads-btn\");\n if (refreshBtn) {\n refreshBtn.addEventListener(\"click\", function () {\n adminFetch(\"/api/books/\" + id + \"/goodreads/refresh\", { method: \"POST\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n });\n }\n\n var deleteBtn = document.getElementById(\"delete-book-btn\");\n if (deleteBtn) {\n deleteBtn.addEventListener(\"click\", function () {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.href = \"/\" + form.querySelector(\"[name=status]\").value;\n });\n });\n }\n }\n\n document.addEventListener(\"DOMContentLoaded\", function () {\n setupDialogClosers();\n setupAdminToggle();\n setupAddBook();\n setupCardActions();\n setupEditPanel();\n });\n})();\n`;\n",[],[155,248],["D",1789123605426],[],[155,63],"d6bfab87-4c56-4ee1-b2af-e1a89991aae5",["D",1789123604280],"directory",[179,180,181,182,183,184],[155],"1af33a3b-3dbf-4621-8ecd-07e6b54b5ce3","types.ts","151bda1c-adce-11f1-880b-1607ee4eb77e","14462d36-adce-11f1-a416-1607ee4eb77e",11,["D",1789123605407],"export type BookStatus = \"reading\" | \"backlog\" | \"finished\";\nexport type Priority = \"high\" | \"medium\" | \"low\";\n\nexport interface Book {\n id: number;\n googleBooksId: string | null;\n title: string;\n author: string | null;\n coverUrl: string | null;\n description: string | null;\n isbn13: string | null;\n goodreadsUrl: string | null;\n status: BookStatus;\n priority: Priority;\n rank: number;\n tags: string[];\n addedBy: string | null;\n pitch: string | null;\n createdAt: string;\n updatedAt: string;\n}\n\nexport const BOOK_STATUSES: BookStatus[] = [\"reading\", \"backlog\", \"finished\"];\nexport const PRIORITIES: Priority[] = [\"high\", \"medium\", \"low\"];\n",[],[273,265],"backend","2b8a1214-0a37-419b-b6f6-9ccb470c1a7c","googleBooks.ts","14e78802-adce-11f1-880b-1607ee4eb77e",25,["D",1789125408337],"// Google Books proxy: the only client input is a search query string or a\n// volume id — every fetch target is the hardcoded googleapis.com host.\nexport interface GoogleBookSummary {\n googleBooksId: string;\n title: string;\n author: string | null;\n coverUrl: string | null;\n isbn13: string | null;\n description: string | null;\n}\n\nconst ALLOWED_COVER_HOSTS = [\"books.google.com\", \"books.googleusercontent.com\"];\n\nfunction isAllowedCoverHost(host: string): boolean {\n return ALLOWED_COVER_HOSTS.includes(host) || host.endsWith(\".gstatic.com\");\n}\n\n// Upgrades http->https and rejects anything off the Google Books image allowlist.\nexport function sanitizeCoverUrl(\n url: string | undefined | null,\n): string | null {\n if (!url) return null;\n try {\n const parsed = new URL(url.replace(/^http:/, \"https:\"));\n if (parsed.protocol !== \"https:\") return null;\n if (!isAllowedCoverHost(parsed.hostname)) return null;\n // \"edge=curl\" draws a decorative folded-corner + margin onto the image;\n // dropping it gives a flat cover that can fill the card edge-to-edge.\n parsed.searchParams.delete(\"edge\");\n return parsed.toString();\n } catch {\n return null;\n }\n}\n\ninterface IndustryIdentifier {\n type: string;\n identifier: string;\n}\n\ninterface GoogleVolumeInfo {\n title?: string;\n authors?: string[];\n description?: string;\n industryIdentifiers?: IndustryIdentifier[];\n imageLinks?: { thumbnail?: string; smallThumbnail?: string };\n}\n\ninterface GoogleVolumeItem {\n id: string;\n volumeInfo?: GoogleVolumeInfo;\n}\n\nfunction extractIsbn13(info: GoogleVolumeInfo): string | null {\n return info.industryIdentifiers?.find((id) => id.type === \"ISBN_13\")\n ?.identifier ?? null;\n}\n\nfunction toSummary(item: GoogleVolumeItem): GoogleBookSummary {\n const info = item.volumeInfo ?? {};\n return {\n googleBooksId: item.id,\n title: info.title ?? \"Untitled\",\n author: info.authors?.length ? info.authors.join(\", \") : null,\n coverUrl: sanitizeCoverUrl(\n info.imageLinks?.thumbnail ?? info.imageLinks?.smallThumbnail,\n ),\n isbn13: extractIsbn13(info),\n description: info.description ?? null,\n };\n}\n\nconst API_BASE = \"https://www.googleapis.com/books/v1/volumes\";\n\nexport async function searchGoogleBooks(\n query: string,\n): Promise {\n const key = Deno.env.get(\"GOOGLE_BOOKS_API_KEY\");\n const url = new URL(API_BASE);\n url.searchParams.set(\"q\", query);\n url.searchParams.set(\"maxResults\", \"5\");\n if (key) url.searchParams.set(\"key\", key);\n\n try {\n const res = await fetch(url, { signal: AbortSignal.timeout(5000) });\n if (!res.ok) return [];\n const data = await res.json();\n const items: GoogleVolumeItem[] = Array.isArray(data.items)\n ? data.items\n : [];\n return items.map(toSummary);\n } catch {\n return [];\n }\n}\n\nexport async function getGoogleBookVolume(\n googleBooksId: string,\n): Promise {\n const key = Deno.env.get(\"GOOGLE_BOOKS_API_KEY\");\n const url = new URL(`${API_BASE}/${encodeURIComponent(googleBooksId)}`);\n if (key) url.searchParams.set(\"key\", key);\n\n try {\n const res = await fetch(url, { signal: AbortSignal.timeout(5000) });\n if (!res.ok) return null;\n const item: GoogleVolumeItem = await res.json();\n if (!item?.id) return null;\n return toSummary(item);\n } catch {\n return null;\n }\n}\n",[],[273,275],"ff33d1d7-70e5-4e3e-96ae-1cce122ff712","goodreads.ts","14dda6de-adce-11f1-bb4b-1607ee4eb77e",6,["D",1789123604996],"// Resolves a Goodreads book URL. ISBN-first: goodreads.com/book/isbn/{isbn13}\n// still 302s to the real book page, which is free and needs no API key. Only\n// falls back to a paid-ish search API when there's no ISBN-13 to look up.\nconst GOODREADS_HOSTS = [\"www.goodreads.com\", \"goodreads.com\"];\n\nfunction isGoodreadsBookUrl(url: URL): boolean {\n return url.protocol === \"https:\" &&\n GOODREADS_HOSTS.includes(url.hostname) &&\n /^\\/book\\/show\\//.test(url.pathname);\n}\n\n// Also used to validate admin-supplied manual corrections (open-redirect / javascript: guard).\nexport function validateGoodreadsUrl(raw: string): string | null {\n try {\n const url = new URL(raw);\n return isGoodreadsBookUrl(url) ? url.toString() : null;\n } catch {\n return null;\n }\n}\n\nasync function tryIsbnLookup(isbn13: string): Promise {\n try {\n const res = await fetch(\n `https://www.goodreads.com/book/isbn/${encodeURIComponent(isbn13)}`,\n {\n method: \"HEAD\",\n redirect: \"manual\",\n signal: AbortSignal.timeout(5000),\n },\n );\n if (res.status < 300 || res.status >= 400) return null;\n const location = res.headers.get(\"location\");\n if (!location) return null;\n const resolved = new URL(location, \"https://www.goodreads.com\");\n return isGoodreadsBookUrl(resolved) ? resolved.toString() : null;\n } catch {\n return null;\n }\n}\n\nasync function trySerper(\n title: string,\n author: string,\n): Promise {\n const apiKey = Deno.env.get(\"SERPER_API_KEY\");\n if (!apiKey) return null;\n try {\n const res = await fetch(\"https://google.serper.dev/search\", {\n method: \"POST\",\n headers: { \"X-API-KEY\": apiKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ q: `\"${title}\" \"${author}\" site:goodreads.com` }),\n signal: AbortSignal.timeout(5000),\n });\n if (!res.ok) return null;\n const data = await res.json();\n for (const result of data.organic ?? []) {\n const validated = validateGoodreadsUrl(result.link);\n if (validated) return validated;\n }\n return null;\n } catch {\n return null;\n }\n}\n\nasync function tryBrave(title: string, author: string): Promise {\n const apiKey = Deno.env.get(\"BRAVE_API_KEY\");\n if (!apiKey) return null;\n try {\n const url = new URL(\"https://api.search.brave.com/res/v1/web/search\");\n url.searchParams.set(\"q\", `\"${title}\" \"${author}\" site:goodreads.com`);\n const res = await fetch(url, {\n headers: { \"X-Subscription-Token\": apiKey, Accept: \"application/json\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!res.ok) return null;\n const data = await res.json();\n for (const result of data.web?.results ?? []) {\n const validated = validateGoodreadsUrl(result.url);\n if (validated) return validated;\n }\n return null;\n } catch {\n return null;\n }\n}\n\n// Never throws — a failed lookup just means the book has no Goodreads link yet.