${escapeHtml(opts.title)}

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_340":341,"_342":343},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_110":91,"_27":54,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":60,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",37,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","frontend/client.ts","latestPath","fileId","154bad1e-adce-11f1-aefb-1607ee4eb77e","name","client.ts","fileType","script","content","// Vanilla JS, no framework, no bundler — served as text/javascript from a\n// route. DOM nodes are built with createElement/textContent for untrusted\n// data. The one exception is the book description: it's run through\n// sanitizeDescriptionHtml (escape-then-allowlist, see below) before the\n// result is assigned via innerHTML, so only a fixed set of bare formatting\n// tags can ever render — never scripts, attributes, or arbitrary markup.\nexport const clientJs = `(function () {\n \"use strict\";\n\n var TOKEN_KEY = \"prc_token\";\n var EXP_KEY = \"prc_exp\";\n var countdownTimer = null;\n\n function getSession() {\n var token = sessionStorage.getItem(TOKEN_KEY);\n var exp = Number(sessionStorage.getItem(EXP_KEY));\n if (!token || !exp || exp <= Date.now()) return null;\n return { token: token, exp: exp };\n }\n\n function setSession(token, exp) {\n sessionStorage.setItem(TOKEN_KEY, token);\n sessionStorage.setItem(EXP_KEY, String(exp));\n }\n\n function clearSession() {\n sessionStorage.removeItem(TOKEN_KEY);\n sessionStorage.removeItem(EXP_KEY);\n document.body.classList.remove(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"false\");\n if (countdownTimer) { clearInterval(countdownTimer); countdownTimer = null; }\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdown) countdown.textContent = \"\";\n }\n\n function formatRemaining(ms) {\n var totalSeconds = Math.max(0, Math.floor(ms / 1000));\n var m = Math.floor(totalSeconds / 60);\n var s = totalSeconds % 60;\n return \"Admin \\\\u00b7 \" + m + \":\" + (s < 10 ? \"0\" : \"\") + s;\n }\n\n function startCountdown(exp) {\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdownTimer) clearInterval(countdownTimer);\n function tick() {\n var remaining = exp - Date.now();\n if (remaining <= 0) { clearSession(); return; }\n if (countdown) countdown.textContent = formatRemaining(remaining);\n }\n tick();\n countdownTimer = setInterval(tick, 1000);\n }\n\n function enterAdminMode(token, exp) {\n setSession(token, exp);\n document.body.classList.add(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"true\");\n startCountdown(exp);\n }\n\n // Wraps fetch with the bearer token; any 401 immediately drops admin mode.\n function adminFetch(url, options) {\n var session = getSession();\n options = options || {};\n options.headers = options.headers || {};\n if (session) options.headers[\"Authorization\"] = \"Bearer \" + session.token;\n return fetch(url, options).then(function (res) {\n if (res.status === 401) clearSession();\n return res;\n });\n }\n\n function showError(id, message) {\n var el = document.getElementById(id);\n if (!el) return;\n el.textContent = message;\n el.hidden = !message;\n }\n\n var ALLOWED_DESCRIPTION_TAGS = [\n \"b\", \"strong\", \"i\", \"em\", \"u\", \"p\", \"ul\", \"ol\", \"li\",\n ];\n\n function escapeHtml(value) {\n return String(value)\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n }\n\n // Mirrors backend/frontend components.ts sanitizeDescriptionHtml: escape\n // everything, then re-open only bare (attribute-free) allowlisted tags.\n function sanitizeDescriptionHtml(html) {\n var escaped = escapeHtml(html);\n ALLOWED_DESCRIPTION_TAGS.forEach(function (tag) {\n escaped = escaped\n .replace(new RegExp(\"<\" + tag + \">\", \"gi\"), \"<\" + tag + \">\")\n .replace(new RegExp(\"</\" + tag + \">\", \"gi\"), \"\");\n });\n return escaped.replace(/<br\\\\s*\\\\/?>/gi, \"
\");\n }\n\n function setupDialogClosers() {\n document.querySelectorAll(\"dialog [data-close]\").forEach(function (btn) {\n btn.addEventListener(\"click\", function () {\n var dialog = btn.closest(\"dialog\");\n if (dialog) dialog.close();\n });\n });\n }\n\n function setupAdminToggle() {\n var toggle = document.getElementById(\"admin-toggle\");\n var loginDialog = document.getElementById(\"login-dialog\");\n var loginForm = document.getElementById(\"login-form\");\n if (!toggle || !loginDialog || !loginForm) return;\n\n var session = getSession();\n if (session) enterAdminMode(session.token, session.exp);\n\n toggle.addEventListener(\"click\", function () {\n if (document.body.classList.contains(\"admin\")) {\n clearSession();\n return;\n }\n showError(\"login-error\", \"\");\n loginForm.reset();\n loginDialog.showModal();\n });\n\n loginForm.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var password = new FormData(loginForm).get(\"password\");\n fetch(\"/api/auth/login\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password: password }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"login-error\", result.body.error || \"Wrong password.\"); return; }\n enterAdminMode(result.body.token, result.body.expiresAt);\n loginDialog.close();\n })\n .catch(function () { showError(\"login-error\", \"Network error. Try again.\"); });\n });\n }\n\n function renderSearchResults(container, hiddenInput, submitBtn, results) {\n container.textContent = \"\";\n results.forEach(function (book) {\n var item = document.createElement(\"button\");\n item.type = \"button\";\n item.className = \"search-result\";\n item.setAttribute(\"role\", \"option\");\n item.setAttribute(\"aria-selected\", \"false\");\n\n if (book.coverUrl) {\n var img = document.createElement(\"img\");\n img.src = book.coverUrl;\n img.alt = \"\";\n item.appendChild(img);\n }\n var text = document.createElement(\"span\");\n text.textContent = book.title + (book.author ? \" \\\\u2014 \" + book.author : \"\");\n item.appendChild(text);\n\n item.addEventListener(\"click\", function () {\n container.querySelectorAll(\".search-result\").forEach(function (el) { el.setAttribute(\"aria-selected\", \"false\"); });\n item.setAttribute(\"aria-selected\", \"true\");\n hiddenInput.value = book.googleBooksId;\n submitBtn.disabled = false;\n });\n container.appendChild(item);\n });\n }\n\n function setupAddBook() {\n var addBtn = document.getElementById(\"add-book-btn\");\n var dialog = document.getElementById(\"add-book-dialog\");\n var form = document.getElementById(\"add-book-form\");\n if (!addBtn || !dialog || !form) return;\n\n var queryInput = form.querySelector(\"[name=query]\");\n var resultsBox = document.getElementById(\"search-results\");\n var hiddenId = form.querySelector(\"[name=googleBooksId]\");\n var submitBtn = document.getElementById(\"add-book-submit\");\n var searchTimer = null;\n\n addBtn.addEventListener(\"click\", function () {\n form.reset();\n resultsBox.textContent = \"\";\n hiddenId.value = \"\";\n submitBtn.disabled = true;\n showError(\"add-book-error\", \"\");\n dialog.showModal();\n });\n\n queryInput.addEventListener(\"input\", function () {\n var q = queryInput.value.trim();\n if (searchTimer) clearTimeout(searchTimer);\n if (!q) { resultsBox.textContent = \"\"; return; }\n searchTimer = setTimeout(function () {\n adminFetch(\"/api/google-books/search?q=\" + encodeURIComponent(q))\n .then(function (res) { return res.ok ? res.json() : []; })\n .then(function (results) { renderSearchResults(resultsBox, hiddenId, submitBtn, results); });\n }, 350);\n });\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n if (!hiddenId.value) { showError(\"add-book-error\", \"Pick a search result first.\"); return; }\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n googleBooksId: hiddenId.value,\n status: \"backlog\",\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"add-book-error\", result.body.error || \"Could not add book.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"add-book-error\", \"Network error. Try again.\"); });\n });\n }\n\n function setupCardActions() {\n document.addEventListener(\"click\", function (event) {\n var btn = event.target.closest ? event.target.closest(\"[data-action]\") : null;\n if (!btn) return;\n var id = btn.getAttribute(\"data-id\");\n var action = btn.getAttribute(\"data-action\");\n\n if (action === \"move-up\" || action === \"move-down\") {\n adminFetch(\"/api/books/\" + id + \"/move\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ direction: action === \"move-up\" ? \"up\" : \"down\" }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"advance\") {\n var nextStatus = btn.getAttribute(\"data-next-status\");\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ status: nextStatus }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"delete\") {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n }\n });\n }\n\n function setupEditPanel() {\n var form = document.getElementById(\"edit-book-form\");\n if (!form) return;\n var id = form.getAttribute(\"data-id\");\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n status: data.get(\"status\"),\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n goodreadsUrl: data.get(\"goodreadsUrl\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"edit-book-error\", result.body.error || \"Could not save.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"edit-book-error\", \"Network error. Try again.\"); });\n });\n\n var refreshBtn = document.getElementById(\"refresh-goodreads-btn\");\n if (refreshBtn) {\n refreshBtn.addEventListener(\"click\", function () {\n adminFetch(\"/api/books/\" + id + \"/goodreads/refresh\", { method: \"POST\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n });\n }\n\n var deleteBtn = document.getElementById(\"delete-book-btn\");\n if (deleteBtn) {\n deleteBtn.addEventListener(\"click\", function () {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.href = \"/\" + form.querySelector(\"[name=status]\").value;\n });\n });\n }\n }\n\n // Progressive enhancement: intercept card taps to show a full-screen sheet\n // instead of a full navigation. Falls back to the real /book/:id link if JS\n // never runs, so this never removes the working href.\n function buildSheet(book) {\n var root = document.getElementById(\"detail-sheet-root\");\n root.textContent = \"\";\n\n var sheet = document.createElement(\"div\");\n sheet.className = \"detail-sheet\";\n sheet.setAttribute(\"role\", \"dialog\");\n sheet.setAttribute(\"aria-modal\", \"true\");\n\n var closeBtn = document.createElement(\"button\");\n closeBtn.type = \"button\";\n closeBtn.className = \"detail-sheet__close\";\n closeBtn.setAttribute(\"aria-label\", \"Close\");\n closeBtn.textContent = \"\\\\u2715\";\n closeBtn.addEventListener(\"click\", closeSheet);\n sheet.appendChild(closeBtn);\n\n if (book.coverUrl) {\n var coverFrame = document.createElement(\"div\");\n coverFrame.className = \"detail__cover-frame\";\n var img = document.createElement(\"img\");\n img.className = \"detail__cover\";\n img.src = book.coverUrl;\n img.alt = \"Cover of \" + book.title;\n img.loading = \"lazy\";\n img.width = 300;\n img.height = 450;\n coverFrame.appendChild(img);\n var coverStamp = document.createElement(\"span\");\n coverStamp.className = \"stamp stamp--\" + book.status;\n coverStamp.textContent = book.status;\n coverFrame.appendChild(coverStamp);\n sheet.appendChild(coverFrame);\n } else {\n var stamp = document.createElement(\"span\");\n stamp.className = \"stamp stamp--\" + book.status;\n stamp.textContent = book.status;\n sheet.appendChild(stamp);\n }\n\n var title = document.createElement(\"h1\");\n title.className = \"detail__title\";\n title.textContent = book.title;\n sheet.appendChild(title);\n\n var author = document.createElement(\"p\");\n author.className = \"detail__author\";\n author.textContent = book.author || \"\";\n sheet.appendChild(author);\n\n if (book.pitch) {\n var pitch = document.createElement(\"p\");\n pitch.className = \"detail__pitch\";\n pitch.textContent = \"\\\\u201c\" + book.pitch + \"\\\\u201d\";\n sheet.appendChild(pitch);\n }\n\n if (book.description) {\n var desc = document.createElement(\"div\");\n desc.className = \"detail__description\";\n desc.innerHTML = sanitizeDescriptionHtml(book.description);\n sheet.appendChild(desc);\n }\n\n if (book.goodreadsUrl) {\n var cta = document.createElement(\"a\");\n cta.className = \"wax-seal\";\n cta.href = book.goodreadsUrl;\n cta.target = \"_blank\";\n cta.rel = \"noopener noreferrer\";\n cta.textContent = \"View on Goodreads\";\n sheet.appendChild(cta);\n }\n\n root.appendChild(sheet);\n document.body.style.overflow = \"hidden\";\n }\n\n function closeSheet() {\n var root = document.getElementById(\"detail-sheet-root\");\n root.textContent = \"\";\n document.body.style.overflow = \"\";\n if (location.pathname.indexOf(\"/book/\") === 0) {\n history.back();\n }\n }\n\n function setupDetailSheets() {\n var root = document.getElementById(\"detail-sheet-root\");\n if (!root) return;\n\n document.addEventListener(\"click\", function (event) {\n var link = event.target.closest ? event.target.closest(\"a.card__cover-link, a.card__title\") : null;\n if (!link) return;\n // Admins get the real page (with the edit panel — status, priority,\n // tags, etc.) instead of the read-only sheet overlay.\n if (document.body.classList.contains(\"admin\")) return;\n var href = link.getAttribute(\"href\");\n if (!href || href.indexOf(\"/book/\") !== 0) return;\n event.preventDefault();\n\n var id = href.slice(\"/book/\".length);\n fetch(\"/api/books/\" + id)\n .then(function (res) { return res.ok ? res.json() : null; })\n .then(function (book) {\n if (!book) { location.href = href; return; }\n history.pushState({ sheet: true }, \"\", href);\n buildSheet(book);\n })\n .catch(function () { location.href = href; });\n });\n\n window.addEventListener(\"popstate\", function () {\n if (!(event.state && event.state.sheet)) {\n root.textContent = \"\";\n document.body.style.overflow = \"\";\n }\n });\n }\n\n document.addEventListener(\"DOMContentLoaded\", function () {\n setupDialogClosers();\n setupAdminToggle();\n setupAddBook();\n setupCardActions();\n setupEditPanel();\n setupDetailSheets();\n });\n})();\n`;\n","// Vanilla JS, no framework, no bundler — served as text/javascript from a\n// route. DOM nodes are built with createElement/textContent for untrusted\n// data. The one exception is the book description: it's run through\n// sanitizeDescriptionHtml (escape-then-allowlist, see below) before the\n// result is assigned via innerHTML, so only a fixed set of bare formatting\n// tags can ever render — never scripts, attributes, or arbitrary markup.\nexport const clientJs = `(function () {\n \"use strict\";\n\n var TOKEN_KEY = \"prc_token\";\n var EXP_KEY = \"prc_exp\";\n var countdownTimer = null;\n\n function getSession() {\n var token = sessionStorage.getItem(TOKEN_KEY);\n var exp = Number(sessionStorage.getItem(EXP_KEY));\n if (!token || !exp || exp <= Date.now()) return null;\n return { token: token, exp: exp };\n }\n\n function setSession(token, exp) {\n sessionStorage.setItem(TOKEN_KEY, token);\n sessionStorage.setItem(EXP_KEY, String(exp));\n }\n\n function clearSession() {\n sessionStorage.removeItem(TOKEN_KEY);\n sessionStorage.removeItem(EXP_KEY);\n document.body.classList.remove(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"false\");\n if (countdownTimer) { clearInterval(countdownTimer); countdownTimer = null; }\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdown) countdown.textContent = \"\";\n }\n\n function formatRemaining(ms) {\n var totalSeconds = Math.max(0, Math.floor(ms / 1000));\n var m = Math.floor(totalSeconds / 60);\n var s = totalSeconds % 60;\n return \"Admin \\\\u00b7 \" + m + \":\" + (s < 10 ? \"0\" : \"\") + s;\n }\n\n function startCountdown(exp) {\n var countdown = document.getElementById(\"admin-countdown\");\n if (countdownTimer) clearInterval(countdownTimer);\n function tick() {\n var remaining = exp - Date.now();\n if (remaining <= 0) { clearSession(); return; }\n if (countdown) countdown.textContent = formatRemaining(remaining);\n }\n tick();\n countdownTimer = setInterval(tick, 1000);\n }\n\n function enterAdminMode(token, exp) {\n setSession(token, exp);\n document.body.classList.add(\"admin\");\n var toggle = document.getElementById(\"admin-toggle\");\n if (toggle) toggle.setAttribute(\"aria-pressed\", \"true\");\n startCountdown(exp);\n }\n\n // Wraps fetch with the bearer token; any 401 immediately drops admin mode.\n function adminFetch(url, options) {\n var session = getSession();\n options = options || {};\n options.headers = options.headers || {};\n if (session) options.headers[\"Authorization\"] = \"Bearer \" + session.token;\n return fetch(url, options).then(function (res) {\n if (res.status === 401) clearSession();\n return res;\n });\n }\n\n function showError(id, message) {\n var el = document.getElementById(id);\n if (!el) return;\n el.textContent = message;\n el.hidden = !message;\n }\n\n var ALLOWED_DESCRIPTION_TAGS = [\n \"b\", \"strong\", \"i\", \"em\", \"u\", \"p\", \"ul\", \"ol\", \"li\",\n ];\n\n function escapeHtml(value) {\n return String(value)\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n }\n\n // Mirrors backend/frontend components.ts sanitizeDescriptionHtml: escape\n // everything, then re-open only bare (attribute-free) allowlisted tags.\n function sanitizeDescriptionHtml(html) {\n var escaped = escapeHtml(html);\n ALLOWED_DESCRIPTION_TAGS.forEach(function (tag) {\n escaped = escaped\n .replace(new RegExp(\"<\" + tag + \">\", \"gi\"), \"<\" + tag + \">\")\n .replace(new RegExp(\"</\" + tag + \">\", \"gi\"), \"\");\n });\n return escaped.replace(/<br\\\\s*\\\\/?>/gi, \"
