[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_203":204,"_205":206},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_155":-5,"_20":156,"_22":157,"_158":159,"_160":161,"_26":162,"_24":163,"_164":-5,"_165":-5,"_166":52,"_167":168,"_169":43,"_170":-5,"_171":-5,"_172":173},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","chotchkies","name","guildcalendar","branchName","main","version","path","cron.ts","project",{"_33":100,"_13":14,"_44":101,"_102":-5,"_103":52,"_104":105,"_106":105,"_107":-5,"_108":-5,"_109":110,"_111":89,"_112":43,"_113":-5,"_114":-5,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_132":133,"_134":135,"_136":137,"_138":52},"tree",[55,56,57,58,59],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","053a0776-2322-47b2-bef8-0d0ea70e2a19","fileId","3ca78ed4-a98a-11f1-9871-1607ee4eb77e","parentId","branchId","d824da79-12b4-4503-842c-a4bddb5df6f2","branchVersion",17,"latest",true,"createdAt",["D",1788830856989],3,"fileType","interval","content","import { blob } from \"https://esm.town/v/std/blob\";\nimport {\n type Fullness,\n type GuildEvent,\n parseCalendarPage,\n parseFullnessWidget,\n} from \"./parse.ts\";\nimport { fingerprint } from \"./ics.ts\";\nimport {\n nextSequence,\n putFullness,\n putSequences,\n recordFirstSeen,\n sequenceRows,\n} from \"./store.ts\";\n\nconst HOST = \"https://www.guildoforegonwoodworkers.com\";\n\n// /Main-Shop-Events-Calendar is deliberately omitted: it requires a Wild\n// Apricot login, and an anonymous request gets redirected to a login page\n// that returns HTTP 200 — so it'd silently contribute zero events forever.\n// Most of its events already appear on the Guild calendar, tagged `shop`.\nconst CALENDARS = [\n { path: \"/Guild-Calendar\", name: \"Guild\" },\n { path: \"/Education-Calendar\", name: \"Education\" },\n];\n\nconst MONTHS_BACK = 1;\nconst MONTHS_AHEAD = 6;\n\nfunction monthUrls(path: string): string[] {\n const urls: string[] = [];\n const now = new Date();\n for (let i = -MONTHS_BACK; i <= MONTHS_AHEAD; i++) {\n const d = new Date(now.getFullYear(), now.getMonth() + i, 1);\n const sel = `${d.getMonth() + 1}/1/${d.getFullYear()}`;\n urls.push(\n `${HOST}${path}?EventViewMode=1&EventListViewMode=2&SelectedDate=${\n encodeURIComponent(sel)\n }&CalendarViewType=1`,\n );\n }\n return urls;\n}\n\nconst sleep = (ms: number) => new Promise((r) => setTimeout(r, ms));\n\nexport async function scrape(): Promise {\n const seen = new Map();\n\n for (const cal of CALENDARS) {\n for (const url of monthUrls(cal.path)) {\n const res = await fetch(url, {\n headers: { \"user-agent\": \"guild-calendar-bridge (personal ics feed)\" },\n });\n if (!res.ok) throw new Error(`${res.status} fetching ${url}`);\n const html = await res.text();\n for (const ev of parseCalendarPage(html, cal.name)) {\n seen.set(`${ev.id}:${ev.start}`, ev);\n }\n await sleep(400); // be a polite guest\n }\n }\n\n return [...seen.values()].sort((a, b) => a.start.localeCompare(b.start));\n}\n\n// ---------------------------------------------------------------------------\n// Fullness\n// ---------------------------------------------------------------------------\n//\n// Whether a class is full is nowhere in the grid pages scraped above. It lives\n// in an \"Upcoming Events\" widget that only renders when EventListViewMode=1,\n// and the difference from the grid URLs is that one parameter — note that\n// everything above passes EventListViewMode=2.\n//\n// Fetched once per calendar, and the \"once\" is load-bearing. SelectedDate has\n// no effect on this widget: two different values return byte-identical bodies,\n// because it is capped by item count rather than by date. Looping months over\n// it would re-download the same 21MB eight times for nothing. The cost of that\n// cap is reach — roughly 3.5 months out, about 26 of the ~33 distinct courses.\n// Everything past the edge is \"unknown\", which is the correct answer for an\n// event the widget never described.\n\nconst WIDGET_QS = \"?EventViewMode=1&EventListViewMode=1&CalendarViewType=1\";\n\n/**\n * Deliberately not CALENDARS, and deliberately not in CALENDARS' order.