\nexport async function findGoodreadsUrl(\n title: string,\n author: string,\n isbn13: string | null,\n): Promise {\n if (isbn13) {\n const viaIsbn = await tryIsbnLookup(isbn13);\n if (viaIsbn) return viaIsbn;\n }\n\n const provider = Deno.env.get(\"SEARCH_API_PROVIDER\") ?? \"serper\";\n if (provider === \"brave\") return await tryBrave(title, author);\n if (provider === \"serper\") return await trySerper(title, author);\n return null;\n}\n",[],[273,283],"e389c57e-3a8b-4690-a263-dd8841b9c7e7","db.ts","14f3349a-adce-11f1-a3cc-1607ee4eb77e",["D",1789123605092],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// Memoized so the DDL only runs once per cold start, but a middleware awaits\n// this on every request — dropping the `books` table in the admin panel and\n// reloading is enough to recreate the schema (self-healing).\nlet initPromise: Promise | null = null;\n\nasync function runInit(): Promise {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS books (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n google_books_id TEXT,\n title TEXT NOT NULL,\n author TEXT,\n cover_url TEXT,\n description TEXT,\n isbn13 TEXT,\n goodreads_url TEXT,\n status TEXT NOT NULL CHECK (status IN ('reading','backlog','finished')),\n priority TEXT NOT NULL DEFAULT 'medium' CHECK (priority IN ('high','medium','low')),\n rank INTEGER NOT NULL DEFAULT 0,\n tags TEXT NOT NULL DEFAULT '[]',\n added_by TEXT,\n pitch TEXT,\n created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n )`,\n `CREATE INDEX IF NOT EXISTS idx_books_status_rank ON books(status, rank)`,\n `CREATE TABLE IF NOT EXISTS admin_sessions (\n token TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_exp ON admin_sessions(expires_at)`,\n ]);\n}\n\nexport function initDb(): Promise {\n if (!initPromise) {\n initPromise = runInit().catch((err) => {\n initPromise = null; // let the next request retry instead of caching a failure\n throw err;\n });\n }\n return initPromise;\n}\n\nexport { sqlite };\n",[],[273,291],"6b111b2e-b981-47aa-9876-5e1e9734de84","books.ts","14c5baec-adce-11f1-a330-1607ee4eb77e",36,["D",1789374979783],"import { sqlite } from \"./db.ts\";\nimport type { Book, BookStatus, Priority } from \"./types.ts\";\nimport { getGoogleBookVolume } from \"./googleBooks.ts\";\nimport { findGoodreadsUrl, validateGoodreadsUrl } from \"./goodreads.ts\";\n\nconst PRIORITY_ORDER =\n `CASE priority WHEN 'high' THEN 0 WHEN 'medium' THEN 1 WHEN 'low' THEN 2 ELSE 3 END`;\n\ntype Row = Record;\n\nfunction rowToBook(row: Row): Book {\n return {\n id: Number(row.id),\n googleBooksId: (row.google_books_id as string) ?? null,\n title: row.title as string,\n author: (row.author as string) ?? null,\n coverUrl: (row.cover_url as string) ?? null,\n description: (row.description as string) ?? null,\n isbn13: (row.isbn13 as string) ?? null,\n goodreadsUrl: (row.goodreads_url as string) ?? null,\n status: row.status as BookStatus,\n priority: row.priority as Priority,\n rank: Number(row.rank),\n tags: JSON.parse((row.tags as string) ?? \"[]\"),\n addedBy: (row.added_by as string) ?? null,\n pitch: (row.pitch as string) ?? null,\n createdAt: row.created_at as string,\n updatedAt: row.updated_at as string,\n };\n}\n\nasync function nextRankFor(status: BookStatus): Promise {\n const result = await sqlite.execute({\n sql:\n `SELECT COALESCE(MAX(rank), 0) + 1 AS next_rank FROM books WHERE status = :status`,\n args: { status },\n });\n