\");\n }\n\n function setupDialogClosers() {\n document.querySelectorAll(\"dialog [data-close]\").forEach(function (btn) {\n btn.addEventListener(\"click\", function () {\n var dialog = btn.closest(\"dialog\");\n if (dialog) dialog.close();\n });\n });\n }\n\n function setupAdminToggle() {\n var toggle = document.getElementById(\"admin-toggle\");\n var loginDialog = document.getElementById(\"login-dialog\");\n var loginForm = document.getElementById(\"login-form\");\n if (!toggle || !loginDialog || !loginForm) return;\n\n var session = getSession();\n if (session) enterAdminMode(session.token, session.exp);\n\n toggle.addEventListener(\"click\", function () {\n if (document.body.classList.contains(\"admin\")) {\n clearSession();\n return;\n }\n showError(\"login-error\", \"\");\n loginForm.reset();\n loginDialog.showModal();\n });\n\n loginForm.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var password = new FormData(loginForm).get(\"password\");\n fetch(\"/api/auth/login\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ password: password }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"login-error\", result.body.error || \"Wrong password.\"); return; }\n enterAdminMode(result.body.token, result.body.expiresAt);\n loginDialog.close();\n })\n .catch(function () { showError(\"login-error\", \"Network error. Try again.\"); });\n });\n }\n\n function renderSearchResults(container, hiddenInput, submitBtn, results) {\n container.textContent = \"\";\n results.forEach(function (book) {\n var item = document.createElement(\"button\");\n item.type = \"button\";\n item.className = \"search-result\";\n item.setAttribute(\"role\", \"option\");\n item.setAttribute(\"aria-selected\", \"false\");\n\n if (book.coverUrl) {\n var img = document.createElement(\"img\");\n img.src = book.coverUrl;\n img.alt = \"\";\n item.appendChild(img);\n }\n var text = document.createElement(\"span\");\n text.textContent = book.title + (book.author ? \" \\\\u2014 \" + book.author : \"\");\n item.appendChild(text);\n\n item.addEventListener(\"click\", function () {\n container.querySelectorAll(\".search-result\").forEach(function (el) { el.setAttribute(\"aria-selected\", \"false\"); });\n item.setAttribute(\"aria-selected\", \"true\");\n hiddenInput.value = book.googleBooksId;\n submitBtn.disabled = false;\n });\n container.appendChild(item);\n });\n }\n\n function setupAddBook() {\n var addBtn = document.getElementById(\"add-book-btn\");\n var dialog = document.getElementById(\"add-book-dialog\");\n var form = document.getElementById(\"add-book-form\");\n if (!addBtn || !dialog || !form) return;\n\n var queryInput = form.querySelector(\"[name=query]\");\n var resultsBox = document.getElementById(\"search-results\");\n var hiddenId = form.querySelector(\"[name=googleBooksId]\");\n var submitBtn = document.getElementById(\"add-book-submit\");\n var searchTimer = null;\n\n addBtn.addEventListener(\"click\", function () {\n form.reset();\n resultsBox.textContent = \"\";\n hiddenId.value = \"\";\n submitBtn.disabled = true;\n showError(\"add-book-error\", \"\");\n dialog.showModal();\n });\n\n queryInput.addEventListener(\"input\", function () {\n var q = queryInput.value.trim();\n if (searchTimer) clearTimeout(searchTimer);\n if (!q) { resultsBox.textContent = \"\"; return; }\n searchTimer = setTimeout(function () {\n adminFetch(\"/api/google-books/search?q=\" + encodeURIComponent(q))\n .then(function (res) { return res.ok ? res.json() : []; })\n .then(function (results) { renderSearchResults(resultsBox, hiddenId, submitBtn, results); });\n }, 350);\n });\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n if (!hiddenId.value) { showError(\"add-book-error\", \"Pick a search result first.\"); return; }\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n googleBooksId: hiddenId.value,\n status: \"backlog\",\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"add-book-error\", result.body.error || \"Could not add book.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"add-book-error\", \"Network error. Try again.\"); });\n });\n }\n\n function setupCardActions() {\n document.addEventListener(\"click\", function (event) {\n var btn = event.target.closest ? event.target.closest(\"[data-action]\") : null;\n if (!btn) return;\n var id = btn.getAttribute(\"data-id\");\n var action = btn.getAttribute(\"data-action\");\n\n if (action === \"move-up\" || action === \"move-down\") {\n adminFetch(\"/api/books/\" + id + \"/move\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ direction: action === \"move-up\" ? \"up\" : \"down\" }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"advance\") {\n var nextStatus = btn.getAttribute(\"data-next-status\");\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ status: nextStatus }),\n }).then(function (res) { if (res.ok) location.reload(); });\n }\n\n if (action === \"delete\") {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n }\n });\n }\n\n function setupEditPanel() {\n var form = document.getElementById(\"edit-book-form\");\n if (!form) return;\n var id = form.getAttribute(\"data-id\");\n\n form.addEventListener(\"submit\", function (event) {\n event.preventDefault();\n var data = new FormData(form);\n var tags = String(data.get(\"tags\") || \"\")\n .split(\",\")\n .map(function (t) { return t.trim(); })\n .filter(Boolean);\n\n adminFetch(\"/api/books/\" + id, {\n method: \"PATCH\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n status: data.get(\"status\"),\n priority: data.get(\"priority\"),\n tags: tags,\n addedBy: data.get(\"addedBy\") || null,\n pitch: data.get(\"pitch\") || null,\n goodreadsUrl: data.get(\"goodreadsUrl\") || null,\n coverUrl: data.get(\"coverUrl\") || null,\n }),\n })\n .then(function (res) { return res.json().then(function (body) { return { ok: res.ok, body: body }; }); })\n .then(function (result) {\n if (!result.ok) { showError(\"edit-book-error\", result.body.error || \"Could not save.\"); return; }\n location.reload();\n })\n .catch(function () { showError(\"edit-book-error\", \"Network error. Try again.\"); });\n });\n\n var refreshBtn = document.getElementById(\"refresh-goodreads-btn\");\n if (refreshBtn) {\n refreshBtn.addEventListener(\"click\", function () {\n adminFetch(\"/api/books/\" + id + \"/goodreads/refresh\", { method: \"POST\" }).then(function (res) {\n if (res.ok) location.reload();\n });\n });\n }\n\n var deleteBtn = document.getElementById(\"delete-book-btn\");\n if (deleteBtn) {\n deleteBtn.addEventListener(\"click\", function () {\n if (!confirm(\"Remove this book from the shelf?\")) return;\n adminFetch(\"/api/books/\" + id, { method: \"DELETE\" }).then(function (res) {\n if (res.ok) location.href = \"/\" + form.querySelector(\"[name=status]\").value;\n });\n });\n }\n }\n\n // Progressive enhancement: intercept card taps to show a full-screen sheet\n // instead of a full navigation. Falls back to the real /book/:id link if JS\n // never runs, so this never removes the working href.\n function buildSheet(book) {\n var root = document.getElementById(\"detail-sheet-root\");\n root.textContent = \"\";\n\n var sheet = document.createElement(\"div\");\n sheet.className = \"detail-sheet\";\n sheet.setAttribute(\"role\", \"dialog\");\n sheet.setAttribute(\"aria-modal\", \"true\");\n\n var closeBtn = document.createElement(\"button\");\n closeBtn.type = \"button\";\n closeBtn.className = \"detail-sheet__close\";\n closeBtn.setAttribute(\"aria-label\", \"Close\");\n closeBtn.textContent = \"\\\\u2715\";\n closeBtn.addEventListener(\"click\", closeSheet);\n sheet.appendChild(closeBtn);\n\n if (book.coverUrl) {\n var coverFrame = document.createElement(\"div\");\n coverFrame.className = \"detail__cover-frame\";\n var img = document.createElement(\"img\");\n img.className = \"detail__cover\";\n img.src = book.coverUrl;\n img.alt = \"Cover of \" + book.title;\n img.loading = \"lazy\";\n img.width = 300;\n img.height = 450;\n coverFrame.appendChild(img);\n var coverStamp = document.createElement(\"span\");\n coverStamp.className = \"stamp stamp--\" + book.status;\n coverStamp.textContent = book.status;\n coverFrame.appendChild(coverStamp);\n sheet.appendChild(coverFrame);\n } else {\n var stamp = document.createElement(\"span\");\n stamp.className = \"stamp stamp--\" + book.status;\n stamp.textContent = book.status;\n sheet.appendChild(stamp);\n }\n\n var title = document.createElement(\"h1\");\n title.className = \"detail__title\";\n title.textContent = book.title;\n sheet.appendChild(title);\n\n var author = document.createElement(\"p\");\n author.className = \"detail__author\";\n author.textContent = book.author || \"\";\n sheet.appendChild(author);\n\n if (book.pitch) {\n var pitch = document.createElement(\"p\");\n pitch.className = \"detail__pitch\";\n pitch.textContent = \"\\\\u201c\" + book.pitch + \"\\\\u201d\";\n sheet.appendChild(pitch);\n }\n\n if (book.description) {\n var desc = document.createElement(\"div\");\n desc.className = \"detail__description\";\n desc.innerHTML = sanitizeDescriptionHtml(book.description);\n sheet.appendChild(desc);\n }\n\n if (book.tags && book.tags.length) {\n var tagList = document.createElement(\"ul\");\n tagList.className = \"detail__tags\";\n book.tags.forEach(function (t) {\n var li = document.createElement(\"li\");\n li.textContent = t;\n tagList.appendChild(li);\n });\n sheet.appendChild(tagList);\n }\n\n if (book.goodreadsUrl) {\n var cta = document.createElement(\"a\");\n cta.className = \"wax-seal\";\n cta.href = book.goodreadsUrl;\n cta.target = \"_blank\";\n cta.rel = \"noopener noreferrer\";\n cta.textContent = \"View on Goodreads\";\n sheet.appendChild(cta);\n }\n\n root.appendChild(sheet);\n document.body.style.overflow = \"hidden\";\n }\n\n function closeSheet() {\n var root = document.getElementById(\"detail-sheet-root\");\n root.textContent = \"\";\n document.body.style.overflow = \"\";\n if (location.pathname.indexOf(\"/book/\") === 0) {\n history.back();\n }\n }\n\n function setupDetailSheets() {\n var root = document.getElementById(\"detail-sheet-root\");\n if (!root) return;\n\n document.addEventListener(\"click\", function (event) {\n var link = event.target.closest ? event.target.closest(\"a.card__cover-link, a.card__title\") : null;\n if (!link) return;\n // Admins get the real page (with the edit panel — status, priority,\n // tags, etc.) instead of the read-only sheet overlay.\n if (document.body.classList.contains(\"admin\")) return;\n var href = link.getAttribute(\"href\");\n if (!href || href.indexOf(\"/book/\") !== 0) return;\n event.preventDefault();\n\n var id = href.slice(\"/book/\".length);\n fetch(\"/api/books/\" + id)\n .then(function (res) { return res.ok ? res.json() : null; })\n .then(function (book) {\n if (!book) { location.href = href; return; }\n history.pushState({ sheet: true }, \"\", href);\n buildSheet(book);\n })\n .catch(function () { location.href = href; });\n });\n\n window.addEventListener(\"popstate\", function () {\n if (!(event.state && event.state.sheet)) {\n root.textContent = \"\";\n document.body.style.overflow = \"\";\n }\n });\n }\n\n document.addEventListener(\"DOMContentLoaded\", function () {\n setupDialogClosers();\n setupAdminToggle();\n setupAddBook();\n setupCardActions();\n setupEditPanel();\n setupDetailSheets();\n });\n})();\n`;\n","createdAt",["D",1789374979802],"branchVersion","branchId","7057c7c9-cb7e-4231-ba4a-4de1c7307134","id","e3c75355-427b-479b-9042-7cb9364551d9","peoples-reading-club",["D",1789123298932],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","2add9a59-dc30-45c4-b94e-f9ad95afa97f","pinnedFileId","15bfcbb8-adce-11f1-86dd-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a08f3c-7541-7640-b197-0e70511ccfce","tursoName","e3c75355427b479b90427cb9364551d9","tursoHostname","e3c75355427b479b90427cb9364551d9-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789560070146],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",45,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","bookclub","handle","displayName","Alex Croitor","avatar","https://lh3.googleusercontent.com/a/ACg8ocJMLw4eXrxwJO6x_yW447MqVkbZ9dkezJobsu2ttp0HqCN2o4TV=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":335,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":336,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":337,"_85":338,"_87":339,"_89":25},"tree",[184,194,201,202,203],"files",[184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203],"counts",{"_173":64,"_174":170,"_175":64,"_176":177,"_178":179},"contents",[131,132,133,134,135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":167,"_32":168,"_30":169,"_138":-5,"_42":43,"_41":170,"_140":60,"_39":171,"_13":64,"_34":165,"_36":-5,"_24":25,"_144":-5,"_27":172},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":164,"_13":64,"_34":165,"_36":-5,"_24":25,"_144":-5,"_27":166},{"_44":153,"_32":154,"_30":155,"_138":-5,"_42":43,"_41":156,"_140":60,"_39":157,"_13":64,"_34":20,"_36":158,"_24":25,"_144":-5,"_27":159},{"_44":146,"_32":147,"_30":148,"_138":-5,"_42":43,"_41":149,"_140":60,"_39":150,"_13":64,"_34":20,"_36":151,"_24":25,"_144":-5,"_27":152},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":141,"_13":64,"_34":142,"_36":143,"_24":25,"_144":-5,"_27":145},"fd49accc-1e32-4bce-a7f9-cf205ebf35a4","index.http.tsx","parentId",20,"latest",["D",1789123606242],"http","import { Hono } from \"npm:hono\";\nimport { initDb } from \"./backend/db.ts\";\nimport { pages } from \"./backend/routes/pages.ts\";\nimport { api } from \"./backend/routes/api.ts\";\nimport { styles } from \"./frontend/styles.ts\";\nimport { clientJs } from \"./frontend/client.ts\";\nimport { iconSvg, manifestJson } from \"./frontend/manifest.ts\";\nimport {\n FONT_OTF_BASE64,\n ICON_192_PNG_BASE64,\n ICON_512_PNG_BASE64,\n} from \"./frontend/assets.generated.ts\";\n\nconst app = new Hono();\n\nfunction base64ToBytes(base64: string): Uint8Array {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes as Uint8Array;\n}\n\n// Plain Response, not c.body(): Hono's typed Data overload wants\n// Uint8Array specifically, which the generic decode above doesn't guarantee.\nfunction binaryResponse(\n bytes: Uint8Array,\n contentType: string,\n extraHeaders: Record = {},\n) {\n return new Response(bytes, {\n status: 200,\n headers: { \"Content-Type\": contentType, ...extraHeaders },\n });\n}\n\n// Runs on every request but is memoized inside initDb(), so a dropped table\n// in the SQLite admin panel self-heals on the very next request.\napp.use(\"*\", async (c, next) => {\n await initDb();\n await next();\n});\n\nconst IMMUTABLE = { \"Cache-Control\": \"public, max-age=31536000, immutable\" };\n\napp.get(\n \"/static/app.css\",\n (c) =>\n c.body(styles, 200, {\n \"Content-Type\": \"text/css; charset=utf-8\",\n ...IMMUTABLE,\n }),\n);\n\napp.get(\n \"/static/client.js\",\n (c) =>\n c.body(clientJs, 200, {\n \"Content-Type\": \"text/javascript; charset=utf-8\",\n ...IMMUTABLE,\n }),\n);\n\napp.get(\n \"/static/fonts/RedOctoberLight.otf\",\n () => binaryResponse(base64ToBytes(FONT_OTF_BASE64), \"font/otf\", IMMUTABLE),\n);\n\napp.get(\n \"/manifest.webmanifest\",\n (c) =>\n c.body(manifestJson, 200, { \"Content-Type\": \"application/manifest+json\" }),\n);\n\napp.get(\n \"/icon.svg\",\n (c) => c.body(iconSvg, 200, { \"Content-Type\": \"image/svg+xml\" }),\n);\n\napp.get(\n \"/icon-192.png\",\n () =>\n binaryResponse(base64ToBytes(ICON_192_PNG_BASE64), \"image/png\", IMMUTABLE),\n);\n\napp.get(\n \"/icon-512.png\",\n () =>\n binaryResponse(base64ToBytes(ICON_512_PNG_BASE64), \"image/png\", IMMUTABLE),\n);\n\napp.route(\"/api\", api);\napp.route(\"/\", pages);\n\napp.notFound((c) => c.text(\"Not found\", 404));\n\nexport default app.fetch;\n","label",[137],"1a9ca186-842d-4bf0-ae22-f662ed2521e2","README.md","158a0884-adce-11f1-a7e6-1607ee4eb77e",17,["D",1789123606104],"# The People's Reading Club\r\n\r\nA server-rendered book club tracker for one Val Town HTTP val. Three\r\nread-only tabs (Reading / Backlog / Finished), a real `/book/:id` page per\r\nbook, and a 5-minute shared admin mode for writes. No client framework, no\r\nbundler, no blob storage — every asset (CSS, JS, manifest, icons, font) is a\r\nTypeScript string served from a route.\r\n\r\n## Stack\r\n\r\n- [Hono](https://hono.dev/) router in [index.http.tsx](index.http.tsx)\r\n- Val-scoped [SQLite](https://docs.val.town/reference/std/sqlite/) (`backend/db.ts`)\r\n- Vanilla JS admin client (`frontend/client.ts`), progressive enhancement only\r\n- Google Books API for metadata, Goodreads ISBN-redirect (+ optional search\r\n fallback) for the Goodreads link\r\n\r\n## Environment variables\r\n\r\n| Variable | Required | Purpose |\r\n| --- | --- | --- |\r\n| `ADMIN_PASSWORD` | yes | Shared password that unlocks a 5-minute admin session. |\r\n| `GOOGLE_BOOKS_API_KEY` | no | Raises the Google Books API quota; works unauthenticated without it. |\r\n| `SEARCH_API_PROVIDER` | no | `serper` (default) or `brave`. Only consulted when a book has no ISBN-13. |\r\n| `SERPER_API_KEY` | only if using Serper | [serper.dev](https://serper.dev) API key, 2,500 free credits. |\r\n| `BRAVE_API_KEY` | only if using Brave | Brave Search API key, alternate provider. |\r\n| `GOODREADS_PROFILES` | no | JSON array of `{\"name\": \"...\", \"url\": \"https://www.goodreads.com/...\"}` shown in the footer. Entries that aren't `https://*goodreads.com` are silently dropped. |\r\n\r\n`GOOGLE_CSE_ID` is intentionally not used — Google Custom Search Engine is\r\nclosed to new customers and EOL Jan 1 2027, so it never made it into this\r\nbuild; Serper (or Brave) is the fallback instead.\r\n\r\n## Setup\r\n\r\n1. Install the Val Town CLI and log in:\r\n ```sh\r\n deno install -grAf jsr:@valtown/vt\r\n vt\r\n ```\r\n2. From this folder: `vt create peoples-reading-club --no-editor-files` (or\r\n `vt clone` if the val already exists), which links `.vt/state.json` to a\r\n Val Town project. The entry file is named `index.http.tsx` — the `http` in\r\n the filename is what makes `vt` register it as an HTTP trigger.\r\n3. Set the environment variables above on the val (Settings → Environment\r\n Variables, or `vt`'s env commands).\r\n4. `vt push` to deploy, `vt tail` to watch logs.\r\n\r\n## Data model\r\n\r\n`books(id, google_books_id, title, author, cover_url, description, isbn13,\r\ngoodreads_url, status, priority, rank, tags, added_by, pitch, created_at,\r\nupdated_at)` plus `admin_sessions(token, expires_at)`. `initDb()` in\r\n`backend/db.ts` runs `CREATE TABLE IF NOT EXISTS` + indexes, memoized per\r\ncold start and awaited from Hono middleware on every request — so dropping\r\nthe `books` table in the SQLite admin panel and reloading recreates the\r\nschema with no redeploy.\r\n\r\nSort order is `CASE priority WHEN 'high' THEN 0 ... END, rank ASC`. New books\r\nget `rank = COALESCE(MAX(rank), 0) + 1` scoped to their status.\r\n\r\n## Judgement calls where the spec was ambiguous\r\n\r\n- **Per-IP login throttle: dropped.** The plan's `admin_login_attempts`\r\n table and 10-failures/15-min lockout were cut per the \"friends-only app\"\r\n call — this is a shared password behind a countdown, not a public login\r\n form worth rate-limiting infrastructure for. The login digest comparison\r\n is still constant-time and nothing is logged.\r\n- **Manifest icons: PNGs generated, not just SVG.** Val Town vals can't\r\n store binary files, so `scripts/gen_icons.py` (Pillow, run locally, not\r\n part of the deployed val — see `.vtignore`) rendered 192×192 and 512×512\r\n PNGs and the `.otf` font, then base64-embedded all three into\r\n `frontend/assets.generated.ts` as plain TS string exports. `index.http.tsx`\r\n decodes them at request time and serves them with real\r\n `Content-Type`/`Cache-Control` headers. Regenerate with\r\n `python scripts/gen_icons.py` if the icon design changes.\r\n- **Serper wired now**, not stubbed. `backend/goodreads.ts` only calls it\r\n when a book has no ISBN-13 (Google Books already supplies one for most\r\n books), so a typical add-book flow costs zero search-API calls.\r\n- **Admin-editable fields are narrower than \"everything.\"** `PATCH\r\n /api/books/:id` accepts `status`, `priority`, `tags`, `addedBy`, `pitch`,\r\n and `goodreadsUrl` (validated). Title, author, cover, description, and\r\n isbn13 stay server-resolved from Google Books at creation time and have no\r\n edit path — this is what the \"client never supplies title/cover/\r\n description\" security note implies, and it avoids reintroducing arbitrary\r\n metadata injection through the back door. If Google Books resolves the\r\n wrong edition, delete and re-add.\r\n- **Reorder boundaries are computed server-side per render.** `bookListView`\r\n walks the already-sorted list and disables a card's up/down button when\r\n the adjacent book (or list edge) has a different priority, rather than\r\n only relying on the API's 409 response.\r\n- **Progressive-enhancement detail sheet** fetches `/api/books/:id` (a\r\n public read endpoint) on card click and builds the overlay with\r\n `createElement`/`textContent`, never `innerHTML`, then falls back to a\r\n normal navigation to `/book/:id` if the fetch fails or JS never loads.\r\n- **`GOODREADS_PROFILES` format**: a JSON array rather than a delimited\r\n string, so names with commas/colons aren't a parsing hazard. Validated\r\n against `https:` + `*.goodreads.com` before rendering, same as the\r\n admin-supplied `goodreads_url` correction.\r\n\r\n## Security notes (OWASP)\r\n\r\n- **XSS** — `escapeHtml()` in `frontend/components.ts` is the only path any\r\n DB-sourced string takes into HTML; the client JS builds the detail sheet\r\n with `createElement`/`textContent`, never `innerHTML`.\r\n- **Open redirect / `javascript:` URIs** — `validateGoodreadsUrl()` in\r\n `backend/goodreads.ts` requires `https:` + a `goodreads.com` host + a\r\n `/book/show/` path before accepting a manual `goodreads_url` correction or\r\n a search-provider result; anything else is rejected with 400.\r\n- **Cover URLs** — `sanitizeCoverUrl()` upgrades `http:` to `https:` and\r\n allowlists `books.google.com`, `books.googleusercontent.com`, and\r\n `*.gstatic.com`; anything else is dropped to `null`.\r\n- **SSRF** — every outbound `fetch` (Google Books, Goodreads, Serper, Brave)\r\n targets a hardcoded host; user input only ever lands in a query string or\r\n path segment, never in the fetched URL's origin.\r\n- **Auth** — `requireAdmin` re-validates the bearer token against\r\n `admin_sessions.expires_at` in SQLite on every write (no caching), a\r\n password never being logged, a 5-minute session, and opportunistic\r\n expired-session purging on every login attempt.\r\n\r\n## Verification checklist\r\n\r\n1. `vt push`, then `vt tail` for live logs.\r\n2. Drop the `books` table in the SQLite admin panel, reload a tab → table\r\n and indexes are recreated automatically.\r\n3. `curl -X DELETE .../api/books/1` with no token / a made-up token / an\r\n expired token → 401 every time.\r\n4. Add a book with a known ISBN-13 (e.g. search \"Dune\") → cover and\r\n `goodreads_url` populate with zero Serper/Brave calls (check `vt tail`\r\n for the absence of a `google.serper.dev` request). Add an ISBN-less\r\n volume → either the search fallback finds it or `goodreads_url` stays\r\n `null` without throwing.\r\n5. Two same-priority backlog books swap order via the up/down buttons and\r\n the new order survives a reload; the top/bottom book in a priority group\r\n has that direction's button disabled.\r\n6. Add a book whose pitch is `