\n *\n * Order: Education first. Only EDS-/EDG- classes become rows on the class\n * list, and those live on the Education calendar; its widget is also a fifth\n * the size of the Guild one (~4.5MB against ~21MB). If the budget below\n * stretches to only one of the two, it should be the one that pays for itself.\n *\n * Separate list: this is also the kill switch. If Wild Apricot grows that\n * 21MB page any further, deleting the Guild line is the whole fix — Guild\n * events go back to \"unknown\" and Education keeps working. Raising the budget\n * is the wrong lever, because the ceiling it is protecting is not ours.\n */\nconst WIDGET_CALENDARS = [\n { path: \"/Education-Calendar\", name: \"Education\" },\n { path: \"/Guild-Calendar\", name: \"Guild\" },\n];\n\n/**\n * The pages take 1.7-6.8s each in observation; 12s is roughly twice the worst\n * seen, so a timeout means something is actually wrong rather than merely\n * slow. Both numbers are sized against the val's 60s ceiling, which the scrape\n * above already spends ~12s of: two timed-out fetches cost 24s, not the rest\n * of the run. A widget that is merely slow costs its own signal and nothing\n * else, because everything that matters has already been written by then.\n */\nconst WIDGET_TIMEOUT_MS = 12_000;\nconst FULLNESS_BUDGET_MS = 26_000;\n\nasync function fetchWidget(url: string): Promise {\n const ctl = new AbortController();\n const timer = setTimeout(() => ctl.abort(), WIDGET_TIMEOUT_MS);\n try {\n const res = await fetch(url, {\n headers: { \"user-agent\": \"guild-calendar-bridge (personal ics feed)\" },\n signal: ctl.signal,\n });\n if (!res.ok) throw new Error(`${res.status} fetching ${url}`);\n return await res.text();\n } finally {\n clearTimeout(timer);\n }\n}\n\n/**\n * Never throws. Every failure below degrades one calendar's events to\n * \"unknown\" and lets the rest through, because a missing fullness signal is a\n * missing decoration and must not be able to cost a day of events.\n */\nexport async function scrapeFullness(): Promise> {\n const out: Record = {};\n const deadline = Date.now() + FULLNESS_BUDGET_MS;\n\n for (const cal of WIDGET_CALENDARS) {\n if (Date.now() >= deadline) {\n console.log(`fullness: budget spent, ${cal.name} widget skipped (stays unknown)`);\n continue;\n }\n try {\n const html = await fetchWidget(`${HOST}${cal.path}${WIDGET_QS}`);\n for (const [id, state] of Object.entries(parseFullnessWidget(html))) {\n // An id both calendars describe, differently, is a contradiction —\n // same rule as inside one widget, and for the same reason.\n out[id] = out[id] === undefined || out[id] === state ? state : \"unknown\";\n }\n } catch (e) {\n console.log(`fullness: ${cal.name} widget unavailable, those events stay unknown: ${e}`);\n }\n }\n\n return out;\n}\n\n/**\n * Fail loudly rather than quietly publishing an empty calendar.\n * The Guild runs open shop most days, so a near-empty result means\n * their markup changed, not that nothing is scheduled.\n */\nfunction check(events: GuildEvent[]) {\n const problems: string[] = [];\n if (events.length < 100) problems.push(`only ${events.length} events parsed`);\n\n const today = new Date();\n const soon = new Date(today.getTime() + 7 * 864e5);\n const fmt = (d: Date) =>\n `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, \"0\")}${\n String(d.getDate()).padStart(2, \"0\")\n }`;\n const upcoming = events.filter((e) => e.start >= fmt(today) && e.start <= fmt(soon));\n if (upcoming.length === 0) problems.push(\"no events in the next 7 days\");\n\n const located = events.filter((e) => e.location).length;\n if (located / events.length < 0.5) problems.push(\"most events missing a location\");\n\n const classes = events.filter((e) => e.courseKey).length;\n if (classes === 0) problems.push(\"no EDS/EDG classes recognised\");\n\n if (problems.length) {\n throw new Error(`calendar scrape looks wrong: ${problems.join(\"; \")}`);\n }\n}\n\nexport default async function () {\n const events = await scrape();\n check(events);\n\n // The snapshot the site actually serves goes first, and on its own. It\n // depends on nothing but the scrape that check() just approved, while\n // everything below it touches a different store and can throw for reasons\n // that have nothing to do with today's events — the sequence read reaches\n // sqlite, and through init() the legacy taken-list blob. Writing the\n // snapshot after that meant one transient error on an unrelated key cost a\n // full day of stale events. Now it costs a day of SEQUENCE bookkeeping,\n // which the next run repairs by itself.