return Number((result.rows[0] as Row).next_rank);\n}\n\nexport async function listBooks(\n status: BookStatus,\n tag?: string,\n): Promise {\n const sql = tag\n ? `SELECT * FROM books WHERE status = :status AND EXISTS (\n SELECT 1 FROM json_each(books.tags) WHERE value = :tag\n ) ORDER BY ${PRIORITY_ORDER}, rank ASC`\n : `SELECT * FROM books WHERE status = :status ORDER BY ${PRIORITY_ORDER}, rank ASC`;\n const args: Record = { status };\n if (tag) args.tag = tag;\n const result = await sqlite.execute({ sql, args });\n return result.rows.map((row) => rowToBook(row as Row));\n}\n\nexport async function getBook(id: number): Promise {\n const result = await sqlite.execute({\n sql: `SELECT * FROM books WHERE id = :id`,\n args: { id },\n });\n const row = result.rows[0];\n return row ? rowToBook(row as Row) : null;\n}\n\nexport interface CreateBookInput {\n googleBooksId: string;\n status: BookStatus;\n priority: Priority;\n tags: string[];\n addedBy: string | null;\n pitch: string | null;\n}\n\n// The client only ever sends a googleBooksId + shelf metadata — title,\n// description, and the Goodreads URL are always re-resolved server-side.\n// Cover is initially resolved from Google Books too, but admins can later\n// override it via updateBook's coverUrl patch field.\nexport async function createBook(input: CreateBookInput): Promise {\n const volume = await getGoogleBookVolume(input.googleBooksId);\n if (!volume) throw new Error(\"Could not resolve book from Google Books\");\n\n const goodreadsUrl = await findGoodreadsUrl(\n volume.title,\n volume.author ?? \"\",\n volume.isbn13,\n );\n const rank = await nextRankFor(input.status);\n\n const insert = await sqlite.execute({\n sql: `INSERT INTO books (\n google_books_id, title, author, cover_url, description, isbn13,\n goodreads_url, status, priority, rank, tags, added_by, pitch\n ) VALUES (\n :googleBooksId, :title, :author, :coverUrl, :description, :isbn13,\n :goodreadsUrl, :status, :priority, :rank, :tags, :addedBy, :pitch\n )`,\n args: {\n googleBooksId: volume.googleBooksId,\n title: volume.title,\n author: volume.author,\n coverUrl: volume.coverUrl,\n description: volume.description,\n isbn13: volume.isbn13,\n goodreadsUrl,\n status: input.status,\n priority: input.priority,\n rank,\n tags: JSON.stringify(input.tags),\n addedBy: input.addedBy,\n pitch: input.pitch,\n },\n });\n\n const book = await getBook(Number(insert.lastInsertRowid));\n if (!book) throw new Error(\"Failed to load created book\");\n return book;\n}\n\nexport interface UpdateBookInput {\n status?: BookStatus;\n priority?: Priority;\n tags?: string[];\n addedBy?: string | null;\n pitch?: string | null;\n goodreadsUrl?: string | null;\n coverUrl?: string | null;\n}\n\nexport async function updateBook(\n id: number,\n patch: UpdateBookInput,\n): Promise {\n const existing = await getBook(id);\n if (!existing) return null;\n\n let goodreadsUrl = existing.goodreadsUrl;\n if (patch.goodreadsUrl !== undefined) {\n if (!patch.goodreadsUrl) {\n goodreadsUrl = null;\n } else {\n const validated = validateGoodreadsUrl(patch.goodreadsUrl);\n if (!validated) throw new Error(\"Invalid Goodreads URL\");\n goodreadsUrl = validated;\n }\n }\n\n const nextStatus = patch.status ?? existing.status;\n const rank = patch.status && patch.status !== existing.status\n ? await nextRankFor(nextStatus)\n : existing.rank;\n\n const coverUrl = patch.coverUrl !== undefined\n ? patch.coverUrl\n : existing.coverUrl;\n\n await sqlite.execute({\n sql: `UPDATE books SET\n status = :status,\n priority = :priority,\n rank = :rank,\n tags = :tags,\n added_by = :addedBy,\n pitch = :pitch,\n goodreads_url = :goodreadsUrl,\n cover_url = :coverUrl,\n updated_at = CURRENT_TIMESTAMP\n WHERE id = :id`,\n args: {\n id,\n status: nextStatus,\n priority: patch.priority ?? existing.priority,\n rank,\n tags: JSON.stringify(patch.tags ?? existing.tags),\n addedBy: patch.addedBy !