` → renders as\r\n literal text on the card and detail page.\r\n7. `PATCH` a book's `goodreads_url` to `javascript:alert(1)` → 400.\r\n8. Chrome DevTools device toolbar + Slow 4G throttling: fast first paint\r\n (CSS/JS are same-origin, no build step to wait on), no auto-zoom on input\r\n focus (all inputs are `font-size: 16px`), \"Add to Home Screen\" installs\r\n using `manifest.webmanifest` + the generated PNG icons.\r\n\r\n## Dropping the custom font entirely\r\n\r\nEverything routes through one `@font-face` in `frontend/styles.ts` pointing\r\nat `/static/fonts/RedOctoberLight.otf`. To remove it: delete that\r\n`@font-face` block, delete the `/static/fonts/RedOctoberLight.otf` route in\r\n`index.http.tsx`, delete `FONT_OTF_BASE64` from\r\n`frontend/assets.generated.ts`, and change the heading font stack (the\r\n`h1, h2, .stamp, .wax-seal, .admin-star, .card__title` selector) to drop\r\n`'RedOctober'` — it already falls back to the Oswald webfont link in\r\n`frontend/layout.ts`'s ``, then `'Arial Narrow Bold'`/`Impact`.\r\n",[147],"2b47d755-13c2-4bb9-a054-7c9292dabf4d",".vtignore","15b3153a-adce-11f1-bc86-1607ee4eb77e",19,["D",1789123605016],".git\r\n.vt\r\nscripts\r\nRedOctoberLight-3nd6.otf\r\nnode_modules\r\n",[154],"d6bfab87-4c56-4ee1-b2af-e1a89991aae5","frontend","1470f110-adce-11f1-88f6-1607ee4eb77e",2,["D",1789123604280],"directory",[161],"c6644256-2bf7-42ae-b82e-b95f5600c8f0","backend","14462d36-adce-11f1-a416-1607ee4eb77e",1,["D",1789123604008],[168],"pulls","branches","forks","envVars",{"_180":182,"_183":64},"connections",{"_180":64,"_181":64},"count","unfilledCount",3,"emptyCount",{"_44":167,"_32":168,"_30":169,"_138":-5,"_42":43,"_41":170,"_140":60,"_39":332,"_13":64,"_34":165,"_36":-5,"_24":25,"_144":-5,"_205":333,"_27":334},{"_44":328,"_32":319,"_30":313,"_138":169,"_42":43,"_41":182,"_140":60,"_39":329,"_13":64,"_34":165,"_36":-5,"_24":25,"_144":-5,"_205":330,"_27":331},{"_44":320,"_32":321,"_30":322,"_138":313,"_42":43,"_41":323,"_140":25,"_39":324,"_13":64,"_34":35,"_36":325,"_24":25,"_144":-5,"_205":326,"_27":327},{"_44":310,"_32":311,"_30":312,"_138":313,"_42":43,"_41":314,"_140":60,"_39":315,"_13":64,"_34":35,"_36":316,"_24":25,"_144":-5,"_205":317,"_27":318},{"_44":302,"_32":303,"_30":304,"_138":169,"_42":43,"_41":305,"_140":60,"_39":306,"_13":64,"_34":35,"_36":307,"_24":25,"_144":-5,"_205":308,"_27":309},{"_44":294,"_32":295,"_30":296,"_138":169,"_42":43,"_41":297,"_140":60,"_39":298,"_13":170,"_34":35,"_36":299,"_24":25,"_144":-5,"_205":300,"_27":301},{"_44":286,"_32":287,"_30":288,"_138":169,"_42":43,"_41":289,"_140":60,"_39":290,"_13":64,"_34":35,"_36":291,"_24":25,"_144":-5,"_205":292,"_27":293},{"_44":278,"_32":279,"_30":280,"_138":169,"_42":43,"_41":281,"_140":60,"_39":282,"_13":64,"_34":35,"_36":283,"_24":25,"_144":-5,"_205":284,"_27":285},{"_44":270,"_32":271,"_30":272,"_138":169,"_42":43,"_41":273,"_140":60,"_39":274,"_13":170,"_34":35,"_36":275,"_24":25,"_144":-5,"_205":276,"_27":277},{"_44":262,"_32":263,"_30":264,"_138":169,"_42":43,"_41":265,"_140":60,"_39":266,"_13":64,"_34":35,"_36":267,"_24":25,"_144":-5,"_205":268,"_27":269},{"_44":160,"_32":161,"_30":162,"_138":-5,"_42":43,"_41":163,"_140":60,"_39":259,"_13":64,"_34":165,"_36":-5,"_24":25,"_144":-5,"_205":260,"_27":261},{"_44":251,"_32":252,"_30":253,"_138":162,"_42":43,"_41":254,"_140":60,"_39":255,"_13":64,"_34":35,"_36":256,"_24":25,"_144":-5,"_205":257,"_27":258},{"_44":247,"_32":33,"_30":31,"_138":162,"_42":43,"_41":14,"_140":25,"_39":248,"_13":219,"_34":35,"_36":38,"_24":25,"_144":-5,"_205":249,"_27":250},{"_44":239,"_32":240,"_30":241,"_138":162,"_42":43,"_41":242,"_140":25,"_39":243,"_13":182,"_34":35,"_36":244,"_24":25,"_144":-5,"_205":245,"_27":246},{"_44":231,"_32":232,"_30":233,"_138":162,"_42":43,"_41":234,"_140":60,"_39":235,"_13":163,"_34":35,"_36":236,"_24":25,"_144":-5,"_205":237,"_27":238},{"_44":223,"_32":224,"_30":225,"_138":162,"_42":43,"_41":226,"_140":60,"_39":227,"_13":64,"_34":35,"_36":228,"_24":25,"_144":-5,"_205":229,"_27":230},{"_44":214,"_32":215,"_30":216,"_138":162,"_42":43,"_41":217,"_140":25,"_39":218,"_13":219,"_34":35,"_36":220,"_24":25,"_144":-5,"_205":221,"_27":222},{"_44":153,"_32":154,"_30":155,"_138":-5,"_42":43,"_41":156,"_140":60,"_39":211,"_13":64,"_34":20,"_36":158,"_24":25,"_144":-5,"_205":212,"_27":213},{"_44":146,"_32":147,"_30":148,"_138":-5,"_42":43,"_41":149,"_140":60,"_39":208,"_13":64,"_34":20,"_36":151,"_24":25,"_144":-5,"_205":209,"_27":210},{"_44":136,"_32":137,"_30":58,"_138":-5,"_42":43,"_41":139,"_140":60,"_39":204,"_13":64,"_34":142,"_36":143,"_24":25,"_144":-5,"_205":206,"_27":207},["D",1789123606242],"children",[],[137],["D",1789123606104],[],[147],["D",1789123605016],[],[154],"461fe0bb-0ec2-4291-957d-2a79f4b14a6c","styles.ts","1599424a-adce-11f1-b099-1607ee4eb77e",33,["D",1789126435347],5,"// Exported as a string and served at /static/app.css with immutable caching —\n// no bundler, no build step, just a route in index.http.tsx.\nexport const styles = `\n:root {\n --red: #C0392B;\n --cream: #F0E6D2;\n --ink: #1C1C1C;\n --gold: #D4A017;\n --nav-height: 64px;\n color-scheme: light;\n}\n\n@font-face {\n font-family: 'RedOctober';\n src: url('/static/fonts/RedOctoberLight.otf') format('opentype');\n font-weight: 300;\n font-display: swap;\n}\n\n* { box-sizing: border-box; }\n\nhtml, body {\n margin: 0;\n padding: 0;\n background: var(--cream);\n color: var(--ink);\n font-family: 'RedOctober', 'Oswald', 'Arial Narrow Bold', Impact, 'Arial Narrow', sans-serif;\n font-size: 16px;\n line-height: 1.4;\n}\n\nbody {\n background-image:\n radial-gradient(rgba(28, 28, 28, 0.05) 1px, transparent 1px);\n background-size: 6px 6px;\n}\n\nh1, h2, .stamp, .wax-seal, .admin-star, .card__title {\n letter-spacing: 0.02em;\n}\n\na { color: inherit; }\n\n.page {\n max-width: 960px;\n margin: 0 auto;\n padding: 12px 12px calc(var(--nav-height) + 56px);\n}\n\n/* ---------- admin bar ---------- */\n\n.admin-bar {\n display: flex;\n align-items: center;\n gap: 12px;\n padding: 8px 0 16px;\n}\n\n.admin-star {\n width: 44px;\n height: 44px;\n min-width: 44px;\n border-radius: 50%;\n border: 2px solid var(--ink);\n background: var(--cream);\n color: var(--gold);\n font-size: 22px;\n cursor: pointer;\n}\n\n.admin-star[aria-pressed=\"true\"] {\n background: var(--gold);\n color: var(--ink);\n}\n\n.admin-countdown {\n font-variant-numeric: tabular-nums;\n font-weight: bold;\n}\n\n#add-book-btn {\n margin-left: auto;\n border: 2px solid var(--ink);\n background: var(--red);\n color: var(--cream);\n border-radius: 8px;\n padding: 10px 14px;\n font-size: 16px;\n cursor: pointer;\n}\n\nbody:not(.admin) .admin-only,\n.admin-only[hidden] { display: none !important; }\n\nbody.admin .admin-only { display: revert; }\nbody.admin #add-book-btn { display: inline-block; }\nbody.admin .card__admin { display: flex; }\n\n/* ---------- shelf / cards ---------- */\n\n.shelf {\n display: grid;\n grid-template-columns: repeat(auto-fill, minmax(185px, 1fr));\n gap: 20px;\n}\n\n.empty-state {\n grid-column: 1 / -1;\n text-align: center;\n padding: 48px 0;\n opacity: 0.6;\n}\n\n.card {\n position: relative;\n border: 3px solid var(--ink);\n background: #fff;\n border-radius: 4px;\n overflow: hidden;\n display: flex;\n flex-direction: column;\n box-shadow: 4px 4px 0 rgba(28, 28, 28, 0.15);\n}\n\n.card__cover-link { position: relative; display: block; }\n\n.card__cover, .detail__cover {\n width: 100%;\n aspect-ratio: 2 / 3;\n object-fit: contain;\n object-position: center;\n display: block;\n background: var(--cream);\n}\n\n.card__cover--placeholder, .detail__cover--placeholder {\n aspect-ratio: 2 / 3;\n display: flex;\n align-items: center;\n justify-content: center;\n font-size: 48px;\n color: var(--ink);\n background:\n repeating-linear-gradient(45deg, rgba(28,28,28,0.06) 0 8px, transparent 8px 16px),\n var(--cream);\n}\n\n.flag--priority {\n position: absolute;\n top: -6px;\n right: 8px;\n width: 34px;\n height: 44px;\n background: var(--gold);\n color: var(--ink);\n display: flex;\n align-items: flex-start;\n justify-content: center;\n padding-top: 4px;\n font-size: 18px;\n clip-path: polygon(0 0, 100% 0, 100% 100%, 50% 78%, 0 100%);\n z-index: 2;\n}\n\n.stamp {\n position: absolute;\n bottom: 10px;\n left: 10px;\n border: 2px dashed currentColor;\n border-radius: 6px;\n padding: 2px 8px;\n font-size: 12px;\n font-weight: bold;\n text-transform: uppercase;\n transform: rotate(-8deg);\n background: rgba(240, 230, 210, 0.85);\n z-index: 2;\n}\n\n.stamp--reading { color: var(--red); }\n.stamp--backlog { color: #5b6b8c; }\n.stamp--finished { color: #3a7d44; }\n\n.card__body {\n padding: 8px 10px 10px;\n display: flex;\n flex-direction: column;\n gap: 4px;\n flex: 1;\n}\n\n.card__title {\n font-size: 15px;\n text-decoration: none;\n font-weight: bold;\n}\n\n.card__author {\n margin: 0;\n font-size: 12px;\n opacity: 0.75;\n}\n\n.card__admin {\n display: none;\n flex-wrap: wrap;\n gap: 6px;\n padding: 0 10px 10px;\n}\n\n.icon-btn {\n width: 32px;\n height: 32px;\n border: 2px solid var(--ink);\n background: var(--cream);\n border-radius: 4px;\n cursor: pointer;\n font-size: 14px;\n}\n\n.icon-btn:disabled {\n opacity: 0.3;\n cursor: not-allowed;\n}\n\n.icon-btn--danger, .danger {\n color: var(--red);\n border-color: var(--red);\n}\n\n.icon-btn--advance {\n flex: 1 0 100%;\n width: auto;\n height: auto;\n padding: 8px;\n font-size: 12px;\n font-weight: bold;\n white-space: nowrap;\n text-align: center;\n}\n\n/* ---------- wax seal button ---------- */\n\n.wax-seal {\n display: inline-block;\n align-self: flex-start;\n margin-top: 4px;\n padding: 6px 14px;\n border-radius: 999px;\n background: radial-gradient(circle at 30% 30%, #d9483a, var(--red) 70%);\n color: var(--cream);\n text-decoration: none;\n font-size: 13px;\n font-weight: bold;\n box-shadow: inset 0 -3px 4px rgba(0,0,0,0.35), 0 2px 3px rgba(0,0,0,0.3);\n border: 1px solid #7a2015;\n}\n\n.wax-seal--small { font-size: 11px; padding: 4px 10px; }\n\n/* ---------- detail page ---------- */\n\n.back-link {\n display: inline-block;\n margin-bottom: 12px;\n text-decoration: none;\n font-weight: bold;\n}\n\n.detail {\n position: relative;\n background: #fff;\n border: 3px solid var(--ink);\n border-radius: 6px;\n padding: 20px;\n box-shadow: 6px 6px 0 rgba(28, 28, 28, 0.15);\n}\n\n.detail__cover-frame {\n position: relative;\n display: block;\n width: 100%;\n max-width: 240px;\n margin-bottom: 12px;\n}\n\n.detail__cover {\n border: 2px solid var(--ink);\n}\n\n.detail__title { margin: 8px 0 0; font-size: 28px; }\n.detail__author { opacity: 0.75; margin-top: 0; }\n.detail__pitch { font-style: italic; }\n.detail__description { line-height: 1.6; }\n.detail__description p { margin: 0 0 12px; }\n.detail__description p:last-child { margin-bottom: 0; }\n.detail__tags { list-style: none; padding: 0; display: flex; gap: 8px; flex-wrap: wrap; }\n.detail__tags li {\n border: 1px solid var(--ink);\n border-radius: 999px;\n padding: 2px 10px;\n font-size: 12px;\n background: repeating-linear-gradient(-45deg, rgba(28,28,28,0.04) 0 6px, transparent 6px 12px);\n}\n.detail__meta { font-size: 12px; opacity: 0.6; }\n\n.edit-panel {\n margin-top: 16px;\n border: 2px dashed var(--ink);\n border-radius: 6px;\n padding: 16px;\n display: flex;\n flex-direction: column;\n gap: 10px;\n background: rgba(212, 160, 23, 0.08);\n}\n\n/* ---------- forms / dialogs ---------- */\n\nlabel {\n display: flex;\n flex-direction: column;\n gap: 4px;\n font-size: 14px;\n font-weight: bold;\n}\n\ninput, select, textarea, button {\n font-size: 16px;\n font-family: inherit;\n}\n\ninput, select, textarea {\n padding: 10px;\n border: 2px solid var(--ink);\n border-radius: 4px;\n background: #fff;\n color: var(--ink);\n}\n\nbutton {\n cursor: pointer;\n}\n\ndialog {\n border: 3px solid var(--ink);\n border-radius: 8px;\n padding: 20px;\n max-width: 420px;\n width: calc(100% - 32px);\n background: var(--cream);\n}\n\ndialog::backdrop {\n background: rgba(28, 28, 28, 0.5);\n}\n\n.dialog-actions {\n display: flex;\n justify-content: flex-end;\n gap: 8px;\n margin-top: 8px;\n}\n\n.dialog-actions button {\n border: 2px solid var(--ink);\n border-radius: 6px;\n padding: 8px 14px;\n background: var(--cream);\n}\n\n.dialog-actions button[type=\"submit\"] {\n background: var(--red);\n color: var(--cream);\n}\n\n.form-error {\n color: var(--red);\n font-size: 13px;\n font-weight: bold;\n}\n\n#search-results {\n display: flex;\n flex-direction: column;\n gap: 6px;\n max-height: 220px;\n overflow-y: auto;\n}\n\n.search-result {\n display: flex;\n gap: 8px;\n align-items: center;\n border: 1px solid var(--ink);\n border-radius: 4px;\n padding: 6px;\n cursor: pointer;\n background: #fff;\n text-align: left;\n}\n\n.search-result img { width: 32px; height: 48px; object-fit: cover; }\n.search-result[aria-selected=\"true\"] { outline: 3px solid var(--gold); }\n\n/* ---------- detail sheet (progressive enhancement overlay) ---------- */\n\n.detail-sheet {\n position: fixed;\n inset: 0;\n background: var(--cream);\n overflow-y: auto;\n padding: 16px;\n z-index: 50;\n}\n\n.detail-sheet__close {\n position: sticky;\n top: 0;\n border: 2px solid var(--ink);\n background: var(--cream);\n border-radius: 50%;\n width: 40px;\n height: 40px;\n font-size: 18px;\n}\n\n/* ---------- nav / footer ---------- */\n\n.tab-nav {\n position: fixed;\n bottom: 0;\n left: 0;\n right: 0;\n display: flex;\n background: var(--ink);\n border-top: 3px solid var(--gold);\n padding-bottom: env(safe-area-inset-bottom);\n z-index: 10;\n}\n\n.nav__item {\n flex: 1;\n text-align: center;\n padding: 16px 0;\n color: var(--cream);\n text-decoration: none;\n font-size: 14px;\n text-transform: uppercase;\n letter-spacing: 0.05em;\n}\n\n.nav__item--active {\n color: var(--gold);\n border-top: 3px solid var(--gold);\n margin-top: -3px;\n}\n\n.shelves-footer {\n position: fixed;\n bottom: calc(var(--nav-height) + env(safe-area-inset-bottom));\n left: 0;\n right: 0;\n background: repeating-linear-gradient(135deg, var(--red) 0 10px, #a5311f 10px 20px);\n color: var(--cream);\n font-size: 12px;\n padding: 6px 12px;\n display: flex;\n gap: 8px;\n flex-wrap: wrap;\n z-index: 9;\n}\n\n.shelves-footer a { color: var(--cream); }\n\n@media (min-width: 640px) {\n .shelf { grid-template-columns: repeat(auto-fill, minmax(170px, 1fr)); }\n}\n`;\n",[],[161,215],"c79da03c-ee04-41f2-890a-20355191ec4a","manifest.ts","157c5676-adce-11f1-9ec7-1607ee4eb77e",16,["D",1789123605994],"export const manifestJson = JSON.stringify(\n {\n name: \"The People's Reading Club\",\n short_name: \"Reading Club\",\n description:\n \"A shared shelf of what we're reading, backlogged, and finished.\",\n start_url: \"/reading\",\n scope: \"/\",\n display: \"standalone\",\n background_color: \"#F0E6D2\",\n theme_color: \"#C0392B\",\n icons: [\n { src: \"/icon.svg\", sizes: \"any\", type: \"image/svg+xml\", purpose: \"any\" },\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"any\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"any\",\n },\n {\n src: \"/icon-192.png\",\n sizes: \"192x192\",\n type: \"image/png\",\n purpose: \"maskable\",\n },\n {\n src: \"/icon-512.png\",\n sizes: \"512x512\",\n type: \"image/png\",\n purpose: \"maskable\",\n },\n ],\n },\n null,\n 2,\n);\n\n// Hand-authored vector twin of the generated PNGs (see scripts/gen_icons.py).\nexport const iconSvg =\n ``;\n",[],[161,224],"c463e76c-6e75-4246-bdc2-e31dcfe17f61","layout.ts","1557fd1c-adce-11f1-a9cc-1607ee4eb77e",35,["D",1789127191321],"import type { BookStatus } from \"../backend/types.ts\";\nimport { adminBar, escapeHtml } from \"./components.ts\";\nimport { styles } from \"./styles.ts\";\nimport { clientJs } from \"./client.ts\";\n\ninterface GoodreadsProfile {\n name: string;\n url: string;\n}\n\n// GOODREADS_PROFILES env var is a JSON array like:\n// [{\"name\":\"Alex\",\"url\":\"https://www.goodreads.com/user/show/123-alex\"}]\nfunction parseGoodreadsProfiles(): GoodreadsProfile[] {\n const raw = Deno.env.get(\"GOODREADS_PROFILES\");\n if (!raw) return [];\n try {\n const parsed = JSON.parse(raw);\n if (!Array.isArray(parsed)) return [];\n return parsed.filter((p): p is GoodreadsProfile => {\n if (typeof p?.name !== \"string\" || typeof p?.url !== \"string\") {\n return false;\n }\n try {\n const url = new URL(p.url);\n return url.protocol === \"https:\" &&\n url.hostname.endsWith(\"goodreads.com\");\n } catch {\n return false;\n }\n });\n } catch {\n return [];\n }\n}\n\nconst TABS: { key: BookStatus; label: string }[] = [\n { key: \"backlog\", label: \"Backlog\" },\n { key: \"reading\", label: \"Reading\" },\n { key: \"finished\", label: \"Finished\" },\n];\n\n// The static routes serve app.css/client.js with an immutable, 1-year cache\n// header. Tagging their URL with a content hash means every deploy that\n// changes either file gets a brand-new URL, so browsers fetch it immediately\n// instead of serving a stale cached copy until a manual hard refresh.\nfunction contentVersion(input: string): string {\n let hash = 5381;\n for (let i = 0; i < input.length; i++) {\n hash = ((hash << 5) + hash + input.charCodeAt(i)) | 0;\n }\n return (hash >>> 0).toString(36);\n}\n\nconst STYLES_VERSION = contentVersion(styles);\nconst CLIENT_JS_VERSION = contentVersion(clientJs);\n\nexport function renderLayout(\n opts: { title: string; activeTab: BookStatus; bodyHtml: string },\n): string {\n const profiles = parseGoodreadsProfiles();\n const shelvesRow = profiles.length\n ? ``\n : \"\";\n\n const navItems = TABS.map(\n (tab) =>\n `${tab.label}`,\n ).join(\"\");\n\n return `\n\n\n \n \n ${escapeHtml(opts.title)}\n \n \n \n \n \n \n \n \n\n\n

\n ${adminBar(opts.activeTab === \"backlog\")}\n ${opts.bodyHtml}\n

\n \n ${shelvesRow}\n \n\n`;\n}\n",[],[161,232],"5bef727c-5be2-48c7-9b50-718d91b72eb9","components.ts","153b861e-adce-11f1-b099-1607ee4eb77e",29,["D",1789126019688],"import type { Book, BookStatus, Priority } from \"../backend/types.ts\";\n\n// Every DB-sourced string passes through this before hitting HTML.\nexport function escapeHtml(value: string | null | undefined): string {\n if (value == null) return \"\";\n return value\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nconst STATUS_LABEL: Record = {\n reading: \"Reading\",\n backlog: \"Backlog\",\n finished: \"Finished\",\n};\n\nexport function stampBadge(status: BookStatus): string {\n return `${STATUS_LABEL[status]}`;\n}\n\nfunction priorityFlag(priority: Priority): string {\n if (priority !== \"high\") return \"\";\n return `★`;\n}\n\n// Shelf order is Backlog -> Reading -> Finished; Finished has no next step.\nconst NEXT_STATUS: Partial> = {\n backlog: \"reading\",\n reading: \"finished\",\n};\n\nfunction advanceButton(book: Book, cssClass: string): string {\n const next = NEXT_STATUS[book.status];\n if (!next) return \"\";\n const label = `Move to ${STATUS_LABEL[next]}`;\n return ``;\n}\n\n// Google Books descriptions are an HTML fragment. Escape everything, then\n// selectively re-open a small formatting allowlist (bare tags only, no\n// attributes survive) so markup like //
renders instead of showing\n// up as literal text, without letting any other tag or attribute through.\nconst ALLOWED_DESCRIPTION_TAGS = [\n \"b\",\n \"strong\",\n \"i\",\n \"em\",\n \"u\",\n \"p\",\n \"ul\",\n \"ol\",\n \"li\",\n];\n\nfunction sanitizeDescriptionHtml(html: string): string {\n let escaped = escapeHtml(html);\n for (const tag of ALLOWED_DESCRIPTION_TAGS) {\n escaped = escaped\n .replace(new RegExp(`<${tag}>`, \"gi\"), `<${tag}>`)\n .replace(new RegExp(`</${tag}>`, \"gi\"), ``);\n }\n return escaped.replace(/<br\\s*\\/?>/gi, \"
\");\n}\n\nfunction coverImg(\n book: Book,\n width: number,\n height: number,\n cssClass: string,\n): string {\n if (book.coverUrl) {\n return ` $\"Cover$ `;\n }\n const initial = escapeHtml(book.title.trim().charAt(0).toUpperCase() || \"?\");\n return `
${initial}
`;\n}\n\nexport function bookCard(\n book: Book,\n boundary?: { atTop: boolean; atBottom: boolean },\n): string {\n const goodreadsCta = book.goodreadsUrl\n ? `Goodreads`\n : \"\";\n const disabledUp = boundary?.atTop ? \"disabled\" : \"\";\n const disabledDown = boundary?.atBottom ? \"disabled\" : \"\";\n\n return `\n
\n ${priorityFlag(book.priority)}\n \n ${coverImg(book, 220, 330, \"card__cover\")}\n ${stampBadge(book.status)}\n \n
\n ${\n escapeHtml(book.title)\n }\n
${escapeHtml(book.author)}
\n ${goodreadsCta}\n
\n
\n ${advanceButton(book, \"icon-btn icon-btn--advance\")}\n \n \n \n
\n
`;\n}\n\n// Reorder only ever swaps within the same priority group, so up/down at a\n// priority boundary is ambiguous — those buttons render disabled at the ends.\nexport function bookListView(status: BookStatus, books: Book[]): string {\n const cards = books\n .map((book, i) =>\n bookCard(book, {\n atTop: i === 0 || books[i - 1].priority !== book.priority,\n atBottom: i === books.length - 1 ||\n books[i + 1].priority !== book.priority,\n })\n )\n .join(\"\\n\");\n return `\n
\n ${books.length ? cards : `
No books here yet.