\n await blob.setJSON(\"events\", events);\n\n // Bump SEQUENCE for anything whose details changed, so clients update\n // in place instead of duplicating. The counter and the fingerprint that\n // justifies it now share one row per UID, written as one UPSERT each.\n // Reading the whole table first is safe here in a way it never was in\n // http.ts: cron is the only writer, and it runs once a day.\n const prev = await sequenceRows();\n\n const rows: { uid: string; seq: number; fingerprint: string }[] = [];\n const prints: Record = {};\n const sequences: Record = {};\n\n for (const ev of events) {\n const uid = `${ev.id}-${ev.start}@guildoforegonwoodworkers`;\n const fp = fingerprint(ev);\n const seq = nextSequence(prev[uid], fp);\n rows.push({ uid, seq, fingerprint: fp });\n prints[uid] = fp;\n sequences[uid] = seq;\n }\n\n await putSequences(rows);\n // Nothing reads these two any more. They are still written so that the\n // previous version of this val stays a working rollback target instead of\n // one that would restore day-old SEQUENCE numbers and stall every client.\n // Safe to keep only because cron is their sole writer — the same dual write\n // on the taken-list would reintroduce exactly the bug this change removes.\n await blob.setJSON(\"prints\", prints);\n await blob.setJSON(\"sequences\", sequences);\n await blob.setJSON(\"lastRun\", { at: new Date().toISOString(), count: events.length });\n\n // \"Newly posted\" can only ever mean \"newly seen\": Wild Apricot publishes no\n // posting date in the markup, so there is nothing to read and nothing to\n // backfill. This is the write that makes the badge possible, and it starts\n // meaning something from the run after the first one — the first run\n // baselines every event already on the calendar as old, in store.ts.\n //\n // Placed here, below every write above it, for the ordering reason the\n // events-snapshot comment states: this reaches sqlite, so it can throw for\n // reasons that have nothing to do with today's events, and nothing that can\n // throw may sit between the scrape and `blob.setJSON(\"events\", ...)`. If it\n // does throw, the cost is one run's worth of first-seen bookkeeping and the\n // fullness refresh below; the baseline marker is written in the same\n // statement list as the rows it certifies, so a half-finished first run is\n // simply redone rather than left half-baselined.\n await recordFirstSeen(events.map((e) => e.id));\n\n // Fullness goes last, and inside a catch, for the same reason the events\n // snapshot goes first: ordering here is a failure-containment decision, not\n // a stylistic one. This step is the slowest and least reliable thing in the\n // file — two multi-megabyte fetches against pages nobody promised us — and\n // it is also the least important. Anything above it is either what\n // subscribers read or bookkeeping that keeps their clients updating. So it\n // sits downstream of all of them, where the worst it can do is fail to\n // refresh a decoration.\n //\n // The catch is not belt-and-braces over scrapeFullness()'s own handling: it\n // covers putFullness, so a blob write that fails cannot take down a run\n // whose real work is already committed. Yesterday's snapshot then simply\n // ages out of its window and every event reads \"unknown\" until tomorrow.\n //\n // A partial result is written rather than withheld. If the Guild widget\n // timed out, its events genuinely are unknown now, and writing that is\n // honest where keeping yesterday's answer for them would not be.