== undefined ? patch.addedBy : existing.addedBy,\n pitch: patch.pitch !== undefined ? patch.pitch : existing.pitch,\n goodreadsUrl,\n coverUrl,\n },\n });\n\n return await getBook(id);\n}\n\nexport async function deleteBook(id: number): Promise {\n const result = await sqlite.execute({\n sql: `DELETE FROM books WHERE id = :id`,\n args: { id },\n });\n return result.rowsAffected > 0;\n}\n\n// Swaps rank only with the adjacent book of the same priority — crossing a\n// priority boundary is ambiguous, so the caller disables the button at ends.\nexport async function moveBook(\n id: number,\n direction: \"up\" | \"down\",\n): Promise {\n const book = await getBook(id);\n if (!book) return null;\n\n const comparator = direction === \"up\" ? \"<\" : \">\";\n const order = direction === \"up\" ? \"DESC\" : \"ASC\";\n const neighborResult = await sqlite.execute({\n sql:\n `SELECT * FROM books WHERE status = :status AND priority = :priority AND rank ${comparator} :rank\n ORDER BY rank ${order} LIMIT 1`,\n args: { status: book.status, priority: book.priority, rank: book.rank },\n });\n const neighborRow = neighborResult.rows[0];\n if (!neighborRow) return null; // already at the boundary\n\n const neighbor = rowToBook(neighborRow as Row);\n await sqlite.batch([\n {\n sql: `UPDATE books SET rank = :rank WHERE id = :id`,\n args: { rank: neighbor.rank, id: book.id },\n },\n {\n sql: `UPDATE books SET rank = :rank WHERE id = :id`,\n args: { rank: book.rank, id: neighbor.id },\n },\n ]);\n\n return await listBooks(book.status);\n}\n\nexport async function refreshGoodreads(id: number): Promise {\n const book = await getBook(id);\n if (!book) return null;\n const goodreadsUrl = await findGoodreadsUrl(\n book.title,\n book.author ?? \"\",\n book.isbn13,\n );\n await sqlite.execute({\n sql:\n `UPDATE books SET goodreads_url = :goodreadsUrl, updated_at = CURRENT_TIMESTAMP WHERE id = :id`,\n args: { goodreadsUrl, id },\n });\n return await getBook(id);\n}\n",[],[273,298],"50cf13f6-4642-42ce-b358-c61773a341f7","auth.ts","14bd3d9a-adce-11f1-a9cc-1607ee4eb77e",4,["D",1789123604788],"import type { Context, Next } from \"npm:hono\";\nimport { sqlite } from \"./db.ts\";\n\n// A shared password unlocks writes for 5 minutes at a time (single-household admin mode).\nconst SESSION_TTL_MS = 5 * 60 * 1000;\n\nasync function sha256(text: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(text),\n );\n return new Uint8Array(digest);\n}\n\n// Constant-time compare so a correct prefix can't be inferred from response timing.\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nasync function purgeExpiredSessions(): Promise {\n await sqlite.execute({\n sql: `DELETE FROM admin_sessions WHERE expires_at < :now`,\n args: { now: Date.now() },\n });\n}\n\nexport interface Session {\n token: string;\n expiresAt: number;\n}\n\nexport async function login(password: string): Promise {\n await purgeExpiredSessions();\n\n const adminPassword = Deno.env.get(\"ADMIN_PASSWORD\") ?? \"\";\n const [submitted, actual] = await Promise.all([\n sha256(password),\n sha256(adminPassword),\n ]);\n\n if (!adminPassword || !timingSafeEqual(submitted, actual)) return null;\n\n const token = crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute({\n sql:\n `INSERT INTO admin_sessions (token, expires_at) VALUES (:token, :expiresAt)`,\n args: { token, expiresAt },\n });\n return { token, expiresAt };\n}\n\nexport async function isValidSession(token: string): Promise {\n if (!token) return false;\n const result = await sqlite.execute({\n sql:\n `SELECT 1 FROM admin_sessions WHERE token = :token AND expires_at > :now`,\n args: { token, now: Date.now() },\n });\n return result.rows.length > 0;\n}\n\nfunction bearerToken(header: string | undefined): string {\n if (!header?.startsWith(\"Bearer \")) return \"\";\n return header.slice(\"Bearer \".length).trim();\n}\n\n// Hono middleware: revalidates the token against the DB on every write, no caching.