`}\n
`;\n}\n\nexport function adminEditPanel(book: Book): string {\n const statusOption = (value: BookStatus, label: string) =>\n ``;\n const priorityOption = (value: Priority, label: string) =>\n ``;\n\n return `\n
\n
Edit
\n Status\n \n \n Priority\n \n \n Tags (comma separated) \n Added by \n Pitch ${\n escapeHtml(book.pitch ?? \"\")\n }\n Goodreads URL \n \n
\n ${advanceButton(book, \"\")}\n \n \n \n
\n
`;\n}\n\nexport function detailPageView(book: Book): string {\n const pitch = book.pitch\n ? `
“${escapeHtml(book.pitch)}”
`\n : \"\";\n const description = book.description\n ? `
${\n sanitizeDescriptionHtml(book.description)\n }
`\n : \"\";\n const goodreadsCta = book.goodreadsUrl\n ? `View on Goodreads`\n : `
No Goodreads link yet.
`;\n const tags = book.tags.length\n ? `
${\n book.tags.map((t) => `
${escapeHtml(t)}
`).join(\"\")\n }
`\n : \"\";\n\n return `\n ← Back to ${\n STATUS_LABEL[book.status]\n }\n
\n ${priorityFlag(book.priority)}\n
\n ${coverImg(book, 300, 450, \"detail__cover\")}\n ${stampBadge(book.status)}\n
\n
${escapeHtml(book.title)}
\n
${escapeHtml(book.author)}
\n ${pitch}\n ${description}\n ${tags}\n ${goodreadsCta}\n
Added by ${\n escapeHtml(book.addedBy) || \"the club\"\n }
\n
\n ${adminEditPanel(book)}`;\n}\n\nexport function adminBar(showAddBook: boolean): string {\n const addBookBtn = showAddBook\n ? ``\n : \"\";\n const addBookDialog = showAddBook\n ? `\n
\n
Add a book
\n Search Google Books \n
\n \n \n Priority\n \n \n Tags (comma separated) \n Added by \n Pitch \n \n
\n \n \n
\n
\n `\n : \"\";\n\n return `\n
\n \n \n ${addBookBtn}\n
\n \n
\n
Admin mode
\n Password \n \n
\n \n \n
\n
\n \n ${addBookDialog}\n
`;\n}\n",[],[161,240],"8bceccfb-0cd3-436f-bd88-ac4079827de4",["D",1789374979802],[],[161,33],"d21c5585-ccdf-4801-8211-36fd00e7acb7","assets.generated.ts","153066e4-adce-11f1-a3cc-1607ee4eb77e",12,["D",1789123605426],"// Generated by scripts/gen_icons.py — base64 binary assets embedded as text (vals can't store binary files).\nexport const ICON_192_PNG_BASE64 =\n \"iVBORw0KGgoAAAANSUhEUgAAAMAAAADACAYAAABS3GwHAAAGlUlEQVR4nO2dPZITSRBGNQr5OOVyAsYmgitwBvw90/qcARsbmxvgtsMJ2GgDVqsdabqlqsov83vPGn5i1F31vcrslqr19PXDu18HAFOO0QcAEAkCgDUIANYgAFiDAGANAoA1CADWIABYgwBgDQKANQgA1iAAWIMAYA0CgBTtr2Xq652mvpoZvSZz+bt1+T3wf57YD5Bv1aoqRjsbx1nnRgVIEvatx1JNitEgQLLQK66imaEFStC7qx1PpWpGBXhlErYweqKu/f69x/v7/yuLMBt7AfaGSCk8Lx3LlvOhTfoX2xZoT/CVQl/xHNuN4xx9XHYCbA1F1tCrnXebcAPhkWO2EWDLRFQLvcpYtIESPHqc5QUg+Bpj0wZI0OPYSgvw2qC7rPhK49Q6iNDzeEoKQPC1x609IEHvRauUAAQ/zzi2OyQYUbHLCBB5K60qbfCYKtymLbEf4NpAroNG+O9nuTF+mT4fVVaAdRJuhR/6sNyQ4F4RVARKKwCrvlc1aINeI6UArPpxLMVaolQC0PLUaIma0DVbGgGUBg0O3Vui8981c05TCEDLo8vyoAS3wn759yPaLHkBCH8tCdrOLZujq4G0AIS/pgTLHaEeJYHsO8E88SAvLdHTKiQrQKYBhH5bNSOQE4Dw12BJIoGUAIS/FksCCWQEIPw1WcQlkBEAwFYAVv/aLMJVIFwAwu/BIipBqACE34tFUILwCnAO9/rrs4i9nxMmQLT5oENkFkIEoPXxZhFqhaYLQPhBSYLwawC1nhC85n6qAPT9oJaRo/sKALFEZ+AYZXb0iYMOM7Y+hgpA6wOqmQlpgVj9QSUTwwVg9Qfl7EyvAKz+oJSNoQKw+oN6hqZWAFZ/eI0yj0Zk9YcMWZpWAVj9QTErQwRg9YfepP5+AFZ/2AtPhwaYQPdng876zM+nHz//8+fPb98MeR2IHf/ReTodEvP925c/Pz+///ji/0GMvkHfM/YZOFW5+D2fkHMQo1/QFVgz1rMKnKpf/CJGzqCfZ2jkwpq6BZopRrZ2KlvQo7AV4Bq3AqLYThF0EQEcdnxFtlPOQV8u2qCe1wFUADExnIMeAQKIXWcQ9IQCOLQ/PXnpHjrBj2mDwh+MBRAJAoA1CADWIABY87AAXABD5ifIUQHAGgQAaxAArEEAsAYBwJqHBOAOEGS/E0QFAGsQAKxBALAGAcAaBABrEACsQQCwBgHAGgQAaxAArEEAsAYBwBoEAGsQAKxBALAGAcAaBABrjmrPaQGYuQuRCgDWIABYgwBgDQKANQgA1jwsAHeCYBYjnkNFBQBrEACsQQCwBgHAmi4CcCEMoxn1IGYqAFiDAGBNNwFog2AUI7+HggoA1iAAWDNUADbIgHqGugrQszcDmJGx0yExz+8//vn5+7cvocfixvPZ2GfmNMLQ87K1/jyiMnx++2bThCDGYzxfGdfL8R/BjG8hTV0BtkwIYugHPZIpAoyqAltAjJxBb5OeMDJEgMs2SJG9YmRrp7IEfSujFtBpLVBkFdjDrYAotlPVgr4yc/EcJkCGKpCpnaoY9K2MXDinXgRnqQKRYjgHfWX2ovn09cO7X9lvZWXj04+fV//NJegqeZl+G7RqFdiDe8ivEdEyD/8wnHvYQTs7IZ8GrXZxDHkzMUUAqgCoZmZaBWDHGCjeKAndEEMrBC24HZ4qAK0QqGXk6L4CgPfcHxUMVxgImMtLcx7RIYRUACTwpomEP7QF4noAFLIQfg1wDq1QfZpYuxsqAK2QF02o9ZGpAEjgQRMMv4QAK0hQmyYafhkBAA7uAlAFatKEV38pAVaQoBZNPPxyAqwgQQ1agvBLCrCCBLlpScI/ZVP8iDdNVAfTnZZwviQrwGsDp/ZuIhxShl9egBUk0KclDX8KAVaQQJeWOPzy1wB7Wp8sA16FVmQuUglQZdXJTis0/ilaoEtoieJohcKftgJUK8MZaEXHOrUAVVclNVrh8S0hQOUVKpJmMKZlBNjyBlmVSRtNMxrHUgI4TmBPmuG4lRTAeULvoRmPU2kBtn5uqPIE36IxNvUF+A2TzVhYC7D3k6TVqoLreb+GnQD3fKQ6aygczvFRbAW4d2+BelCqnc9o7AXosdEmKkTZjlcRBBi446xX0NSOpxIIsIGsWzAJvOAXZWcPkroMhH4fCJD4kS2E/XEQIMEGHYI+DgQYCMHVJ+WWSIBeIABYgwBgDQKANQgA1iAAWIMAYA0CgDUIANYgAFiDAGANAoA1CADWIAAcnPkH7YpXXjkvCdcAAAAASUVORK5CYII=\";\nexport const ICON_512_PNG_BASE64 =\n \"iVBORw0KGgoAAAANSUhEUgAAAgAAAAIACAYAAAD0eNT6AAAUeklEQVR4nO3dP5YkR9XG4dEc+TjlsgJhc462wBrwWRM+a8CWjc0OcNNhBfpOf6Nh/qi7ujIrMiPufZ/HAc5BUquqMu4vI7J6fvjl559+/QAARPk4+wcAAK4nAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAoJXb37bZP0IJP87+AYCai93299uUfy4wxg+//PzTr4P+XsBAXe5ihAKzrhufvfvsAMAkXQb8s/+eFmmYQwDAyVIG/ejXRxgw6rPE6wQADGQBOve1FAXs/Qz5zLxNAMATDPy5r7fFHY7zECA8yLCvQRRkund9+ky8zg4A3GHo1+MpcHiMAICvGPi9ODLI4Lo9RgAQz+KRw+5AJg8Dvk4AEKnb0L/6jLPD6ycGSCcAiFFtaK384NKen63C6y4G6qrw+VqVbwHQ2uqLw8pD/greH678DKVfb9+zA0A7Kw4VC8++12WV99DOwNpW+ZxUJQBoYaWFwLA/5zWc/R6LAbpxBEBps4fCCwN/Du99tqPvv+v1CzsAlDN74beArOH792HG58KuAJXZAaCMWYPfwK/J56W3Z95f1/QndgBY3tULucWhh1k7BJ//OT5H57/GPEcAsCRDn9G+HshXfL4cD7A6RwDEDn53aPjM5a4Rm98JYAeArMHvoufeZ+Lsz6HjAVZiB4D2g9/Q5wifzWtUOc/fGu4YCACmsLhShc/qeq9XBRWCQQDQanGocNFRl8/vGq/T6rYi65AA4BIWTjrxeV7jdVrRVmT4vxAAlF0AKl1o9OUzPu/1WclWcD0SAJS78CteaPTn8379a7OKreiaJAAYzkJIMp//a1+X2baiw/+FAGDpC7zyxQWuid4hsBVfnwQAT7PIgWtk9ppxta348H8hAFjqQu5wUcFbXC/nvRZX2RqtUQKAQyxkcJzr55zX4Wxbo+H/QgAw9aLtdkHBHq6l8a/DWbaGa5UA4GEWKziHa2vtCNgaDv8XH2f/ANRggYIaA2blQVpxyG6L/lwj2AHgLoMfrpV+za0SMFvB124vAcDpF2LChQSjpV9/M0NgK/qa7SUA+J30hQdWknw9zoiAreDrdJRnAPhG8mIDKxp1La2ytc467ADw/wx+WF/SdeoI4Hx2ABhyob0sKBUWFahs1HVmN4AXAiDcqOEPXEcEMMKPQ/4ulGPwQ48IeOZa/vzXivhMdgACGf7QR8fdgNk/z22x1+MsAiDMsx9sZ/2wnhHXZcrQ4wsBEOLl4h4x/IF1jYgAIZBDAARw1w857AbwKAHQnLt+yFT1SGCVHYjbIj/HmQRAY4Y/ZKsaASN2QBxZvs/XABsy+IFRXxes9FXB73/Gl/9dMWKuYgegGcMfSNsNuHfHbzfgbQKgEcMfqBwBR/7+j/47Hfl3vy0cPSM4AmjimQ9qha09YJ0jgRXWjCM/w4jfntiJHYAGDH9gr2eG+OwB+myArBAwKxAAxRn+QEoEjDzP33xT4MMPv/z8069DXk0ud/QCVL/AauvJe//8M9et28R/9kyeASjIXT8w2tGvzJ39NcErhu8W+myAI4BiDH8g5Ujg6jvvremd/lsEQCGGP5AQATPP57egZwMEQBGGP9A1Ar7+a1YZvttXP0fXowEBUIDhD3SPgBXvvLcFf6aRfAtgcbOfzAWwDvVkB2BhLjpgBUdvKLpunXchABZl+AMrEQH9CIAFGf7AikRALwJgMYY/sDIR0IcAWIjhD1QgAnoQAIsw/IFKREB9AmABhj9QkQioTQAU5Xv+wAqsRXUJgMmO/sYsgFUcWZP8joD5BMBEhj/QhQioRwBMYvgD3YiAWgTABIY/0JUIqEMAXMzwB7oTATUIgAsZ/kAKEbA+AXARwx9IIwLWJgAW5at+QAfWsnUJgAv4viuANXM1AuBktv6BdI4C1iQATmT4A3wiAtYjAE5i+AN8SwSsRQAswoMyQAJr3ToEwAJ3/y4IIMneNc+D1OcQAIMZ/gDvEwHzCYCBVCrAeayxYwmAiWz9A8msgXMJgEFs/QPs5yhgHgEwgOEPcJwImEMAPMmZFMD1rL3PEwAXc+YFYG1cgQB4gq1/gHEcBVxLABxk+AOMJwKuIwAAIJAAOMDdP8B57AJcQwDsZPgDnE8EnE8AnMgT/wDW0FUJgB187xRgXdbofQTAg2z9A1zPUcB5BMAJbP0DWFNXJwAeYFsJoA5r9mMEwDts/QPM5yhgPAEwkK1/gPNYY8cSAHfYRgKoyxp+nwB4g61/gPU4ChhHAAxgWwrgOtbcMQTAK2wbAfRhTX+dAHiSEgW4nrX3eQLgO0oRoB9r++8JgCcoUIB5rMHPEQAHC9EHD2C+PWuxXYBvCYDf+GAA9Get/0IAHODuH2Ad1uRjBIAiBIhiF+ATAbCT0gRYj7V5v/gAUIIAeW47HvruKj4A9lCYAOuyRu8THQC+9gfQi68FPi46AAAgVWwAuPsH6MkuwGNiAwAAkkUGgLt/gN7sArwvMgAAIF1cALj7B8hgF+C+uAAAAMICwN0/QBa7AG+LCgAA4BMB8Aq/ThKgD2t6eAD4gx8AMCsCAwAACAsAD/8BZPMwYGgAAABhAeDuH4AXdgHCAgAA+D0B8BtfEwHoz1ofEgC++geAGRIYAABAWAB4+A+A13gY8JMff/tPmvvrf/77zf/+xx//MO1nAdZifcgUHwBJD4T8+1///N9//9Of//Lq/0cYQM6g37M2dFz7b3/bPiRrGQDpb+ojvr7gvyYMIGPQs2+mdLxZbBkAXBcGL+wawDpD/oVBzyOiA6Bj0Z3l3oJi1wDO427+PFv4MUC7AEh+M2exawDPM+jXdmt4DNAuAB7V7Y1ckV0D+JZt+/VswbsAsQHAXB5CpDN381TQKgBSK64TxwlUYtBnuTU7BmgVAI/q9AamcJzALLbt+9tCjwEiA4BeHCcwgrt50rQJgMR64z7HCbzGoOcZt0bHAG0C4FFd3jiOc5zQn2179toCjwHiAgDusWtQi7t5CA+AtGrjenYN5jLoWcmtyTFAiwB4VIc3jPV4CHEM2/bMtoUdA0QFAFzJccLr3M3DGsoHQFKt0UPKcYJBT2e3BscA5QPgUdXfKDJU2zWwbU83W9AxQEwAQGWzdw3czUM/AgCKG/kQokEPOUoHQMo2DVx1nHBvpwHo9RzAxw8BKr9BMJohD/elzIyIAAAAmgSA7X8AZrsVPoouGwAAwHHtAyDlLAeAcbaA2dE+AACA3xMAABCoZABUfugCgF5uRWdSyQB4VMIZDgDn2JrPkNYBAAC8TgAAQKByAVD1rAWAvm4FZ1O5AHhU97MbAM63NZ4lbQMAAHibAACAQAIAAAKVCoCKD1kAkOFWbEaVCoBHdX5oA4BrbU1nSssAAADuEwAAEEgAAEAgAQAAgcoEQLWnKwHIcys0q8oEQPrTmgDMszWcLe0CAAB4nwAAgEACAAACCQAACCQAACCQAACAQB87fa+y49c0AFjD9uCMqfK7AEoEAAAwlgAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAINDyAVDlNyoBQKXZtXwAPMqvAQbArAkMAADgcQIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAIJAAAIBAAgAAAgkAAAgkAAAgkAAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAI1CYAbn/bZv8IADR3azRrlg+A7e+32T8CALSbXcsHAAAwngAAgEACAAACCQAACCQAACCQAACAQAIAAAIJAAAIJAAAINDHTr9RqdOvaARgLbcHZ0yF3wJYJgAAgLEEAAAEEgAAEEgAAEAgAQAAgQQAAARqFwC+CgiA2dIoAKp8rxKAXFuhWVUmAACAcQQAAAQSAAAQSAAAQKCWAeCbAACYKY0CoNLTlQBk2YrNqFIBAACMIQAAIJAAAIBAbQPAg4AAmCWNAqDaQxYA9LcVnE3lAgAAeJ4AAIBArQPAcwAAmCGNAqDiWQsAPW1FZ1LJAAAAniMAACBQ+wDwHAAAZkdgAAAAjQKg6kMXAPSxFZ5FZQMAADguIgA8BwCAmdEoACpvvQBQ21Z8BpUOAADgGAEAAIFiAsBzAACYFY0CoPoZDAD1bA1mT/kAAAD2iwoAxwAAmBGNAqDDVgwANWxNZk6LAAAA9okLAMcAAHwvcTa0CYAuWzIArGtrNGvaBAAA8LjIAEjc6gHgdbfQmdAqADptzQCwlq3ZjGkVAADAY2IDIHXLB4AvkmdBuwDotkUDwHxbw9nSLgD2SC4/gHS38BkQHQAAkKplAHTcqgFgjq3pTPnxQ7iXLaCub+73/vTnv/zvv//7X/+c+rMAa64NKW7h2/8v4gMgxT/++IeHLnhhAH29dd1/vz6QoW0AvNzVP1p4SbsA713wwgDqM+jH3f1vjWdD2wDgmjB4YdcArnfvmnRHz4f0ANizC8B99xYUuwZwHnfz82yN7/7bB8AeiccAo9g1gOcZ9NdwU/iFAOA0dg3gW7btWUn7APAw4Jo8hEhn7ubX5OG/sACgFscJVGLQU1lEANgFqM9xArPYtu/B3X9oANCbXQNGcDdPmpgA8JXAPHYNeI1Bzz1b0LfBYgJgD18J7M9DiL3Ztudrvvr3OgEAX3GcUIu7eTguKgA8DMhRjhPmMug5ysN/b4sKADiD44QxbNvDteICwC4AV3Gc8Dp381zF3f99cQEAs6UcJxj0sLbIALALwKqq7RrYtmdV7v7fFxkAUM3sXQN389DPD7/8/NOvH0IpRDr763/++2YY3Ltz3xsgsBpr+2PsAEBTR44TDHrIEb0D8EIpAvRhTX/cxx3/33h+nSTAuqzR+8QHQNIf/ADAJ5u1XwDspTAB1mNt3i9+B+CFEgTIYc3/RAAcoDQB1mFNPkYA/EYRAvRnrf9CABz8YChOgPl87e84AfAEEQAwjzX4OQLgO7aHAPqxtv+eAHiSAgW4nrX3eQLgFUoRoA9r+usEwABKFOA61twxBMCgYvSBBDjf3rXW3f/bBMAdPjgAdVnD7xMAA9kFADiPNXYsAfAORwEA89n6H08APMA2EkAd1uzHCIAT2KYCsKauTgA8yFEAwPVs/Z9HAOxgWwlgXdbofQTAiRwFAFhDVyUAdnIUAHA+W//nEwAHiACA8xj+1xAAABBIABxkFwBgPHf/1xEATxABAOMY/tcSABfzzQAAa+MKBMCTfO8U4HrW3ucJgAEcBQAcZ+t/DgEwiAgA2M/wn0cATOR5ACCZNXAuATCQMymA81hjxxIAgzkKAHifrf/5BMAJRADA2wz/NQiARTgLAxJY69YhABY6q3JhAJ0dWeOc+59HAJxIBAB8YvivRwCcTAQA6Qz/NQmAC9jCArBmrkYALMrzAEAH1rJ1CYCLOAoA0tj6X5sAuJAIAFIY/usTABcTAUB3hn8NAmACEQB0ZfjXIQAmEQFAN4Z/LQJgIhEAdGH41yMAJhMBQHWGf00CoCjfrQVWYC2qSwAU/k2BLjxgpqNrkN+OugYBsAgRAFRi+NcnABYiAoAKDP8eBMBiRACwMsO/DwGwIBEArMjw70UALEoEACsx/PsRAAsTAcAKDP+efvjl559+nf1DcN7X/XzdBjjK2tObHYACnhniflcAcPXa4cajBgFQhAgArmL4ZxAAhYgA4GyGfw4BUIwIAM5i+GfxEGBhnswFrCccJQCKU+yANYQjHAEU50gAOMoNRDYB0IAIAPYy/HEE0Miz3/n33V3ozzrBZ3YAGnl2gPulQdCb4c/XBEAzIgB4jeHP9xwBNOaCB6wDvMUOQGN2AyCb4c89AqA5EQCZDH/e4wggxIgH/HxLANbnWudRAiCMuwLoy/XNHgIgkDsE6MU1zRGeAQg0Yivf7wyANRj+HGUHIJzFA2py7fIsOwDh7AZAPYY/I9gBYOiWvm8KwHlcp4wkAPiGBQbW47rkDI4AOOUO3kOCMIbhz1nsAPAmCw/M4/rjbAKAy+7kPR8A73PNcRUBwEMsSnAu1xhX8wwAl9+9ez4Azrsm7LTxKDsA7GaxgjFcS8wkAFjiLt5dC0lcP6xAAPAUCxm4XqhJALDkmb4dATpxjbAiAcAwFjlwTVCHAGC4s57ytytABT7/VCEAOI2FkCQ+71QjADjVmd/5tyPACnzGqUoAcImzf/mPGOBKPs90IAC4lIWTynx+6UQAMMUVvw7YrgAj+KzSlQBgKosrq/LZpDsBwBKu+gOC7ArgcwifCACWcuWfFCgG8JkjmQBgSVf/kcFiIIvPFwgACrBY43ME49kBoIyrQ+AzuwM1+bzAfQKAcmYt7J8JgjX5XMA+AoDSZi/6LwTBHN57eI4AoIUVhsFnguAc3mMYSwDQzkqD4jNRsI/3EM4nAGhtxUHytfQw8P7APAKAGKsPm65x4HWHNQkAIlUbSqvFgtcP6hMAxOs2zMjaYYGjfjz8V0LDQSAGejP04QsBAHcGhCCozcCHtwkAuMPuQD2GPjxGAMATg8UOwVyGPRwnAOAJjgyuZeDDOAIABrJLcO5rCYwjAGDSIHN8cP/1Ac4lAGDRwdclEAx4WJMAgOKDc1YoGOxQmwCA4gxi4IiPh/4qAKA0AQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAAQSAAAQSAAAQCABAACBBAAABBIAABBIAABAIAEAAIEEAAAEEgAAEEgAAEAgAQAAgQQAAHzI839tzptiqIfCewAAAABJRU5ErkJggg==\";\nexport const FONT_OTF_BASE64 =\n \"T1RUTwALAIAAAwAwQ0ZGILV5+54AABg4AAA2nkdQT1MuEkLuAAATZAAABNRPUy8yZjoE8wAAASAAAABgY21hcI66KNEAAAdsAAADYGhlYWQMp+l3AAAAvAAAADZoaGVhCFMDzwAAAPQAAAAkaG10eNTlQhYAAArMAAAD/Gtlcm4OmhGMAAAO6AAABHptYXhwAP9QAAAAARgAAAAGbmFtZeuHpIgAAAGAAAAF6nBvc3T/dAAUAAAOyAAAACAAAQAAAAEAALo4OwxfDzz1AAMD6AAAAADUV9KlAAAAANRX0qX/pP8/BT0EDgAAAAMAAgAAAAAAAAABAAADb/84AAAFq/+k/ewFPQABAAAAAAAAAAAAAAAAAAAA/wAAUAAA/wAAAAIC1wEsAAUAAAK8AooAAACPArwCigAAAcUAMgEDCAAEAAAAAAAAAAAAgAACAwAAAAAAAAAAAAAAAE5FT0cAAAAgIDADb/84AAADbwCCAAAABAAAAAADLwMgACAAIAACAAAAIAGGAAEAAAAAAAAARQAAAAEAAAAAAAEAEQBFAAEAAAAAAAIABQBWAAEAAAAAAAMAHwBbAAEAAAAAAAQAEQBFAAEAAAAAAAUAEgB6AAEAAAAAAAYAEACMAAEAAAAAAAcAOACcAAEAAAAAAAgAGQDUAAEAAAAAAAkADADtAAEAAAAAAAoAWwD5AAEAAAAAAAsADwFUAAEAAAAAAAwADwFUAAEAAAAAAA0AWwD5AAEAAAAAABAACwFjAAEAAAAAABEABQBWAAMAAQQJAAAAigFuAAMAAQQJAAEAIgH4AAMAAQQJAAIACgIaAAMAAQQJAAMAPgIkAAMAAQQJAAQAIgH4AAMAAQQJAAUAJAJiAAMAAQQJAAYAIAKGAAMAAQQJAAcAcAKmAAMAAQQJAAgAMgMWAAMAAQQJAAkAGANIAAMAAQQJAAoAtgNgAAMAAQQJAAsAHgQWAAMAAQQJAAwAHgQWAAMAAQQJAA0AtgNgAAMAAQQJABAAFgQ0AAMAAQQJABMAGgRKQ29weXJpZ2h0IChjKSAyMDA4IGJ5IEl2YW4gRmlsaXBvdiwgTmVvZ3JleSBMdGQuIEFsbCByaWdodHMgcmVzZXJ2ZWQuUmVkIE9jdG9iZXIgTGlnaHRMaWdodEl2YW5QaGlsaXBvdjogUmVkIE9jdG9iZXI6IDIwMDhWZXJzaW9uIDEuMDA0IDIwMTNSZWRPY3RvYmVyLUxpZ2h0UmVkIE9jdG9iZXIgaXMgYSB0cmFkZW1hcmsgb2YgSXZhbiBGaWxpcG92LCBOZW9ncmV5IEx0ZC5JdmFuIEZpbGlwb3YsIE5lb2dyZXkgTHRkSXZhbiBGaWxpcG92RnJlZSBmb3IgcGVyc29uYWwgcHJvamVjdHMuIEZvciBjb21tZXJjaWFsIHByb2plY3RzLCBwbGVhc2UgY29udGFjdCBtZSBhdCBpdmFuQG5lb2dyZXkuY29tLnd3dy5uZW9ncmV5LmNvbVJlZCBPY3RvYmVyAEMAbwBwAHkAcgBpAGcAaAB0ACAAKABjACkAIAAyADAAMAA4ACAAYgB5ACAASQB2AGEAbgAgAEYAaQBsAGkAcABvAHYALAAgAE4AZQBvAGcAcgBlAHkAIABMAHQAZAAuACAAQQBsAGwAIAByAGkAZwBoAHQAcwAgAHIAZQBzAGUAcgB2AGUAZAAuAFIAZQBkACAATwBjAHQAbwBiAGUAcgAgAEwAaQBnAGgAdABMAGkAZwBoAHQASQB2AGEAbgBQAGgAaQBsAGkAcABvAHYAOgAgAFIAZQBkACAATwBjAHQAbwBiAGUAcgA6ACAAMgAwADAAOABWAGUAcgBzAGkAbwBuACAAMQAuADAAMAA0ACAAMgAwADEAMwBSAGUAZABPAGMAdABvAGIAZQByAC0ATABpAGcAaAB0AFIAZQBkACAATwBjAHQAbwBiAGUAcgAgAGkAcwAgAGEAIAB0AHIAYQBkAGUAbQBhAHIAawAgAG8AZgAgAEkAdgBhAG4AIABGAGkAbABpAHAAbwB2ACwAIABOAGUAbwBnAHIAZQB5ACAATAB0AGQALgBJAHYAYQBuACAARgBpAGwAaQBwAG8AdgAsACAATgBlAG8AZwByAGUAeQAgAEwAdABkAEkAdgBhAG4AIABGAGkAbABpAHAAbwB2AEYAcgBlAGUAIABmAG8AcgAgAHAAZQByAHMAbwBuAGEAbAAgAHAAcgBvAGoAZQBjAHQAcwAuACAARgBvAHIAIABjAG8AbQBtAGUAcgBjAGkAYQBsACAAcAByAG8AagBlAGMAdABzACwAIABwAGwAZQBhAHMAZQAgAGMAbwBuAHQAYQBjAHQAIABtAGUAIABhAHQAIABpAHYAYQBuAEAAbgBlAG8AZwByAGUAeQAuAGMAbwBtAC4AdwB3AHcALgBuAGUAbwBnAHIAZQB5AC4AYwBvAG0AUgBlAGQAIABPAGMAdABvAGIAZQByAFIAZQBkACAATwBjAHQAbwBiAGUAcgAgAEAAAAAAAAMAAAADAAABIgABAAAAAAAcAAMAAQAAASIAAAEGAAAAAAAAAAAAAAADAAAAAwAAAAAAAAAAAAAAAAAAAAAAAANpaAQFBgdfCAkKCwwNDg8Q7RESExQVFhcYGRobHB0eHyAhIiMkJSYnKCkqKywtLi8wMTIzNDU2Nzg5Ojs8PT5lP0BBQkNERUZHSElKS0xNTk9QUVJTVFVWV1hZWltcAH8AAIMAgIGM4vfoAAAAhOEAhQDfAOkAjYj+6wCJ7PrqAAAAXV5iYQBmZwB6fACGAAAAAAAAAAAAAAAAAAAA5wAAAAAAAAAAAABjduAAAIf83d4A2wAAAACO8AAAAAAAAGAAANxk9vXkfuN7+33lgvkA5o/4AAD0AAAAAAAAAADyAAQCPgAAAG4AQAAFAC4AIgAmACcAMAAxAF8AYAB+AKAAowCpAK4AtAC2AMIAxADGAM8A1ADWAN4A4gDkAOYA6QDsAO8A9AD2AP0A/wFTAWEBeAF+AscEAQQDBAkEDAQhBCIEQQRCBE8EUQRWBFkEXCAUIB4gIiAmIDD//wAAACAAIwAnACgAMQAyAGAAYQCgAKMApwCuALQAtgDAAMQAxgDIANIA1gDaAOAA5ADmAOgA6wDvAPIA9gD5AP8BUgFgAXgBfQLGBAEEAwQFBAwEEAQiBCMEQgRDBFEEUwRYBFwgEyAdICEgJiAw//8AAP/hADj/4AC8/98ABf/e/9b/ugAA/7j/xv+rAAD/u//AAAAAAP+qAAAAAAAEAAEAAAAA//oAAP/1AAD/jwAAAAD/eP9xAAD8afzQAAD8yfyA/Fb8gPw3/ID8gQAAAAD8euDK4L4AAOA94DQAAQBuAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAXgAAAAAAXgBsAAAAbgB2AAAAAAB2AHgAAAB4AAAAegAAAIAAggAAAAAAgAAAAAAAfgAAAAAAAAAAAAAAAAAAAHgAfgAAAAAAAAB6AAAAAAAAAAMAaQBoAF4AfABnAOAA5AD2AOMAgwD1AH4A5QB7APsAfQDmAIIA+QCPAPgAgQCLAP0A4gCMAPcA4QCEAIUA3wCIAI0A/gDsAIkA+gDqAIoAhwD8APMA8QD0APIAawDZAG0AbgDQANQA0QBvAHAAcQDXAGAAYgH0AD8AAAAAAfoAAAF3AAAB/gAPArEAWALdACgDIwBtAQ8ACgEPAAABsP/8AaQABQE4AFABzgBzAVEAWgJNAAADLgBiAwoAYwMKAEEDKQBDA1IAagM5AGMC1gBKAuAAXAMxAGYBRgBQASkAVwGI//sCUgBaAYgACgMUAEgDMQAAAuwAMAMKAEYDGABQAzEAJgLHAFgCtQA8AzUATwL+AEYBJQBKAl0AVAL+AD8CxwBHA7UATQMJADwDTABPAxQATwNhAF4DPABPAxgATwLLACwDKgBTAugAUQPlAGEC7ABQAwIARgMYAE8BKQBQAZ7/2AElAEYBmf/2AfQAAAMqAFgDEQBGAvMAUANdADMDPABRAzkAewMbAE8DRwB6AWAAbAJHAFQDSwBpAvMAfASdAHcDTwB6A0wATwLgAD4DYQBeAzMATwMYAE8CqAAsA08AbQL+AG8ErgB7AzkATwONAIQDRwBlAX0AMgCgACgBhABuAZH/+wLHAGYBzAAuAMYAIwLcAAAB0QAZAXwAKAEKAAAC3QAoAOf/7AL8ACoDZgALAYUAIwFZAGIC4QA8AtEAAAEsABoEyAAAAjYABALRAAABDwAAAjYABAAAAAAB9AAAAzMAAAH0AAAB+gAABY4AAAKmAC8EBABNA0EBNQEuAAUAAACIAS7/pALhADwC7AAwAwcATwMqAFMDUgBPAv4AUAM8AFEDPABRBPgAXAU2AFkDTABPA2EAewOGAIQDAgBGAx8AWANMAE8DjQCEAyoAUwMjAE0DOQBuAx8AVQKFAFEDeQBLAuEAPAQBAA0C6ABQAxgAZAMqAGQDJgBRAvoAOwO1AE0C/gBGA0sATwMlAFoDFABPAxgAUAK9AC8DMwBnA9gADgLXABsDRgARAy4AWQQKAEwELgALA6wADwQyAHEDOQBZAzwARgScAFsDCQBFAtwAOQLVAG4DNABwAp0AUQOyAG0DMwBRBJwAXALoAFAC+gA8A1oAewMsAEoDEABGA9MATQL+AFEDQABPAyUAWgLZAD0DEABQAr0ADgMXAGEEYQBoAzkATwN5AGUDJQBZBB8AaASGAHkEAgAWBC4AcQMxAF4DOQBGBJwAWwMYAFcC3AA7A0EAAAK2AGkCZwAAAmcAAAL+AD8DSwBpBMcAAANBAAADQQAAAv4AWAHnAAAB5wAAA2wASgRPAF4BD/+nAs8AMALXAFEC3ABYAr0APAL6AEEBJf+vAwcATwTwAFwC3ABYAQ//4ANoAHsDAwDQA2gAewHRAFEDGABPA0cAZQMCAEYDGABPAAAAfQMYAE8AAAB9AscAWALsADADKgBYAyoAUwNMAE8DYQB7ASUAFwWrAHcC8wBeA0wATwADAAAAAAAA/3EAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAABHYAAQC8AwAABwFoAA4AE/+lAA4AGP+tABAADgA+ABAAJAA+ABAAJQA+ABAAJgA+ABAAJwA+ABAALQA+ABAALgA+ABAALwA+ABAAMQA+ABAAQAA+ABAAQQA+ABAAQwA+ABAARAA+ABAARQA+ABAARgA+ABAATAA+ABAATgA+ABAAUAA+ABIAGAAkABUAM/8xABUAUv8xABgAEP/gABgAEf/gAB8AE/+QAB8AGP+tAB8AdP+sACAAE/+lACAAGP+tACAAM//sACEAE/+lACEAGP+tACIAE/9lACIAGP+sACMAE/9mACMAGP+sACMAH/+3ACMAdP+cACQAE/9lACQAGP+sACQAMwAMACUAE/9lACUAGP+sACUAH/+vACUAKf+RACUAP//jACUAQv+hACUAdP9sACYAE/+lACYAGP+tACcAE/+lACcAGP+tACgAE/+lACgAGP+tACoAE/+NACoAGP+uACsAEf/BACsAE/5jACsAGP5rACsAKAAYACsAM/9KACsAOP/XACsAUv8yACwAE/+lACwAGP+tAC0AE/+lAC0AGP+tAC4AE/+lAC4AGP+tAC8AE/+lAC8AGP+tAC8AIP/kAC8AP//kAC8AdP+mADEAE/+YADEAGP+uADIAE/+lADIAGP+tADMAE/9lADMAGP+sADMAH/+vADMAIP/jADMAP//jADMAQv84ADMAdP9sADQAE/+lADQAGP+tADUAE/9HADUAGP+sADUAH/+SADUAIP/jADUAKAAYADUAP//jADUAQv+7ADUAdP93ADYAE/+lADYAGP+tADkAE/+DADkAGP+sAD8AE/+lAD8AGP+tAD8ASP/yAEAAE/+lAEAAGP+tAEEAE/9lAEEAGP+sAEIAE/+lAEIAGP+tAEMAE/9lAEMAGP+sAEQAE/9lAEQAGP+sAEQAH/+vAEQAQv+hAEQASP+tAEQAdP9sAEUAE/+lAEUAGP+tAEYAE/+lAEYAGP+tAEcAE/+lAEcAGP+tAEkAE/+lAEkAGP+tAEoAEf/BAEoAE/5jAEoAGP5rAEoAUv8+AEsAE/+lAEsAGP+tAEwAE/+lAEwAGP+tAE0AE/+lAE0AGP+tAFAAE/+mAFAAGP+uAFAAUgAoAFEAE/+lAFEAGP+tAFIAE/9lAFIAGP+sAFIAH/+vAFIAQv84AFIAU//xAFIAdP9sAFMAE/+lAFMAGP+tAFMAUgAIAFUAE/+lAFUAGP+tAFcAUv/YAFgAE/+DAFgAGP+sAFgAP//XAGAAE/+lAGAAGP+tAGMAE/+lAGMAGP+tAGkAE/+fAGkAGP+sAGoAE/9lAGoAGP+sAGsAE/+lAGsAGP+tAGwAE/+lAGwAGP+tAG8AE/+lAG8AGP+tAHAAE/+lAHAAGP+tAHQAEf/BAHQAE/9nAHQAGP9vAHQAM/+uAHQAUv+uAHgAoAAbAJAAl//WAJEAo//yAJMAkP+7AJQAnf/WAJcAkQAqAJoAkP/XAKAAkP/IALMAvv+7ALUAwAASALoAsP/jALoAu//wAAAAAQAAAAoAHgAsAAFsYXRuAAgABAAAAAD//wABAAAAAWtlcm4ACAAAAAEAAAABAAQAAgAAAAEACAABBA4ABAAAAEUAlACeAOgA7gD4AQIBEAEeASgBMgFEAVIBcAF6AYQBjgGYAbYBwAHKAdQB6gH0Af4CHAImAkgCUgJcAmoCdAJ+AogCkgKsArYCwALKAtQC5gLwAvoDBAMSAxwDNgNEA04DVANiA2wDdgOAA4oDlAOeA6gDsgPIA84D1APaA+AD5gPsA/ID+AP+BAQAAgAT/6UAGP+tABIADgA+ACQAPgAlAD4AJgA+ACcAPgAtAD4ALgA+AC8APgAxAD4AQAA+AEEAPgBDAD4ARAA+AEUAPgBGAD4ATAA+AE4APgBQAD4AAQAYACQAAgAz/zEAUv8xAAIAEP/gABH/4AADABP/kAAY/60AdP+sAAMAE/+lABj/rQAz/+wAAgAT/6UAGP+tAAIAE/9lABj/rAAEABP/ZgAY/6wAH/+3AHT/nAADABP/ZQAY/6wAMwAMAAcAE/9lABj/rAAf/68AKf+RAD//4wBC/6EAdP9sAAIAE/+lABj/rQACABP/pQAY/60AAgAT/6UAGP+tAAIAE/+NABj/rgAHABH/wQAT/mMAGP5rACgAGAAz/0oAOP/XAFL/MgACABP/pQAY/60AAgAT/6UAGP+tAAIAE/+lABj/rQAFABP/pQAY/60AIP/kAD//5AB0/6YAAgAT/5gAGP+uAAIAE/+lABj/rQAHABP/ZQAY/6wAH/+vACD/4wA//+MAQv84AHT/bAACABP/pQAY/60ACAAT/0cAGP+sAB//kgAg/+MAKAAYAD//4wBC/7sAdP93AAIAE/+lABj/rQACABP/gwAY/6wAAwAT/6UAGP+tAEj/8gACABP/pQAY/60AAgAT/2UAGP+sAAIAE/+lABj/rQACABP/ZQAY/6wABgAT/2UAGP+sAB//rwBC/6EASP+tAHT/bAACABP/pQAY/60AAgAT/6UAGP+tAAIAE/+lABj/rQACABP/pQAY/60ABAAR/8EAE/5jABj+awBS/z4AAgAT/6UAGP+tAAIAE/+lABj/rQACABP/pQAY/60AAwAT/6YAGP+uAFIAKAACABP/pQAY/60ABgAT/2UAGP+sAB//rwBC/zgAU//xAHT/bAADABP/pQAY/60AUgAIAAIAE/+lABj/rQABAFL/2AADABP/gwAY/6wAP//XAAIAE/+lABj/rQACABP/pQAY/60AAgAT/58AGP+sAAIAE/9lABj/rAACABP/pQAY/60AAgAT/6UAGP+tAAIAE/+lABj/rQACABP/pQAY/60ABQAR/8EAE/9nABj/bwAz/64AUv+uAAEAoAAbAAEAl//WAAEAo//yAAEAkP+7AAEAnf/WAAEAkQAqAAEAkP/XAAEAkP/IAAEAvv+7AAEAwAASAAIAsP/jALv/8AABAEUADgAQABIAFQAYAB8AIAAhACIAIwAkACUAJgAnACgAKgArACwALQAuAC8AMQAyADMANAA1ADYAOQA/AEAAQQBCAEMARABFAEYARwBJAEoASwBMAE0AUABRAFIAUwBVAFcAWABgAGMAaQBqAGsAbABvAHAAdAB4AJAAkQCTAJQAlwCaAKAAswC1ALoBAAQCAAEBARFSZWRPY3RvYmVyLUxpZ2h0AAEBATH4EAD4eAH4eQwA+HoC+HoD+BYE+y0MA58MBC/7VRwFPfqiBRwEwg8cBaoRoRwqwRIAYAIAAQAGAAgADgAUABoAIAAmACwAMgA4ADoAPgBCAEYATQBQAFYAXABlAG4AdwCAAIkAkgCbAKQArQC2AL8AyADRANoA4wDsAPUA/gEHARABGQEiASsBNAE9AUYBTwFYAWEBagFzAXwBhQGOAZcBoAGpAbIBuwHEAc0B1gHfAegB8QH6AgMCDAIVAh4CJwIwAjkCQgJLAlQCXQJmAm8CeAKBAooCkwKcAqUCrgK3AsACyQLSAtsC5ALtAvQC/QNCA50Dri5udWxsQ1JfMDQwMWhfMDQwNWhfMDQwNmhfMDQwN2hfMDQwOGhfMDQ1NWhfMDQ1NmhfMDQ1OGhfMV8yNjFfMjYyXzMzNG5ic3BhY2VTX1RfMDQyMmhfMDQ0MmhhZmlpMTAwMTdhZmlpMTAwMThhZmlpMTAwMTlhZmlpMTAwMjBhZmlpMTAwMjFhZmlpMTAwMjJhZmlpMTAwMjRhZmlpMTAwMjVhZmlpMTAwMjZhZmlpMTAwMjdhZmlpMTAwMjhhZmlpMTAwMjlhZmlpMTAwMzBhZmlpMTAwMzFhZmlpMTAwMzJhZmlpMTAwMzNhZmlpMTAwMzRhZmlpMTAwMzVhZmlpMTAwMzZhZmlpMTAwMzdhZmlpMTAwMzhhZmlpMTAwMzlhZmlpMTAwNDBhZmlpMTAwNDFhZmlpMTAwNDJhZmlpMTAwNDNhZmlpMTAwNDRhZmlpMTAwNDVhZmlpMTAwNDZhZmlpMTAwNDdhZmlpMTAwNDhhZmlpMTAwNDlhZmlpMTAwNjVhZmlpMTAwNjZhZmlpMTAwNjdhZmlpMTAwNjhhZmlpMTAwNjlhZmlpMTAwNzBhZmlpMTAwNzJhZmlpMTAwNzNhZmlpMTAwNzRhZmlpMTAwNzVhZmlpMTAwNzZhZmlpMTAwNzdhZmlpMTAwNzhhZmlpMTAwNzlhZmlpMTAwODBhZmlpMTAwODFhZmlpMTAwODJhZmlpMTAwODNhZmlpMTAwODRhZmlpMTAwODVhZmlpMTAwODZhZmlpMTAwODdhZmlpMTAwODhhZmlpMTAwODlhZmlpMTAwOTBhZmlpMTAwOTFhZmlpMTAwOTJhZmlpMTAwOTNhZmlpMTAwOTRhZmlpMTAwOTVhZmlpMTAwOTZhZmlpMTAwOTdhZmlpMTAwNThhZmlpMTAxMDFhZmlpMTAwNzFhZmlpMTAwNTJhZmlpMTAxMDBhZmlpMTAwNjFhZmlpMTAxMDlhZmlpMTAxMDZhZmlpMTAwNTZ1bmkwNDA2YWZpaTEwMDIzQ29weXJpZ2h0IChjKSAyMDE2IGJ5IEl2YW4gRmlsaXBvdiwgTmVvZ3JleSBMdGQuIEFsbCByaWdodHMgcmVzZXJ2ZWQuRnJlZSBmb3IgcGVyc29uYWwgcHJvamVjdHMuIEZvciBjb21tZXJjaWFsIHByb2plY3RzLCBwbGVhc2UgY29udGFjdCBtZSBhdCBpdmFuQG5lb2dyZXkuY29tLlJlZCBPY3RvYmVyIExpZ2h0AAABAYcBAAEAAAQDAAkIABMtAEIdAGIAAGYAAGgAAHEAAHMBAHkBAHwAAKUAAKoAAAMAAAIAAYkPAH0AALYAAIMAALgAALQAAK0AAL0AAMMAALsAALIAAM8AANEAAIoAAI4AANsAAN4AAOIAAMUAAMgAANgAAOMAAMEAAZlKAHcAAHYAAG8AAIkAANYAAK4AANIAAMsAALUAAKsAALkAAL4AAJAAAMoAANUAAOAAANoAAOEAABIAAMcAAOQAAMYAAN0AAIgAAMAAAH4AALMAAKwAAMkAAMIAALwAAN8AALcAAJQAAJ0AANkAAP8CAAEAJAAlACgAKwCKAOAA8wE7AYABxQH1Ah4CMQJHAl0CdwKcAtMDIwNRA40DzgPyBFIEgwSdBMME5wT7BR4FYwa8Br8GwgbFBvIG9QcVBxgHGgcdByEHLQdQB1QHfAd/B4EHgweGB4kHjAePB8MH9QhOCF4IYQiFCJsIvAjgCPEI9Aj3CPoJKgk0CVgJWwmGCawJsAm9CdkKGwpICksKWQpbCl4KYQpkCnQKoArgCu0K/QsACzkLTguEC6YL4wwfDCoMYQyKDMgM+Q0WDSQVNhW9FdIV/BYOFhAWJBYnFikWKxZJFksWTBZPFoAWgxaGFrIWwhbyFvwXEBcgFzcXRBdeF3kXkxenF8QX4xf3GGkYrBjTGOMY/xkXGSsZUBlsGYIZjhm9GccZ0RokGi4akRqTGqMaxRrRGt8a4xrlGuka+hr8Gy8bOhtEG08boxuyG8Ib1hviHBccGxwoHDccORxEHFAckRycHKoc8R0AHW4dcB2bHbwdyR30HfgeBR4JHioeOB47HkweVh5hHnYelR62Htse6B8JHw0fJx9GH0gfUx+UH5YfqB+qH6wfwx/eICUgJyApIDYgQCBKIFkgaSCLIKcgwSDdIPkhECEnIUQhbCGIIaohwiHTIekiDiIWIh4iPyJHIlIiWiJlIm0idSJ9IoUijSKYIp8i2SMNIxX7sYvK+TfJAcrJ947KA/hKFvm0/AuGCsn5dhX3jv03+44GDg77qw78Lg77p6B293Hn4uf3ZHcB+Ab3cRXv5zQGl+IF7+czBqn3ZAU0Bm37ZAU3Bqj3ZAU0Bm77ZAUgL+oGfzQF+wIv7AZs+3EF4gaq93EF3wZs+3EF4gb7E/fNFZfiBd8GfzQFDiv7AfdpI/P3jvcQ91v3DvsO93oS4/cU4eDj9xATt+P39hX4F/uO/BcGE3cj92oHE7f7AeAHE3f3Afdo+HL8E/db+BP3DvtoBxOv9wA2BxO3+wD7agcOhAoTAAAT38Cz+VA/ChPvwGcKDp2L9wz3c/cO92iJCvcB9xX3v94K9wH4lxX3FvsB+xb7AAX7vvi/9/Lc9wc61/sTP/u/92j39PcO/HUH9xX8XBX3v/tz+78GDtAKlfceA/ejlRU5xGLq9xga9xi06t3EHvcdB156YG5kY2RkbGB2XAhuTH1GQRpBmUaoTB6gXKlhsmSzYrZuuHoI9x0HDtAK9w/3HgP41gTdUrQs+xga+xhiLDlSHvsdB7ictqiztLKyqbWgugioypnQ1RrVfdBuyh52umy2ZLJks2CoXpwI+x0HDvv1+DR2+CN3AfcV+LgVWPst9xTq9xgsWPct9xTpBfsyBlj3LFv7LAX7Ngb3GS0FDvwB9z529zTl9zR3Afc55QP3OffJFfs05fc09zTl+zT3NDH7NPs0MQcO/G37AbAKA/dnWBX3VfsX+6QHDvvX1gr3B/dvA/cH94QV92/3FvtvBg78VI33PwGL9z8D93uNFfcX+yH7FwcO+1h0dvmwdwH4Ivm2Ffwi/Yz3CWH4IvmMBQ6oi/cb+LOJCu33FPf/ZAr5YRb5tPz/hgr3FPcbFfiz9//8swcOhIr3Gvio9xoB7vcb98zOCu74thX3G/cL98z7Agb8U/t/BfvV+Nr3GvxT7gf4U/eFBffa/NoHDoSL9xr7Gvdj9x33FPci90/7D/cPEsz3Evev9xUTtvlA+bUV/Pn7T/cMBhOuy4EK+9H7FPfABudFBfsg+/8HE3bU+xL7Y/j+988HMNrm8gUOo6B294v3HPg1dwH42c4K+NldCvw1++UH2vg1BfsbBvsN/L0F+Jb7i/cb+bQGDsynCvsU92T3JvcS91P3FRL19xX3//cVE7z5a/h0FfyA91P4gPcV/QH8UviA+3b7/wYTfNv7Fftk+QEHDrOK9xv3Z/cU9yT3S/sU9xQS7vcV9//3FRPc+WT4bRX8gPdh9/4GE+xU9xX3Rf0A/bX5AQf7FfcbFfv/92f3/wYOUKN2+VL3FgHVXQr7YPcQ3ffXB/u6/ToF9ykG97D5OwX3DQcOWo33Dfdz9vd19wwB5/cW97Z9CviU+LcVLy0FIQYv6QX3F/e2B/cV/TgV96wHYa9awWWq9xX3Chj3qfy5+6gHtGi5Va9t+w/7Dhj7qwf4OPcNFfu29xUG5+kF9QbnLQUOq6J297C+Cpf3G/f/zgrx9+sV+Hz7ZPv+w/sR+1P4+Pm0/PkG9xH7DxX3//tl+/8GDvxfjfc/95v3PwHbfQr3ZfhI0Qr3FfxG0QoO/HyOdvha9z8Bi/c/A/du+FwV9yv7F/srB/cX/AsV9wX7F/tUBw78Hfc+dvg4dwH4EvhwFegH/Bf7QQVBB/gX+0EF6Af7nPcDBQ77U/d45dPlAeX4ptMK/C77aNMKDvwd9zh2+Dh3AZX3gBUuB/gX90EF1Qf8F/dBBS4H95z7CQUOjov3BvhR94SdCtP3EcD3FPdJ9xUT3PeOFvcU9wZRCvcU6RXrB/fK9yoF9+38/PuE9xEHE7z3Cvf++yIH+8n7JAX7SwcOq6B2+ch3AfdE+MoVzmQFfQZum3BvtXenmAWfBqVcVqFYbmOecqQFqgf3By8Vipd7l3J9BffCIxWZvKWCmal9maWHBaEHdaFfc2r7BgXLpRWTnHmSgWwF/ET7DxWil7V2BZoGsqelcJ+fd71akjSsXncFt2sVoZa2cmCUBXsGatYVppa0f5qalq5tlgV5egdkmHFjBbD3OhV4eKZwkZwF+Q/DFZEHNfdaR7YFmFdZklsbXFGEfkUfWYFhZmpKU/s2GJiUwvcoqsSzrbqUGZjJwZG4G7u+hH3AH5x/nn6gfZhuoFupSWl/GDarI1yYYoNxZZyBqHWDe0uhWqyTqnyYt9axrEppIC9bh59feYBc+x9CZrBvfoBiBWuPZ52IqneffkBJZ3t89wVavaSwf6xOBeUGsfF/p5q1yKWbu5x6Rft5BcAGl6+tfX11BfMG0Pdixseh4JL3SAUORAoOhDcKki4Kq4p2CgHufQqxXQr7Fdz9NPhhB8P3bMP3Z8P3bQj3MQf7oP00Fft8+LP4CgYOWgoOL6F29+v3FAGfZAr3UBb37fgP9xT8D/dh+Fv3DvzbqQqvSgpQCooKDvtIdQp4pgoBypAK+UU0Cg5Bjgr5NHcB0vcU98VkCviM948V+w/7xfk0+xT9tfjF95AHDvc4MQqDgwrH9xT4F2QKx9UK9xT4ugf4F/tkBfvqfAr7FPu+B/wX92QF5QcOYAoOSwo5CrY+CioKDkVpCmgKDmKLggrc9x333vcfA/ihFvc2+JcF97H7H/uyB/sN/BUFMgb7DPgVBfey+x37sQf3M/yXBQ73aIMK7PcV+LH3FgP6FV0K+xb9Hwb7oveo+6P7qAX5H1cK9ycH95H3gveP+4IF9ykGDmagdvfX9y7313cB2/cW99zeCvktFvetB2OyUMRnrvcb9wMY96n7E/t9BzMxBfssBjPlBfd9+xb7qAeyasNarm77FvsXGPuu9xb3fgfj5AX3LAbjMgX7fgcOnwoB3Qr3FfcU9wN9CkwKDk8KDvx8k3b52XcS0fIk9yYT0Nt+Ffcm3QYT4GD5NQYT0Lbd+yYGDvwHknb5sHcB9/p9Fc+v/CL5jEdnBQ78gIl2+dl3AWL3YPs19zUD92z5zBX7Jjm2/TVgOfcmBg78DPg7dvgidwH34fjPFeEG+0T3eQU+BvtE+3kF4Qb3FPcRBQ77sfsOvQH4iEMV/IhZ+IgGDkAKDos3Cm0uCteK9xv4tIkK9yf3GAP5oYoV9xsH+0b5LgX8vPsO6gaO/TsF+If3GxX8Bfi0924GDrwKAdz3HAMrCg6zoHb31fcc92T3GwG1CgP3lhb31fgi9xz8Ivdk+JH3G/0YqQqVSgrBn3b4LPcb95Z3AZf3HPgVzgr3lviyFfeW+xz9tPcc+Cv4Ffwr9xv4sgcO/EWgdvks9xwB9wD3HAP3AF0K+xz3HPccB/sc+4YV/ML3HPjCBw77XnUKxZgKEvTJChPs+PRfCm2L9xv5LXcB9xr3HAP3EBb44vcb/Fr5LfscBg74IKB2+Rz3FQH3C/cV97T3G/ewfQr3jBb5OvdlB9ouBfzd9xv43QfV6AX3Zv069xX5tPwUBi/7Dij3DgX8Gv20Bg7Jgwr3Dvcc9/7OCvcO1Qr3HPhlB/f++2wF+433G/m0+xv8EQf7/vdrBfc6Bw5gCg5aoHb3ir4Kyc4K+Vx6CjkKrT4KKgoOImkKyfcB9xv4BfccA/j59C8KDninCvk0dwH3A