\n let full = 0;\n try {\n const fullness = await scrapeFullness();\n full = Object.values(fullness).filter((s) => s === \"full\").length;\n await putFullness(fullness);\n } catch (e) {\n console.log(`fullness: snapshot not refreshed, it will expire on its own: ${e}`);\n }\n\n return `${events.length} events, ${full} full`;\n}\n","deleted",false,"label",[19],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":97,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_67":98,"_18":99},{"_33":87,"_13":88,"_35":89,"_37":-5,"_38":39,"_40":90,"_42":43,"_44":91,"_17":92,"_47":93,"_49":94,"_51":52,"_53":-5,"_67":95,"_18":96},{"_33":78,"_13":79,"_35":80,"_37":-5,"_38":39,"_40":81,"_42":43,"_44":82,"_17":83,"_47":65,"_49":84,"_51":52,"_53":-5,"_67":85,"_18":86},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":46,"_47":65,"_49":75,"_51":52,"_53":-5,"_67":76,"_18":77},{"_33":60,"_13":61,"_35":62,"_37":-5,"_38":39,"_40":63,"_42":43,"_44":64,"_17":46,"_47":65,"_49":66,"_51":52,"_53":-5,"_67":68,"_18":69},"7742d344-7ef6-4cb2-adbf-7cc4bf41e552","store.ts","df88630e-a9de-11f1-85b6-1607ee4eb77e",20,["D",1788882912455],"script","// Storage for the two things concurrent HTTP requests mutate.\n//\n// The scraped events snapshot stays in blob storage on purpose: cron.ts is its\n// only writer and it replaces the whole document every time, which is exactly\n// what an object store is good at. The taken-list and the SEQUENCE map are a\n// different problem. Both were read-whole, modified in memory and written back,\n// and an object store has no atomic update and no transaction — so two HTTP\n// requests that overlap silently discard one of the two writes. That happened\n// in production: a click was overwritten by a later write, and a key that had\n// been removed came back. It is a property of the primitive, not an ordering\n// bug, so those two moved here. A hide is one INSERT, an unhide is one DELETE,\n// and a sequence bump is one UPSERT — no read-modify-write anywhere.\n//\n// Account-scoped sqlite, not val-scoped (`.../sqlite/main.ts`), for one\n// reason: cron.ts and http.ts must see the same rows, and account scope is\n// true whether those two files are one val or two. It is also the same scope\n// the blob store already has, so nothing about who-can-see-what changes. The\n// docs call account scope legacy but promise it keeps working; switching to\n// val scope later is the single import line below plus nothing else, because\n// row decoding is shape-agnostic (see `col`).\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport type { Fullness } from \"./parse.ts\";\n\n// Namespaced: the account-scoped database is shared with every other val on\n// the account, so \"taken\" or \"sequences\" would be a collision waiting to\n// happen.\nconst TAKEN = \"guild_taken\";\nconst SEQ = \"guild_sequences\";\nconst META = \"guild_meta\";\nconst FIRST_SEEN = \"guild_first_seen\";\nconst SESSIONS = \"guild_sessions\";\n\n/**\n * The whole point of the migration, spelled out so it cannot drift: hiding a\n * class touches one row and reads nothing first, so two overlapping requests\n * cannot lose one another. OR IGNORE makes a double-submit a no-op rather than\n * an error.\n */\nexport const HIDE_SQL = `INSERT OR IGNORE INTO ${TAKEN} (course_key) VALUES (?)`;\nexport const UNHIDE_SQL = `DELETE FROM ${TAKEN} WHERE course_key = ?`;\n\n/**\n * Account-scoped sqlite returns each row as an array; val-scoped returns an\n * object keyed by column name. Reading both means the import at the top of\n * this file can change without turning every column read into a silent\n * `undefined`.\n */\nexport function col(row: unknown, name: string, index: number): unknown {\n return Array.isArray(row) ? row[index] : (row as Record)[name];\n}\n\n/**\n * Turso can hand integers back as BigInt depending on client config, and both\n * a BigInt and a numeric string coerce cleanly. Anything that does not is a\n * row shape `col` did not understand — a libsql protocol wrapper such as\n * `{type:\"integer\",value:\"4\"}` coerces to NaN. Defaulting to 0 there would map\n * every uid to zero, look like a successful read, and publish `SEQUENCE:0` on\n * every event in /all.ics, which is not a missing update but a poisoned one:\n * subscribers that already hold a higher number ignore every future change.\n * Throwing hands http.ts the 503 it already has for an unreadable store.