\nexport async function requireAdmin(c: Context, next: Next) {\n const token = bearerToken(c.req.header(\"Authorization\"));\n if (!(await isValidSession(token))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n}\n",[],[273,306],"7449411e-9b2e-4af8-b5b9-cd27119254e6","pages.ts","150ae1d0-adce-11f1-bb4b-1607ee4eb77e","1492ae72-adce-11f1-9c8c-1607ee4eb77e",10,["D",1789123605295],"import { Hono } from \"npm:hono\";\nimport { getBook, listBooks } from \"../books.ts\";\nimport { BOOK_STATUSES } from \"../types.ts\";\nimport { bookListView, detailPageView } from \"../../frontend/components.ts\";\nimport { renderLayout } from \"../../frontend/layout.ts\";\n\nexport const pages = new Hono();\n\nfunction capitalize(value: string): string {\n return value.charAt(0).toUpperCase() + value.slice(1);\n}\n\npages.get(\"/\", (c) => c.redirect(\"/reading\", 302));\n\nfor (const status of BOOK_STATUSES) {\n pages.get(`/${status}`, async (c) => {\n const tag = c.req.query(\"tag\") || undefined;\n const books = await listBooks(status, tag);\n return c.html(\n renderLayout({\n title: `${capitalize(status)} — The People's Reading Club`,\n activeTab: status,\n bodyHtml: bookListView(status, books),\n }),\n );\n });\n}\n\n// A real page (not a JS-only modal) so book detail works before hydration —\n// the full-screen sheet in client.ts is progressive enhancement on top of this.\npages.get(\"/book/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n if (!Number.isInteger(id)) return c.notFound();\n const book = await getBook(id);\n if (!book) return c.notFound();\n return c.html(\n renderLayout({\n title: `${book.title} — The People's Reading Club`,\n activeTab: book.status,\n bodyHtml: detailPageView(book),\n }),\n );\n});\n",[],[273,322,314],"routes","d65c94f9-bdfc-4e8d-aecc-80ec16feb150","api.ts","14fcf99e-adce-11f1-a9cc-1607ee4eb77e",40,["D",1789374979786],"import { Hono } from \"npm:hono\";\nimport { login, requireAdmin } from \"../auth.ts\";\nimport {\n createBook,\n deleteBook,\n getBook,\n listBooks,\n moveBook,\n refreshGoodreads,\n updateBook,\n} from \"../books.ts\";\nimport { searchGoogleBooks } from \"../googleBooks.ts\";\nimport { BOOK_STATUSES, PRIORITIES } from \"../types.ts\";\nimport type { BookStatus, Priority } from \"../types.ts\";\n\nexport const api = new Hono();\n\nfunction parseId(raw: string | undefined): number | null {\n if (raw === undefined) return null;\n const id = Number(raw);\n return Number.isInteger(id) ? id : null;\n}\n\napi.post(\"/auth/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const password = typeof body?.password === \"string\" ? body.password : \"\";\n const session = await login(password);\n if (!session) return c.json({ error: \"Invalid password\" }, 401);\n return c.json(session);\n});\n\n// Reads are public — only the three tabs and book detail, no write surface.\napi.get(\"/books\", async (c) => {\n const status = c.req.query(\"status\");\n if (!status || !BOOK_STATUSES.includes(status as BookStatus)) {\n return c.json(\n { error: \"status must be one of reading, backlog, finished\" },\n 400,\n );\n }\n const tag = c.req.query(\"tag\") || undefined;\n return c.json(await listBooks(status as BookStatus, tag));\n});\n\napi.get(\"/books/:id\", async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const book = await getBook(id);\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n});\n\n// Admin-gated proxy so the Google Books quota can't be drained by anonymous callers.\napi.get(\"/google-books/search\", requireAdmin, async (c) => {\n const q = (c.req.query(\"q\") ?? \"\").trim();\n if (!q) return c.json([]);\n return c.json(await searchGoogleBooks(q));\n});\n\napi.post(\"/books\", requireAdmin, async (c) => {\n const body = await c.req.json().catch(() => null);\n if (!body || typeof body.googleBooksId !