/cU9+R9CvlU+J8V96n7Ffu0B/se/BQF+1r5NPsU/bT4LAYO+DGL9yz5HHcBtQr3tPcb97D3GgP3D9UK+B8H7/cO5/sNBfgZ+bP7Gv0c+2YGQdoF+Fv7G/xaBzw7Bftl+RwGDrOgdvfp9xH38XcBQgr3EKAKAfcY9x34Fs4KRQoOTgoO/CgvdvnZdxL3FPcM+wz3NxPg9xT4QRU9SNlIBfwYBxPQ9zfdBhPgYPfPBk3FycUF970Htt37NwYO/QWgdvlQdwGz2wP3DBb5UDv9UAcO/CFDdvoQdxL3Avc3+wz3DBPg96W3Cvs3Obb7vQYT0MlRTVEF+89gOQcT4Pc3+BgG2c49zgUO/BT3wnb3W3cB97H4EhX7U+0o+xzPZ7/S91Qp7vcbRa4FDkGL9xH3oLz3oPcRAfcJ9xEU4PdP+E4VSlrM+6A2+xH4uPcR++b3oPchvPsh9zwGw88F4PcO+zoGJ/sMBQ772Yv3GOT3Evb3EuT3GAG59zT3Bvc0A7n3cRX3pjL7pvsY+Eb42Pum5Pem9xj8Rgb3pvxaFfsG9vcGBg783/iMdvdtd60KDlafdvcc90f3xvdHAfhe90cDigT3TAav9xwF94L7HPdH+bT87PtH9xEG8/vGFdv3xgX3BPvGBg771KB2+QXWEqT3hMzWEwD3nRb5Bcz9Bdb5BbjW/D376QcT8Pc5+/sGDvwp91J298B3AbP30xVimmeobh5uqK98tBu0r5qoqB+oqJqvtBq0fK9uqB6obmeaYhtiZ3xubh9ubnxnYhoO/JuN9z/7LHahdvc/dxKL9z/3Lfc/9xj3PxMAE473P42vChNe+IOJrwoTPvhujK8KDoQK1PHJ8RMAABPf8LP5UD8KE+/wZwr3g/wkPwoO/L75AdsKAdT6klIKwwp2lfeL+y+vi/cLxKJ79wWL1HLNYrSL5PcddxLh9xH3S/cEo7MTVPj5SvceFXCMbJNqnAiGiImFHpKFho6HG4iNh46IHoIGhJmBhhqK3AqIHpSej4YFj4yNjYweho8Fj5N7mhuRio+JjR6Uh5KIkIkIiZWXipkbgfdiFYOFhIeCG36PhJWbj46UjhqMi42KkB6KlwWKjYuOjpKhoJMahQaAfoCSjo+Oj46OGY+XjoyVjJyNGYqPBYqMi4yMGoCMf5B8kwhnnnmgopeXp5YajI6Mjo0ajoWdiR6LioqhGoqSh5WEmoSahpSGj3yWd5mClAigYGSWaBuEhIuKhB92iHiJfIgI3AqKiB9+hH6EgIRwgnmGgIhifnF2gm4IiYSKiIsafn6EgoOAhoOKhRmJfwWFdoh+hRqAjIGMhB6GiIeJhhuYiJGHh4p/gIIak5KRj5Ebhn12hoceiImNkIkfioncCooIi4uLix6GgoSIiR5/hYiJiIiKhhmUiYKEBZaRiYiIiIiEhh+SjAWOjs8KH4qLhoqBHop1BYqBi4WIGnSQdpR6HpCGi4eMhgiCjIyHjhuTjY+Pj42IhB5+g4aGiBqDlX+Mhh6MiIyFjYIIeJCTgpYbjI2OkI4fhJKHkI0ajo2Mjh6MkIGOG4yLi4wajweMjI2MjBuKjo6KjhuCjYWOiB6ZhJKFhxqCiX2GeR6KhHd1ihqImJOKjRuUjwWEiYOGgR6EfoiDiokIggeIiYqLiooIjIaNiYsajAeGhgWMioyJihqGiYmGghoTlPiJjIqMHveeBpeRkpgfiZeXlwWJjIqNjBqPmpmPHoiOBZqel5segAeOjI2NjBuUBoyQj52PG4+KioqMH4qKiouKG4iNjomPG4yOjpCOH4mMBYyKioyKG46OjYgFEyp4jJCPkJGRCJiYkZaWGomOio6OGo6PlZOaHoGTlIaUG4yNjYyMG4eCk5AflJCJh44fhKEFjc8KHqcGjY6Oko8fj46Un5Aae4EFiISNhxuNjo+OkI8IlZKQk5IalIScgx6NB4uMiIyEHoyHi4mIGoKEhIaGG4Z+mpCSkZOWlB+Kj6CDkxuclJOaH/sE+2QViIqKioofjokFjM8KjRrZXRUTVPiTho+BHneJe5gFhIeJh4ofiH2KgIMaioaFgoJ+gn6Eg4eJCBOU+HiEgYeKiAinBpCPlY+cjqiSnJKRlHqJGIeJjZCQkpKalR+alZKRjhr7FYUVj4mNhx6EBoKEiXKCH4Z+iYGEGoGAg4SGhgimBvwEzRWEhIaAgh+EjYeOj46Njo0emaEFq00VgYeVBnG9FYaHh4KHH4mIiIWHgIiDh4WGiAikBp6Pm5OYHmNqFYaHh4SJH5OOj5If9+L5OhWGBoeJBYmJiYqJG5cHjImOiI4elgaOjI+Njo8IioqLiYoahgeKiYuKihqOh46IjIkI9wv7ihV/iXyGeR6CXwWJioqKioqMjYoeaYd6gx6KjoqNiowIhIiEfB+IigWHioaGhxp0B4iJiYaEiI+THoeIi4qKH4iGiYeJh4aEg4aCiIOJGIBxhoIbhIOTjIgfgAaIgJKZdh+PjZGOlB6fkqePsIwIkI2NjY4akIGOd4wed42BkJMakIyOjB7CBpCbhI8bko6MjB+Elm6WWZSNjhiOj42OjIwIkoqRio4eoYyQjo2NiYmOHomPjoqMG5qSBY2Ni4qOH4+KBZSQjY+OiY6IjR+EBoR+iIYbE4p4hn2ThBt8goR9iR+GkQaGiYmHH4aRkImPG5aKkImGGoiIh4aFhIiIhId/iAh2hoCEgxp6k4OUlhqMzwoeioyNipAbkI6MjB+UB5SGlICSHoeHB5mIkoQeh4gFjYiRhJUehZWIkY4alI6Qkh6tBomMio0ejYyOjY6OnJqRiIyOf42Ej4qQCBOU+I+Wh5AbkpCNkI4flIgFipCSipQbiooFiIeKiIgaiouJjIgehAeQjAWMi4qKidwKih+LjIqLHhOSeM8KjpAfho2JkJCOkZceE5F4ioyJkIeTCJYHjaKEkYOQg44ZaJBxjnqOcH4YioiIiogbiomMjIkfkgeoo6C7mB4TVPiUrrCQsRvPt3dinx+Ehn2GGoCNfI52Ho52jXyAGvuiqxWJjo+NBfdS+70ViIrcCh6Pzwoei4yLix77HvcYFYqEin2KHpCNjY6NjYqKjB6Pj4qKjh/3IvtYFYKFhYaGG4mKjIyRkI+Wjx+NjIqLH26KFYmJiYiIHoCFg4eGiXqCf4SDhgiKh4qJhh+AiAWKioOBhhuRj5aTmx6TnJGVj44IjoqNh4aHiYSIGoYHmJaYlJiSpI0YjI2Jh4wfJ4kViIeIihuOlI6IjImMihmUkRWGiISGgR6BhoaGiBuVoZKWj48IdHIViIqJiYkeioyLjI0ajIuNjI4ejIyKiYwfZQSHiYiIih6NB46Njo4egIAViIqHioUbhIeNjoofkIyNjB6OiY6IBc8Kjo4ekoiPiYga92H4bRWUhI98HkQGfoWCeoKShpkfj5eOkBuPhI+IjooIioyMi44bmZAFj5F7jhudBo2MjY+ShpKBkB+CkYaPjhqVjAWOjoqKjh+IjI2JjxuRjpCVH4X7VRWOiY2IHnwHjo2Okh9zaRWPiY2RBXCSFaKFl3+IiomHHo6HjoiOiQh7B4KNhZCIHpCQBYyOi46OGmytFY+JjYiMHoqIi4mJGoaNiI2KHoyNjI6PGq73NRWIiYqIih6JBomNioyNGo2NjI+MHo6MiogfDuBRdvdk3fh7ugH5E/cHA/my9z0VJtsFq6Ok0tga6GzZTMgeyE08qiwbTk1vUkwftKW0mLaK9wWK2mS4PgilXphTRxqIan9teHD7GfQY0OP7KZT7Efsi9kTDzvcI+wQFZlZVeVIbVlabq1Uf+2f7l/cDPPcd95YFar7Cescb1M2ftMgf7iwFDvwg+Hf3ba0K93n7bRW/BrH3bQV4CvxMjfcZ+Sx3Eqf3HPsb9xsT0O6NFfcZ9xv7GQf3iAT4vQcT4Psc/L0GDlt7Cp/3FJ2ZCkgKExb1+d4gCkkK/Hmfdvm0dwGl90cD92HACvtHqQr4Sw5wCkkK0goBi/dIA/m0BPtI90j3SAf7SPuvFfyZ90j4mQcOcAoO+7EOrYr3R/hO90cB+HP3RwP3Z7cK+w79AQUy+0f5cfdHQPkBBvwS/QEV1PhOBfcW/E4GDvuxDvurDvkRZgr3ufdIngr4YAbK90cF/VKICvlTXQr86AZR+0cF94j9AfdI+QH3egYOIJcK90P3XTv3FdQK+Tk4CveHoHb5LPcbAdj3G/dx9xv3gPccA9i3Cv2z9xv5LPdx/Lj3G/i494D9LPcc+bMHDrv5wfdJAffJYQr8d592+cL3SQGQ90fECvs5+cKNCvnd9wsB9xxWCgP3HPndIAr8d592+er3CwEv9ybw9ybECvuo+eqPClt7Cp/3FKmZCvkhRgpmagq0qgr3WFYKVPcUE+K7JAoTHPvm+MkgCoFjCrSqCtr3FIBWCqr3FRPSIQoTLPw8+VwgCqQKyKoK3vcVgFYKjPcTE9JNChMs9wr53SAKzGMKmMcKXgoT2CEKEyD7yPlALQp4Qwqu90n7RccKs/cUEwgT5Pk1JgoTEPd0+dctCraLCpj3Sfss90nLCin3HBNpgBOUQCsKEwIA7/gMLQq8CrSqCtz3HICZCisKExaI+CggCvh7tAr3G/dH+zv3FbXICvsNwgr4SvdSWfcUE2qA5xb3GAYTWoCy9ycFE1pA98/7J/cUBhNpQFwKBxNagKn8JhUTaYDx+CYFE2lA90cGE1pA/CYHE6qA+Ob7qXcKBxNmgDIKBxNpgPcP/OUHE6qA/bUHDvi5tAr37PcU92H3DxLk9xT4MfcVE7wcBMeKFfcV/GT3bPf69xT7+vdh+GT3Dxz7kgcTfP20+LEHE7yKB/wx9xY7Cg7GvQr4Tnag90f7FfcVT3f3kneuChNTQBOIoCEK+136EVIKEyQAwwrb+cHHCrEKE2A1ChOA1WEK9wmgCqzHCvcY9x34FvcbExAT7EUKExD8PpgtCp8KrMcK3Qr3FfcU9wP3FRPuTAoTEHhhCplrCpnHCqMKE+woChMQ+2z4vC0Kxr0K+E73R/sV9xWY90n7O/dJrgoTZoATkUAhChMIAPvL+UAtCvcQoArIqgr3GPcdjFYKg/cbE+lFChMW/Jy0IAqkCqzHCt73FfgT9xMT2E0KEyD3dmEKnWoKAfjHZArYJAoOs6cK+wB2zAr3WvcVEvcC9xT3+fcVE3ylChO8+PqMBfhsB/x6+xQV9/n7bPv5Bg6Zcwrgogr5VykK+yCRCtz3FgOoCvP7CveK+xX3Ffi69w0S1vcG+DT3FVT3GxO0+Tv7ChX3GwaM94oFE7g6+TP8SQb7GP0zBTH7ivcGBhN09wn4fgcTtPwN9xUV5fi6BRO492n8ugYOW0MKAZ9kCkgKDveEoXahdvg+9xT3h3cBmPcV9633Fvet9xUUDvpX+EAV+Af7FfuH+60HiveHBfsV+4f7rfeH+xX8B/caBjD8QAX3Hgao9x2u9zGn9xoI9x0GjPxBBfcV+EH3HQbncgpu9xcIDkEKkoMK7/cU9/NkCvjXXQpvCqSgdvm0d5+yEu/3FPfz9xQTIPiKXQrk+1IyBxPY958WbwqgpgoB3JAK+Vc0Cg50n3b5O4kK+LR9CnQKDvc4MQpQCsUiCg6fn3b5O/cNAeX3FPgE3gqTCksKkorKCvsxdvi994v7SPdH+w33DssKKPcV9/f3FRNKABORgFsKEzGAjIz3k/sVBxOFgH8KN5EK97x9Cvk5OAqtxgryvwr47XkK91u7Cpm6CvomVApRoHb36vcL9+d3AfksFlz3F1b3IVz3Ffcd+CMY+yoGa/sAZvsSbCII+w0GJffnBfskBrj7GLr7Hbj7Fvsn/CUY9yQGr/a29xeu8wj3Cgb3BPvqBQ7AioIKnPcV9/B9Cvcmhwqon3b3l/cW+C93AeS/CoUK942LggrX9xT3ifcV93pkCvo8gAr3sYyCCpbFCviBbgr3L4r3Fveg9xT3JfcVAfeh9xX4BH0KmrcK+xX3kv0z+Qb4ovyF96YH+AT9MhX8BPeg+AQGDve1PQqzlArkkAr5X/ihOgoOtov3DPdu9wz3cPcMAVUKNgqDuArQoQoTfNBYClZrCgHRswoD2yMKDk+K90f7RvcU91LICssKRvcU92f3R2r3FRObAKUKE2yA+PqMBROcgPhsBxObAPx6+xQVE1yA9/n7bAYTawD7+QYOrnMK9wSiCvlyKQr7CJcKi/dHKfcW1AqoCvc1JXb3Dvcb+M/3GwGp9xX4NPcbUfciA/lk+w8V9xsGiveVBTb5Lf0WBt79LQUm+5T3EPcN+HoG/An3GxVF+LQF+AL8tAYOrYsKywop9xwTahOVKwoO+B+gdver9xr4FXegdxLn9xv3vPcc97z3GxQOE+76SPgxFev4FQX7JAZs+x1n+wdt+xkI+yQGE974Fvsc/Bb7JQcT7iv4FQX7JAap+xyw+w2o+xQI+yL8Mfcb96v3vPur9xz3q/e8+6v3G/gxBg5BCnSgdvmzdwHH9xT4BX0K+MH0FSL3Ffmz+xX8tgf8BfsEBfkm+xT9s/cvBw7U+bPrErUK0vdt3PccE6D4trcK6/ttKwcTUPe+/UovCg6mmAoS1ckKE+z41V8KipEK5PcU9+VkCvjCFnwK/Pz7DvcwBvsZ/CUF+6n3FPerB/cf+CMF91oGDvdWMQqWCtz3FPgDZAr41EcKuiIKDp+fdqF2+Tr3DYt3EuX3FPsU9xX4A/cT+xH3FBNVE6qTClOgdveKvgrIzgr5W3oKii4KN5cK93r3SPsn9xXUCvkYOAqRxgrsvwr453kK9+S7CvO6CvqAVAqzoHb30Pc++yX3Effid653EtQKQgrzisoK+QF3Et/3R/s29xX3u/dH+xL3FRN0E6r3eocKn59295f3Fi33SPfZdxKL90gw9xb3hfdHV/cUE7oT1YUK96K9CvkBdxKn90ck9xT3D/dHUvcVyfdHgPcUE3UAE6qA+liACvgJjIIK9w3FCvjvbgr3hYr3HPeG9xL3QvcPAfer9xX4FmQKoV0K+w/3lf06jAr3sT0Kq4r3HPeG9xL3vXcB6fcV+BZkCuldCv21jAqzi/cM+wz3P/ci9z/7JvcM9z33P/sM9wwSE2gTlFUKNgqSuArioQoTfOJYClaK9xb7FvdI+zN2+AT3R/sp9xTq90f7DfcOincS+F73R/sQ9xUp9xX3ifdHNfcUE1SQEyIgdAoTiUj45/stOgoOuw4w+d/3CwH09ybw9yYD9PnfjwpZClkKeKYKrMcKyqEKE+z5RTQKExD7ivgVLQrFmAqsxwr0yQoT5vj0cQoT1mUKEwj8TPhjLQr4Sor3SPdQ90fV90cB+F73R/et90cD+t34thX8YPeR/Ov7R/cQBvs2/QEF900G9zX5AQX3BP0B+RMG+0f3SBX7rfdQ960GDrsOuw54ewq79xSpmQr5PUYK+775V6wK+ZGSCvu++0CsCvsGkgrm1grV94QV+P73DPz+Bg730tYK6feEFfnC9xb9wgYO/Jagdvgq2wr3B/dIEov3SBOY+JkE/Jn3SPiZB/tE97a5CkmgnAr36Xbd9w5LdxL4qvcUE9S7JAr7ffl6bApRi7IK90x2zPcbT3cS3PccE9QrCvcB+N1sClagdvcZ9xT3/HbZ9w1QdxKjChPWKAr7tvmNbAo3jgr3bPcU9yl23QpQdxKf9xQT1EgK9236k2wKdGoKsccK+Lv3FBPozCQKExD7a/jGLQr8gKF2+RDbCsp3Eq33FROYlQpN+qO5CoGL9xX4gHbS9xVPdxJeChOsIQr70foRUgoTUMMK+HOK9xUgnArP9xT3WvcV+w3CCviv9xQy9xQTZeckChOa+Ob7qScKDlZrCvcAqgrw9xWCVgpk9xQT6SgKExb8APkaIArSCrSqCmv3FCv3SMD3FBPI+WIE/WL3SPliBxM0+2j3DyAK4vohqgq1CnlWCoX3HBNINQoTsF76ISAKffom9wsB92RWCgP3ZPomIAri+QHbChKxChMwNQr3IvqSUgoTwMMK+9Sfdvm1dwH3b30K929dCl4H+x5nBfsZB/cergX9AvcV+bUHDk8K94/4qjwKTgr3hPiqPAqfCrmqCt0KgPcUl/cUiPcUffcVE+qATAoTFQD7IPnOIAoqCvwK+e48Cvnu9yEB91P57jwKKgr8D/nfPAr57vchAfcR+e4sCloK90r54CwKRAr7fvjLLApACvvE+OksCmgK91r53ywKYAr74PleLArbsQoDNQqj+e4sCooKWPngLAr5LovaCrIK9373FRJeChN8HAUFFvca/IT3PPhbB974hgUc+0j9tAYTvDAK+Ij4uhVm+4YF++L3hgYObZ929xr3Ffer9w73HHcB6fcV97l9CvdzihX3Gvg6+Kb8OvccVwoH9xX3mxX3q/e5+6sHDmAK+9b5bSwKioz5tIsG+wuLBx6gOWP/DAn5pRWhEwC/AgABAAoAFgAfAEYAZQBtAHEAfQCCAK4A3AEBARMBGgE6AVQBWwGIAZUBtQHTAdkCIAIpAjsCfQKUAp0CrwLJAwADEgMcA1UDjAOXA6MDvwPJA98D5APyBCEESgRlBHYEiASYBKUEqQSxBLcE4wUQBRcFHAVFBWYFcAWBBYYFigWSBZkFnQWhBagFrAWwBcIF1QXqBfcGAQYJBhQGGgYkBjcGUgZvBoEGjgaZBrUGzQbUBtoG3Qb1Bw8HFQcaBx4HIwctB0QHTQdUB1sHdQeLB48HmgeoB6wHugfSB+gH8Qf1B/4IAggJCBEIIAgsCDQIQAhJCFUIWghjCGwIcgh3CIIIjQiYCJ8IpgiqCLIIwgjMCNAI3gjhCOUI6QjyCQAJDQkWCR8JJgktCTIJNwk8CUEJRQlSCVgJZQlyCXsJfwmHCY4JkwmXCZsJngmnCbIJvQnBCcwJ0wnYCdwJ4QnlCekJ7Qn2Cf8KCAoRChYKGwohCiUKKgovCjQKOQo9CkEKRSUK9537CyUKDvmBFvm0/TKGCjAKC2MKAV4KAyEKC/ecFfuc9xX3Gfft+xn3FPmz/QX7DfcwB4f8NRX3F/g1Bfdq/DUGCxb3GAay9ycF98/7J/cUXAoGqfwmFfH4JgX3R/wmBgsV9xT3C1EKC4onCgt3CjIK9w/85f21Bwv3AyMKC10K/QL9tPkB988GaKJusHCe5vIY+xX7cxX7Jvv/92z3owf7o/cUFfdigQoO1wr3Z/cS92nBCvcV+Ab3EgP5VPhlFfyE92n4hPcO/QX8YfiH+2f8h/sU+QUGC/lWFvca/IX3PPhcB974hgX9L/20BvcU+TsV+AgGZvuGBfvjBgsV2ga457ovBdcGR/chBfsFBg4V9xRTCngKtAr4vfeLnQrb9xX39/cVE6xbChNsjIz3k/sVBxOcfwoVIvcc+bT7HPy3B/wF+wQF+Sf7G/209zYHC/cU9xU7CguDCtj3FviyZArYFvcW+R4G96L7pvek96YF/R58CvsnB/uR+4L7j/eCBfspBg73bPf79xT7+/dh+GULFvkF9xT8hfcGBviF93kF9939BfsO+Ib7Fgf8hvt0BQv4QBX4CPsU+4f8BfeH+xXYCvhA93YH5nIKb/cXCAv5B/QvCgv4H4n3FCF2+AL3FfdNqgrm9xX3Tfcd+DH3IBN++Cm3CvvE+033xPsV/bP3FfgC900HE778A/lG+bQH+yD9NBX8Mfi7+DEGDnMK0aIK+UgpCl0K/Qr7DveN/Tr3Ffk695AGDtv7A3b3GPcU+LL3FgHp9xX3IvcV9yF9CvmQXQr9Mv2096P7GPcV9xj3ogb7FfcUFfsh9w1RCor7DQX7Ivi6+DAGDhX8hfemVwr5Bgb7FPcWFfwF96D4BQYLFfi5+DH8uQcLFfcFBs/3IQU/BlwvXucFPAYOlAr3BaEK9WQK+Xf4oToK9378IhX5tPcUqQqgdvfM9xP3g8EK9xX4JWQK2tUK9xX3zPeiB9n7zAX3HQY998wF9w74fAb8pfv9FfeD+CX7gwcOFfv095739Acl+5oVTfdAyQYLpGsKAaMKAygKC2KK9xP3XvcR92/3EwH4OX0K+RSKFfha+3gH93j3dQX3DfzE+w34Lgf7hPtzBfsT95n7XvxD+xMHDvmCFvsv+Cj3IvgvBfsvBiH78QX7EwYg9/EF+ysG9yP8L/sv/CgF9y0G9wv36QX3EAb3CvvpBQ6OCvds9xT3WvcVC2ZqCgH4qmQKuyQKC/kjXQr8BfwW+AX7HfyO+J/7NPye+xv5Jfm1BwsmChMW9wr53iAKXQr7ifwD94n7FLYK+D74A/w+9xTNCvkhJgoLS2YKngr4X/dH/RKICg6OCvd69xT3TPcWAZ73FfgkZAr5dPh6Ffvf+xT3X/t6/CT4svik9xb9Jf21+SUGDo6gdvem9xT3ofcVAdqQCvlVXQr9BtgK96b4hQb7FPcUFfwF96j4BQYO+FwW99P3hPh1+xX79PwE9/T7Ffx195b70wcL+WYW+bT7E/0y/BP5MlcKBwvBpwr4uokK8PcU+AbeCvAzCgvXCvi6wQr3FPgG3graMwoLlgrR9xT4A2QK+MlHCvsUBgsVLgbh+0kFCwbh90kFC10K/BXg+xY2/BX9tvgVNfcW4fgVBv2X9xYV+LP3lPyzB/gWFvuU+LP3lAYO+Ff5shX8BvsM98IG91T7cAX8XfsM+F4G+z77bgX75PsM+C8G95L34wX3EwcO9xT3HfcUC/sV/bQLtwr8SvcOBz37/QX3HQbZ9/0F94MGE7z7/nwKB/yF+8oV91D4BftQBw77PqB2+QH3R5j3SQGrCgOLBPdH+QH4JPdH/NcG906YjQpBQwoBu2QKfgoL+Mj4vRX3FfeL/Pn9tfj4Bgv5tGIKC/m0FQva9xT4MfcVC3EKE9xlCg7GIgoL+cEtCvzb+w73JAuLdgoL9xQDC/hW+xXYCvdr+Bf7a/cU9/IHC4v3Rvcc90T3F/dHAasK9673RQv3gvuWPwr8YvuiFc9n+CL5jEevBQukCgHe9xX4E94KTQoLkQr3uX0K+TY4CqCcCvgm9w4LoHb3GfcU+DX3DQtSChMowwr3Ffsj2Qr9MwcO9xYV+MT7FPzE+3X5M1cK+ldtCjEH+/P7ZAX3vvsUtgr36gf38/dkBfy69xTNCvtvqwr5AXcB95H3SAP4RV0K+0j9AfuN+0f4QQYO9/IV7PhVBfseBiv8VQX7gQYL/EAF9x4GbvccaPc1C6cK92z3FPdiiQoL+LSKFfcV+bViCgb7Q/07BfcZBvdC+TsF90YGC4uCCvgT9xYD+JVdCvsW/TP7v/sV+EEGDvcV+LL3FQsV9xX8ZQtRCg63Cvvz/AT38/sW/HX4hvtS/IT7FfkEzQpdCv0e/bT3G/eK+DoG+wP3HBX7y/ev9/wGDkMKtaoKC/cU+bQL9xUDC/k9JgoL+xP79/i69/cHDhb5tPsU/TP7evjE+xX8xPuJ+TP7FKkK9//7FwdAQAUL9xX5M3cBC6B2+bR3AQtXdHa35fdA5Yfl90Dlv3cSs/HJ8fcc8cnxC+T3lhX4hvuXfAr7FPwv/AT4L/sWBg79tAcL9xQV+TNXCvmBbQr8evhh+xz8YftG+RIGC/cOAQv8gKF2+bJ3Aa19CpUKC4v3Gvsa90b3D/dH+0b3G/dL90f7GvcbC/kX+Iz8lve9B/gW/S0V/Bb3hvgWBg4V9zJTCvsyBg6K9xULmwr3i/sLmwoOoQoDC6B2+TqJCguaCvgl2poKDuW3CrYK+Tv4BP079xPNCor3Fveg9xT3pncBC/dfwApXCgcLeKB2+D73FfeJdwELoHb5AfdHnQoLoHb3a/cb+FV3oHcLVgoT6AsV9wX7P/tUBwsV9yb3C/smBgt29yf3FQv7DsIKCwP5Evh+Ffxf9xcLfKB299P3Fff0dwuK9xv3NPcd+AV3C/cV+AX3FAv3Fff/fQoL8LMKC6SL9xb5MncL94L4bBX3Yvh59w38+YYKC6B2+ED3FfeHdwuL9xQL3Bb3Fvk69//3DvyBBg6GCg73CxILi/dHC7AKxvc/A/c/CwHU+HcVvwax920FUQoLywon9xT3u/dHTvcVCxX3P/s/+z8HC3b3VHcBi/c/C7UK+AX3HAv3Gvc89xsL9xXMCguOCiB2C/cP9xsL/bT3FAv5sxULn3ahdvf99xT3UMIKC1IKE2DDCvcV95T3FveU9xUUDgtKdt/3Fviz9xXgdwELtouyCvd49xsLi8oKC/cc96/3GwEL9xb4BGQKC4oV+bQLiQraC/cOEgvoBg4DkMAK90eGCgv3Ffd19xT3ZX0KC44K91L3FvfzdwEL90kSC/dH+y33FPco90cL9xX4F/cUC9oK90cLEqsKC/ft9xQL+bQHDvcbAwuMjIwL/JYhdvnedwELFfc/+xX7PwcL/JagdvkA90gLFfsC+C73AgcLE9ATqAtdCv20C/eE9xYBC5KnCgv9tPcVC/kz+xUL9xX7FQt29yB3C4qJigvR9xUL9xMDCwAA\";\n",[],[161,252],["D",1789123604280],[195,196,197,198,199,200],[161],"1af33a3b-3dbf-4621-8ecd-07e6b54b5ce3","types.ts","151bda1c-adce-11f1-880b-1607ee4eb77e",11,["D",1789123605407],"export type BookStatus = \"reading\" | \"backlog\" | \"finished\";\nexport type Priority = \"high\" | \"medium\" | \"low\";\n\nexport interface Book {\n id: number;\n googleBooksId: string | null;\n title: string;\n author: string | null;\n coverUrl: string | null;\n description: string | null;\n isbn13: string | null;\n goodreadsUrl: string | null;\n status: BookStatus;\n priority: Priority;\n rank: number;\n tags: string[];\n addedBy: string | null;\n pitch: string | null;\n createdAt: string;\n updatedAt: string;\n}\n\nexport const BOOK_STATUSES: BookStatus[] = [\"reading\", \"backlog\", \"finished\"];\nexport const PRIORITIES: Priority[] = [\"high\", \"medium\", \"low\"];\n",[],[168,263],"2b8a1214-0a37-419b-b6f6-9ccb470c1a7c","googleBooks.ts","14e78802-adce-11f1-880b-1607ee4eb77e",25,["D",1789125408337],"// Google Books proxy: the only client input is a search query string or a\n// volume id — every fetch target is the hardcoded googleapis.com host.\nexport interface GoogleBookSummary {\n googleBooksId: string;\n title: string;\n author: string | null;\n coverUrl: string | null;\n isbn13: string | null;\n description: string | null;\n}\n\nconst ALLOWED_COVER_HOSTS = [\"books.google.com\", \"books.googleusercontent.com\"];\n\nfunction isAllowedCoverHost(host: string): boolean {\n return ALLOWED_COVER_HOSTS.includes(host) || host.endsWith(\".gstatic.com\");\n}\n\n// Upgrades http->https and rejects anything off the Google Books image allowlist.\nexport function sanitizeCoverUrl(\n url: string | undefined | null,\n): string | null {\n if (!url) return null;\n try {\n const parsed = new URL(url.replace(/^http:/, \"https:\"));\n if (parsed.protocol !== \"https:\") return null;\n if (!isAllowedCoverHost(parsed.hostname)) return null;\n // \"edge=curl\" draws a decorative folded-corner + margin onto the image;\n // dropping it gives a flat cover that can fill the card edge-to-edge.\n parsed.searchParams.delete(\"edge\");\n return parsed.toString();\n } catch {\n return null;\n }\n}\n\ninterface IndustryIdentifier {\n type: string;\n identifier: string;\n}\n\ninterface GoogleVolumeInfo {\n title?: string;\n authors?: string[];\n description?: string;\n industryIdentifiers?: IndustryIdentifier[];\n imageLinks?: { thumbnail?: string; smallThumbnail?: string };\n}\n\ninterface GoogleVolumeItem {\n id: string;\n volumeInfo?: GoogleVolumeInfo;\n}\n\nfunction extractIsbn13(info: GoogleVolumeInfo): string | null {\n return info.industryIdentifiers?.find((id) => id.type === \"ISBN_13\")\n ?.identifier ?? null;\n}\n\nfunction toSummary(item: GoogleVolumeItem): GoogleBookSummary {\n const info = item.volumeInfo ?? {};\n return {\n googleBooksId: item.id,\n title: info.title ?? \"Untitled\",\n author: info.authors?.length ? info.authors.join(\", \") : null,\n coverUrl: sanitizeCoverUrl(\n info.imageLinks?.thumbnail ?? info.imageLinks?.smallThumbnail,\n ),\n isbn13: extractIsbn13(info),\n description: info.description ?? null,\n };\n}\n\nconst API_BASE = \"https://www.googleapis.com/books/v1/volumes\";\n\nexport async function searchGoogleBooks(\n query: string,\n): Promise {\n const key = Deno.env.get(\"GOOGLE_BOOKS_API_KEY\");\n const url = new URL(API_BASE);\n url.searchParams.set(\"q\", query);\n url.searchParams.set(\"maxResults\", \"5\");\n if (key) url.searchParams.set(\"key\", key);\n\n try {\n const res = await fetch(url, { signal: AbortSignal.timeout(5000) });\n if (!res.ok) return [];\n const data = await res.json();\n const items: GoogleVolumeItem[] = Array.isArray(data.items)\n ? data.items\n : [];\n return items.map(toSummary);\n } catch {\n return [];\n }\n}\n\nexport async function getGoogleBookVolume(\n googleBooksId: string,\n): Promise {\n const key = Deno.env.get(\"GOOGLE_BOOKS_API_KEY\");\n const url = new URL(`${API_BASE}/${encodeURIComponent(googleBooksId)}`);\n if (key) url.searchParams.set(\"key\", key);\n\n try {\n const res = await fetch(url, { signal: AbortSignal.timeout(5000) });\n if (!res.ok) return null;\n const item: GoogleVolumeItem = await res.json();\n if (!item?.id) return null;\n return toSummary(item);\n } catch {\n return null;\n }\n}\n",[],[168,271],"ff33d1d7-70e5-4e3e-96ae-1cce122ff712","goodreads.ts","14dda6de-adce-11f1-bb4b-1607ee4eb77e",6,["D",1789123604996],"// Resolves a Goodreads book URL. ISBN-first: goodreads.com/book/isbn/{isbn13}\n// still 302s to the real book page, which is free and needs no API key. Only\n// falls back to a paid-ish search API when there's no ISBN-13 to look up.\nconst GOODREADS_HOSTS = [\"www.goodreads.com\", \"goodreads.com\"];\n\nfunction isGoodreadsBookUrl(url: URL): boolean {\n return url.protocol === \"https:\" &&\n GOODREADS_HOSTS.includes(url.hostname) &&\n /^\\/book\\/show\\//.test(url.pathname);\n}\n\n// Also used to validate admin-supplied manual corrections (open-redirect / javascript: guard).\nexport function validateGoodreadsUrl(raw: string): string | null {\n try {\n const url = new URL(raw);\n return isGoodreadsBookUrl(url) ? url.toString() : null;\n } catch {\n return null;\n }\n}\n\nasync function tryIsbnLookup(isbn13: string): Promise {\n try {\n const res = await fetch(\n `https://www.goodreads.com/book/isbn/${encodeURIComponent(isbn13)}`,\n {\n method: \"HEAD\",\n redirect: \"manual\",\n signal: AbortSignal.timeout(5000),\n },\n );\n if (res.status < 300 || res.status >= 400) return null;\n const location = res.headers.get(\"location\");\n if (!location) return null;\n const resolved = new URL(location, \"https://www.goodreads.com\");\n return isGoodreadsBookUrl(resolved) ? resolved.toString() : null;\n } catch {\n return null;\n }\n}\n\nasync function trySerper(\n title: string,\n author: string,\n): Promise {\n const apiKey = Deno.env.get(\"SERPER_API_KEY\");\n if (!apiKey) return null;\n try {\n const res = await fetch(\"https://google.serper.dev/search\", {\n method: \"POST\",\n headers: { \"X-API-KEY\": apiKey, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ q: `\"${title}\" \"${author}\" site:goodreads.com` }),\n signal: AbortSignal.timeout(5000),\n });\n if (!res.ok) return null;\n const data = await res.json();\n for (const result of data.organic ?? []) {\n const validated = validateGoodreadsUrl(result.link);\n if (validated) return validated;\n }\n return null;\n } catch {\n return null;\n }\n}\n\nasync function tryBrave(title: string, author: string): Promise {\n const apiKey = Deno.env.get(\"BRAVE_API_KEY\");\n if (!apiKey) return null;\n try {\n const url = new URL(\"https://api.search.brave.com/res/v1/web/search\");\n url.searchParams.set(\"q\", `\"${title}\" \"${author}\" site:goodreads.com`);\n const res = await fetch(url, {\n headers: { \"X-Subscription-Token\": apiKey, Accept: \"application/json\" },\n signal: AbortSignal.timeout(5000),\n });\n if (!res.ok) return null;\n const data = await res.json();\n for (const result of data.web?.results ?? []) {\n const validated = validateGoodreadsUrl(result.url);\n if (validated) return validated;\n }\n return null;\n } catch {\n return null;\n }\n}\n\n// Never throws — a failed lookup just means the book has no Goodreads link yet.\nexport async function findGoodreadsUrl(\n title: string,\n author: string,\n isbn13: string | null,\n): Promise {\n if (isbn13) {\n const viaIsbn = await tryIsbnLookup(isbn13);\n if (viaIsbn) return viaIsbn;\n }\n\n const provider = Deno.env.get(\"SEARCH_API_PROVIDER\") ?? \"serper\";\n if (provider === \"brave\") return await tryBrave(title, author);\n if (provider === \"serper\") return await trySerper(title, author);\n return null;\n}\n",[],[168,279],"e389c57e-3a8b-4690-a263-dd8841b9c7e7","db.ts","14f3349a-adce-11f1-a3cc-1607ee4eb77e",8,["D",1789123605092],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// Memoized so the DDL only runs once per cold start, but a middleware awaits\n// this on every request — dropping the `books` table in the admin panel and\n// reloading is enough to recreate the schema (self-healing).\nlet initPromise: Promise | null = null;\n\nasync function runInit(): Promise {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS books (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n google_books_id TEXT,\n title TEXT NOT NULL,\n author TEXT,\n cover_url TEXT,\n description TEXT,\n isbn13 TEXT,\n goodreads_url TEXT,\n status TEXT NOT NULL CHECK (status IN ('reading','backlog','finished')),\n priority TEXT NOT NULL DEFAULT 'medium' CHECK (priority IN ('high','medium','low')),\n rank INTEGER NOT NULL DEFAULT 0,\n tags TEXT NOT NULL DEFAULT '[]',\n added_by TEXT,\n pitch TEXT,\n created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,\n updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n )`,\n `CREATE INDEX IF NOT EXISTS idx_books_status_rank ON books(status, rank)`,\n `CREATE TABLE IF NOT EXISTS admin_sessions (\n token TEXT PRIMARY KEY,\n expires_at INTEGER NOT NULL,\n created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP\n )`,\n `CREATE INDEX IF NOT EXISTS idx_sessions_exp ON admin_sessions(expires_at)`,\n ]);\n}\n\nexport function initDb(): Promise {\n if (!initPromise) {\n initPromise = runInit().catch((err) => {\n initPromise = null; // let the next request retry instead of caching a failure\n throw err;\n });\n }\n return initPromise;\n}\n\nexport { sqlite };\n",[],[168,287],"6b111b2e-b981-47aa-9876-5e1e9734de84","books.ts","14c5baec-adce-11f1-a330-1607ee4eb77e",36,["D",1789374979783],"import { sqlite } from \"./db.ts\";\nimport type { Book, BookStatus, Priority } from \"./types.ts\";\nimport { getGoogleBookVolume } from \"./googleBooks.ts\";\nimport { findGoodreadsUrl, validateGoodreadsUrl } from \"./goodreads.ts\";\n\nconst PRIORITY_ORDER =\n `CASE priority WHEN 'high' THEN 0 WHEN 'medium' THEN 1 WHEN 'low' THEN 2 ELSE 3 END`;\n\ntype Row = Record;\n\nfunction rowToBook(row: Row): Book {\n return {\n id: Number(row.id),\n googleBooksId: (row.google_books_id as string) ?? null,\n title: row.title as string,\n author: (row.author as string) ?? null,\n coverUrl: (row.cover_url as string) ?? null,\n description: (row.description as string) ?? null,\n isbn13: (row.isbn13 as string) ?? null,\n goodreadsUrl: (row.goodreads_url as string) ?? null,\n status: row.status as BookStatus,\n priority: row.priority as Priority,\n rank: Number(row.rank),\n tags: JSON.parse((row.tags as string) ?? \"[]\"),\n addedBy: (row.added_by as string) ?? null,\n pitch: (row.pitch as string) ?? null,\n createdAt: row.created_at as string,\n updatedAt: row.updated_at as string,\n };\n}\n\nasync function nextRankFor(status: BookStatus): Promise {\n const result = await sqlite.execute({\n sql:\n `SELECT COALESCE(MAX(rank), 0) + 1 AS next_rank FROM books WHERE status = :status`,\n args: { status },\n });\n return Number((result.rows[0] as Row).next_rank);\n}\n\nexport async function listBooks(\n status: BookStatus,\n tag?: string,\n): Promise {\n const sql = tag\n ? `SELECT * FROM books WHERE status = :status AND EXISTS (\n SELECT 1 FROM json_each(books.tags) WHERE value = :tag\n ) ORDER BY ${PRIORITY_ORDER}, rank ASC`\n : `SELECT * FROM books WHERE status = :status ORDER BY ${PRIORITY_ORDER}, rank ASC`;\n const args: Record = { status };\n if (tag) args.tag = tag;\n const result = await sqlite.execute({ sql, args });\n return result.rows.map((row) => rowToBook(row as Row));\n}\n\nexport async function getBook(id: number): Promise {\n const result = await sqlite.execute({\n sql: `SELECT * FROM books WHERE id = :id`,\n args: { id },\n });\n const row = result.rows[0];\n return row ? rowToBook(row as Row) : null;\n}\n\nexport interface CreateBookInput {\n googleBooksId: string;\n status: BookStatus;\n priority: Priority;\n tags: string[];\n addedBy: string | null;\n pitch: string | null;\n}\n\n// The client only ever sends a googleBooksId + shelf metadata — title,\n// description, and the Goodreads URL are always re-resolved server-side.\n// Cover is initially resolved from Google Books too, but admins can later\n// override it via updateBook's coverUrl patch field.\nexport async function createBook(input: CreateBookInput): Promise {\n const volume = await getGoogleBookVolume(input.googleBooksId);\n if (!volume) throw new Error(\"Could not resolve book from Google Books\");\n\n const goodreadsUrl = await findGoodreadsUrl(\n volume.title,\n volume.author ?? \"\",\n volume.isbn13,\n );\n const rank = await nextRankFor(input.status);\n\n const insert = await sqlite.execute({\n sql: `INSERT INTO books (\n google_books_id, title, author, cover_url, description, isbn13,\n goodreads_url, status, priority, rank, tags, added_by, pitch\n ) VALUES (\n :googleBooksId, :title, :author, :coverUrl, :description, :isbn13,\n :goodreadsUrl, :status, :priority, :rank, :tags, :addedBy, :pitch\n )`,\n args: {\n googleBooksId: volume.googleBooksId,\n title: volume.title,\n author: volume.author,\n coverUrl: volume.coverUrl,\n description: volume.description,\n isbn13: volume.isbn13,\n goodreadsUrl,\n status: input.status,\n priority: input.priority,\n rank,\n tags: JSON.stringify(input.tags),\n addedBy: input.addedBy,\n pitch: input.pitch,\n },\n });\n\n const book = await getBook(Number(insert.lastInsertRowid));\n if (!book) throw new Error(\"Failed to load created book\");\n return book;\n}\n\nexport interface UpdateBookInput {\n status?: BookStatus;\n priority?: Priority;\n tags?: string[];\n addedBy?: string | null;\n pitch?: string | null;\n goodreadsUrl?: string | null;\n coverUrl?: string | null;\n}\n\nexport async function updateBook(\n id: number,\n patch: UpdateBookInput,\n): Promise {\n const existing = await getBook(id);\n if (!existing) return null;\n\n let goodreadsUrl = existing.goodreadsUrl;\n if (patch.goodreadsUrl !