== \"string\" || !body.googleBooksId) {\n return c.json({ error: \"googleBooksId is required\" }, 400);\n }\n if (!BOOK_STATUSES.includes(body.status)) {\n return c.json({ error: \"Invalid status\" }, 400);\n }\n if (!PRIORITIES.includes(body.priority)) {\n return c.json({ error: \"Invalid priority\" }, 400);\n }\n\n const tags = Array.isArray(body.tags)\n ? body.tags.filter((t: unknown) => typeof t === \"string\")\n : [];\n\n try {\n const book = await createBook({\n googleBooksId: body.googleBooksId,\n status: body.status as BookStatus,\n priority: body.priority as Priority,\n tags,\n addedBy: typeof body.addedBy === \"string\" ? body.addedBy : null,\n pitch: typeof body.pitch === \"string\" ? body.pitch : null,\n });\n return c.json(book, 201);\n } catch (err) {\n return c.json({ error: (err as Error).message }, 400);\n }\n});\n\napi.patch(\"/books/:id\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n\n const body = await c.req.json().catch(() => null);\n if (!body) return c.json({ error: \"Invalid body\" }, 400);\n if (body.status !== undefined && !BOOK_STATUSES.includes(body.status)) {\n return c.json({ error: \"Invalid status\" }, 400);\n }\n if (body.priority !== undefined && !PRIORITIES.includes(body.priority)) {\n return c.json({ error: \"Invalid priority\" }, 400);\n }\n if (body.coverUrl !== undefined && body.coverUrl !== null && typeof body.coverUrl !== \"string\") {\n return c.json({ error: \"Invalid coverUrl\" }, 400);\n }\n\n try {\n const book = await updateBook(id, {\n status: body.status,\n priority: body.priority,\n tags: Array.isArray(body.tags)\n ? body.tags.filter((t: unknown) => typeof t === \"string\")\n : undefined,\n addedBy: body.addedBy,\n pitch: body.pitch,\n goodreadsUrl: body.goodreadsUrl,\n coverUrl: body.coverUrl,\n });\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n } catch (err) {\n return c.json({ error: (err as Error).message }, 400);\n }\n});\n\napi.delete(\"/books/:id\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const deleted = await deleteBook(id);\n if (!deleted) return c.json({ error: \"Not found\" }, 404);\n return c.json({ ok: true });\n});\n\napi.post(\"/books/:id/move\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const body = await c.req.json().catch(() => null);\n const direction = body?.direction;\n if (direction !== \"up\" && direction !== \"down\") {\n return c.json({ error: \"direction must be 'up' or 'down'\" }, 400);\n }\n const books = await moveBook(id, direction);\n if (!books) {\n return c.json({ error: \"Already at the end of this priority\" }, 409);\n }\n return c.json(books);\n});\n\napi.post(\"/books/:id/goodreads/refresh\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const book = await refreshGoodreads(id);\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n});\n",[],[273,322,324],"aae4289d-d148-434a-9178-f2736bbe770f",["D",1789123604509],[170,171],[273,322],"c6644256-2bf7-42ae-b82e-b95f5600c8f0",["D",1789123604008],[169,172,173,174,175,176,177],[273],["D",1789123298932],["D",1789560070146],{"_11":12,"_124":69},{"_11":12,"_119":120,"_68":69,"_30":67,"_121":122,"_123":24},{"_38":110,"_13":16,"_32":35,"_111":71,"_112":-5,"_113":-5,"_114":-5,"_115":-5,"_116":-5,"_117":14,"_118":12},"ctx",{"_51":-5,"_143":377,"_378":379,"_380":381,"_382":24,"_383":24,"_384":24,"_385":84,"_386":-5,"_387":-7,"_388":-7,"_389":26,"_390":24,"_391":24,"_392":-5,"_393":24,"_394":24,"_395":24,"_396":-5},"ENV",{"_348":349,"_350":351,"_352":16,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362,"_363":364,"_365":366,"_367":368,"_369":370,"_371":372,"_373":374,"_375":376},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · assets.generated.ts