== undefined) {\n if (!patch.goodreadsUrl) {\n goodreadsUrl = null;\n } else {\n const validated = validateGoodreadsUrl(patch.goodreadsUrl);\n if (!validated) throw new Error(\"Invalid Goodreads URL\");\n goodreadsUrl = validated;\n }\n }\n\n const nextStatus = patch.status ?? existing.status;\n const rank = patch.status && patch.status !== existing.status\n ? await nextRankFor(nextStatus)\n : existing.rank;\n\n const coverUrl = patch.coverUrl !== undefined\n ? patch.coverUrl\n : existing.coverUrl;\n\n await sqlite.execute({\n sql: `UPDATE books SET\n status = :status,\n priority = :priority,\n rank = :rank,\n tags = :tags,\n added_by = :addedBy,\n pitch = :pitch,\n goodreads_url = :goodreadsUrl,\n cover_url = :coverUrl,\n updated_at = CURRENT_TIMESTAMP\n WHERE id = :id`,\n args: {\n id,\n status: nextStatus,\n priority: patch.priority ?? existing.priority,\n rank,\n tags: JSON.stringify(patch.tags ?? existing.tags),\n addedBy: patch.addedBy !== undefined ? patch.addedBy : existing.addedBy,\n pitch: patch.pitch !== undefined ? patch.pitch : existing.pitch,\n goodreadsUrl,\n coverUrl,\n },\n });\n\n return await getBook(id);\n}\n\nexport async function deleteBook(id: number): Promise {\n const result = await sqlite.execute({\n sql: `DELETE FROM books WHERE id = :id`,\n args: { id },\n });\n return result.rowsAffected > 0;\n}\n\n// Swaps rank only with the adjacent book of the same priority — crossing a\n// priority boundary is ambiguous, so the caller disables the button at ends.\nexport async function moveBook(\n id: number,\n direction: \"up\" | \"down\",\n): Promise {\n const book = await getBook(id);\n if (!book) return null;\n\n const comparator = direction === \"up\" ? \"<\" : \">\";\n const order = direction === \"up\" ? \"DESC\" : \"ASC\";\n const neighborResult = await sqlite.execute({\n sql:\n `SELECT * FROM books WHERE status = :status AND priority = :priority AND rank ${comparator} :rank\n ORDER BY rank ${order} LIMIT 1`,\n args: { status: book.status, priority: book.priority, rank: book.rank },\n });\n const neighborRow = neighborResult.rows[0];\n if (!neighborRow) return null; // already at the boundary\n\n const neighbor = rowToBook(neighborRow as Row);\n await sqlite.batch([\n {\n sql: `UPDATE books SET rank = :rank WHERE id = :id`,\n args: { rank: neighbor.rank, id: book.id },\n },\n {\n sql: `UPDATE books SET rank = :rank WHERE id = :id`,\n args: { rank: book.rank, id: neighbor.id },\n },\n ]);\n\n return await listBooks(book.status);\n}\n\nexport async function refreshGoodreads(id: number): Promise {\n const book = await getBook(id);\n if (!book) return null;\n const goodreadsUrl = await findGoodreadsUrl(\n book.title,\n book.author ?? \"\",\n book.isbn13,\n );\n await sqlite.execute({\n sql:\n `UPDATE books SET goodreads_url = :goodreadsUrl, updated_at = CURRENT_TIMESTAMP WHERE id = :id`,\n args: { goodreadsUrl, id },\n });\n return await getBook(id);\n}\n",[],[168,295],"50cf13f6-4642-42ce-b358-c61773a341f7","auth.ts","14bd3d9a-adce-11f1-a9cc-1607ee4eb77e",4,["D",1789123604788],"import type { Context, Next } from \"npm:hono\";\nimport { sqlite } from \"./db.ts\";\n\n// A shared password unlocks writes for 5 minutes at a time (single-household admin mode).\nconst SESSION_TTL_MS = 5 * 60 * 1000;\n\nasync function sha256(text: string): Promise {\n const digest = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(text),\n );\n return new Uint8Array(digest);\n}\n\n// Constant-time compare so a correct prefix can't be inferred from response timing.\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nasync function purgeExpiredSessions(): Promise {\n await sqlite.execute({\n sql: `DELETE FROM admin_sessions WHERE expires_at < :now`,\n args: { now: Date.now() },\n });\n}\n\nexport interface Session {\n token: string;\n expiresAt: number;\n}\n\nexport async function login(password: string): Promise {\n await purgeExpiredSessions();\n\n const adminPassword = Deno.env.get(\"ADMIN_PASSWORD\") ?? \"\";\n const [submitted, actual] = await Promise.all([\n sha256(password),\n sha256(adminPassword),\n ]);\n\n if (!adminPassword || !timingSafeEqual(submitted, actual)) return null;\n\n const token = crypto.randomUUID();\n const expiresAt = Date.now() + SESSION_TTL_MS;\n await sqlite.execute({\n sql:\n `INSERT INTO admin_sessions (token, expires_at) VALUES (:token, :expiresAt)`,\n args: { token, expiresAt },\n });\n return { token, expiresAt };\n}\n\nexport async function isValidSession(token: string): Promise {\n if (!token) return false;\n const result = await sqlite.execute({\n sql:\n `SELECT 1 FROM admin_sessions WHERE token = :token AND expires_at > :now`,\n args: { token, now: Date.now() },\n });\n return result.rows.length > 0;\n}\n\nfunction bearerToken(header: string | undefined): string {\n if (!header?.startsWith(\"Bearer \")) return \"\";\n return header.slice(\"Bearer \".length).trim();\n}\n\n// Hono middleware: revalidates the token against the DB on every write, no caching.\nexport async function requireAdmin(c: Context, next: Next) {\n const token = bearerToken(c.req.header(\"Authorization\"));\n if (!(await isValidSession(token))) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n await next();\n}\n",[],[168,303],"7449411e-9b2e-4af8-b5b9-cd27119254e6","pages.ts","150ae1d0-adce-11f1-bb4b-1607ee4eb77e","1492ae72-adce-11f1-9c8c-1607ee4eb77e",10,["D",1789123605295],"import { Hono } from \"npm:hono\";\nimport { getBook, listBooks } from \"../books.ts\";\nimport { BOOK_STATUSES } from \"../types.ts\";\nimport { bookListView, detailPageView } from \"../../frontend/components.ts\";\nimport { renderLayout } from \"../../frontend/layout.ts\";\n\nexport const pages = new Hono();\n\nfunction capitalize(value: string): string {\n return value.charAt(0).toUpperCase() + value.slice(1);\n}\n\npages.get(\"/\", (c) => c.redirect(\"/reading\", 302));\n\nfor (const status of BOOK_STATUSES) {\n pages.get(`/${status}`, async (c) => {\n const tag = c.req.query(\"tag\") || undefined;\n const books = await listBooks(status, tag);\n return c.html(\n renderLayout({\n title: `${capitalize(status)} — The People's Reading Club`,\n activeTab: status,\n bodyHtml: bookListView(status, books),\n }),\n );\n });\n}\n\n// A real page (not a JS-only modal) so book detail works before hydration —\n// the full-screen sheet in client.ts is progressive enhancement on top of this.\npages.get(\"/book/:id\", async (c) => {\n const id = Number(c.req.param(\"id\"));\n if (!Number.isInteger(id)) return c.notFound();\n const book = await getBook(id);\n if (!book) return c.notFound();\n return c.html(\n renderLayout({\n title: `${book.title} — The People's Reading Club`,\n activeTab: book.status,\n bodyHtml: detailPageView(book),\n }),\n );\n});\n",[],[168,319,311],"routes","5be3549c-ba78-4a21-bcdb-39d1c7455009","api.ts","14fcf99e-adce-11f1-a9cc-1607ee4eb77e",9,["D",1789123605141],"import { Hono } from \"npm:hono\";\nimport { login, requireAdmin } from \"../auth.ts\";\nimport {\n createBook,\n deleteBook,\n getBook,\n listBooks,\n moveBook,\n refreshGoodreads,\n updateBook,\n} from \"../books.ts\";\nimport { searchGoogleBooks } from \"../googleBooks.ts\";\nimport { BOOK_STATUSES, PRIORITIES } from \"../types.ts\";\nimport type { BookStatus, Priority } from \"../types.ts\";\n\nexport const api = new Hono();\n\nfunction parseId(raw: string | undefined): number | null {\n if (raw === undefined) return null;\n const id = Number(raw);\n return Number.isInteger(id) ? id : null;\n}\n\napi.post(\"/auth/login\", async (c) => {\n const body = await c.req.json().catch(() => null);\n const password = typeof body?.password === \"string\" ? body.password : \"\";\n const session = await login(password);\n if (!session) return c.json({ error: \"Invalid password\" }, 401);\n return c.json(session);\n});\n\n// Reads are public — only the three tabs and book detail, no write surface.\napi.get(\"/books\", async (c) => {\n const status = c.req.query(\"status\");\n if (!status || !BOOK_STATUSES.includes(status as BookStatus)) {\n return c.json(\n { error: \"status must be one of reading, backlog, finished\" },\n 400,\n );\n }\n const tag = c.req.query(\"tag\") || undefined;\n return c.json(await listBooks(status as BookStatus, tag));\n});\n\napi.get(\"/books/:id\", async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const book = await getBook(id);\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n});\n\n// Admin-gated proxy so the Google Books quota can't be drained by anonymous callers.\napi.get(\"/google-books/search\", requireAdmin, async (c) => {\n const q = (c.req.query(\"q\") ?? \"\").trim();\n if (!q) return c.json([]);\n return c.json(await searchGoogleBooks(q));\n});\n\napi.post(\"/books\", requireAdmin, async (c) => {\n const body = await c.req.json().catch(() => null);\n if (!body || typeof body.googleBooksId !== \"string\" || !body.googleBooksId) {\n return c.json({ error: \"googleBooksId is required\" }, 400);\n }\n if (!BOOK_STATUSES.includes(body.status)) {\n return c.json({ error: \"Invalid status\" }, 400);\n }\n if (!PRIORITIES.includes(body.priority)) {\n return c.json({ error: \"Invalid priority\" }, 400);\n }\n\n const tags = Array.isArray(body.tags)\n ? body.tags.filter((t: unknown) => typeof t === \"string\")\n : [];\n\n try {\n const book = await createBook({\n googleBooksId: body.googleBooksId,\n status: body.status as BookStatus,\n priority: body.priority as Priority,\n tags,\n addedBy: typeof body.addedBy === \"string\" ? body.addedBy : null,\n pitch: typeof body.pitch === \"string\" ? body.pitch : null,\n });\n return c.json(book, 201);\n } catch (err) {\n return c.json({ error: (err as Error).message }, 400);\n }\n});\n\napi.patch(\"/books/:id\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n\n const body = await c.req.json().catch(() => null);\n if (!body) return c.json({ error: \"Invalid body\" }, 400);\n if (body.status !== undefined && !BOOK_STATUSES.includes(body.status)) {\n return c.json({ error: \"Invalid status\" }, 400);\n }\n if (body.priority !== undefined && !PRIORITIES.includes(body.priority)) {\n return c.json({ error: \"Invalid priority\" }, 400);\n }\n\n try {\n const book = await updateBook(id, {\n status: body.status,\n priority: body.priority,\n tags: Array.isArray(body.tags)\n ? body.tags.filter((t: unknown) => typeof t === \"string\")\n : undefined,\n addedBy: body.addedBy,\n pitch: body.pitch,\n goodreadsUrl: body.goodreadsUrl,\n });\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n } catch (err) {\n return c.json({ error: (err as Error).message }, 400);\n }\n});\n\napi.delete(\"/books/:id\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const deleted = await deleteBook(id);\n if (!deleted) return c.json({ error: \"Not found\" }, 404);\n return c.json({ ok: true });\n});\n\napi.post(\"/books/:id/move\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const body = await c.req.json().catch(() => null);\n const direction = body?.direction;\n if (direction !== \"up\" && direction !== \"down\") {\n return c.json({ error: \"direction must be 'up' or 'down'\" }, 400);\n }\n const books = await moveBook(id, direction);\n if (!books) {\n return c.json({ error: \"Already at the end of this priority\" }, 409);\n }\n return c.json(books);\n});\n\napi.post(\"/books/:id/goodreads/refresh\", requireAdmin, async (c) => {\n const id = parseId(c.req.param(\"id\"));\n if (id === null) return c.json({ error: \"Invalid id\" }, 400);\n const book = await refreshGoodreads(id);\n if (!book) return c.json({ error: \"Not found\" }, 404);\n return c.json(book);\n});\n",[],[168,319,321],"aae4289d-d148-434a-9178-f2736bbe770f",["D",1789123604509],[186,187],[168,319],["D",1789123604008],[185,188,189,190,191,192,193],[168],["D",1789123298932],["D",1789560070146],{"_101":100,"_109":105},{"_101":100,"_102":103,"_104":105,"_18":56,"_106":107,"_108":25},{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"ctx",{"_83":-5,"_128":373,"_374":375,"_376":377,"_378":25,"_379":25,"_380":25,"_381":60,"_382":-5,"_383":-7,"_384":-7,"_385":64,"_386":25,"_387":25,"_388":-5,"_389":25,"_390":25,"_391":25,"_392":-5},"ENV",{"_344":345,"_346":347,"_348":91,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358,"_359":360,"_361":362,"_363":364,"_365":366,"_367":368,"_369":370,"_371":372},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v37