\n */\nexport function int(v: unknown): number {\n const n = Number(v);\n if (!Number.isFinite(n)) {\n throw new Error(`sequence store returned a non-numeric value (${typeof v})`);\n }\n return n;\n}\n\n/**\n * The same failure one table over, and a worse one, because it cannot even\n * fail loudly on its own: `String(row)` on a shape `col` did not understand\n * yields \"[object Object]\" or \"undefined\", which matches no course key, so\n * /new.ics answers 200 with every hidden class restored and looks exactly like\n * a correct feed. A key that is not a non-empty string is not a key. Exported\n * so the check is testable without a database.\n */\nexport function courseKeyOf(row: unknown): string {\n const v = col(row, \"course_key\", 0);\n if (typeof v !== \"string\" || !v.trim()) {\n throw new Error(`taken-list row did not decode to a course key (${typeof v})`);\n }\n return v;\n}\n\ntype Stmt = { sql: string; args: unknown[] };\n\n/**\n * A daily scrape is several hundred rows and one giant batch is a bad idea.\n * Splitting it costs the all-or-nothing guarantee across chunks, which is fine\n * here: every statement is idempotent, every import insert re-checks the\n * marker inside the statement (see IMPORT_TAKEN_SQL), and the marker rides in\n * the same list as the rows it certifies — so a half-finished import is simply\n * redone, and a marker can never be reached without the rows before it.\n */\nasync function chunked(stmts: Stmt[], size = 200): Promise {\n for (let i = 0; i < stmts.length; i += size) {\n await sqlite.batch(stmts.slice(i, i + size));\n }\n}\n\n// ---------------------------------------------------------------------------\n// Legacy import — pure halves, so they are testable without a database.\n// ---------------------------------------------------------------------------\n\n/**\n * Faithful, deliberately not clever. The live list is known to be wrong (it\n * holds a class the owner never chose and is missing one he did), and it is\n * still not this function's job to have an opinion — he clears it through the\n * app after deploying. Only values that could never have been a course key at\n * all are dropped: non-strings, blanks, and exact duplicates.\n *\n * Absent and unreadable are different answers and must stay different. A\n * missing blob key means there is nothing to import and the step is genuinely\n * done. A value that is present but not a list — `{\"keys\":[...]}`, a bare\n * string from a partial write — means the list exists and we failed to read\n * it; returning `[]` there would import nothing, let the caller mark the step\n * complete, and make the list unrecoverable. So that case throws and the\n * import is retried instead. A JSON `null` counts as absent: `getJSON` gives\n * `undefined` for a missing key, but a store that answered `null` instead\n * would otherwise wedge a fresh val at a permanent 503, and no truncated\n * array parses to `null` anyway.\n */\nexport function normalizeTaken(raw: unknown): string[] {\n if (raw == null) return [];\n if (!Array.isArray(raw)) {\n throw new Error(\n `legacy taken-list is present but not an array (${typeof raw}); ` +\n `refusing to mark the import done over a list that may still exist`,\n );\n }\n const out: string[] = [];\n for (const v of raw) {\n if (typeof v !== \"string\") continue;\n const key = v.trim();\n if (key && !out.includes(key)) out.push(key);\n }\n return out;\n}\n\n/** Same absent-versus-unreadable rule as `normalizeTaken`, same reason. */\nexport function normalizeSequences(raw: unknown): Record {\n const out: Record = {};\n if (raw == null) return out;\n if (typeof raw !== \"object\" || Array.isArray(raw)) {\n throw new Error(\n `legacy sequence map is present but not an object (${typeof raw}); ` +\n `refusing to mark the import done`,\n );\n }\n for (const [uid, v] of Object.entries(raw as Record)) {\n const n = Number(v);\n if (uid && Number.isFinite(n) && n >= 0) out[uid] = Math.floor(n);\n }\n return out;\n}\n\nexport function normalizePrints(raw: unknown): Record {\n const out: Record = {};\n if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return out;\n for (const [uid, v] of Object.entries(raw as Record)) {\n if (uid && typeof v === \"string\") out[uid] = v;\n }\n return out;\n}\n\n// ---------------------------------------------------------------------------\n// Schema + one-time import\n// ---------------------------------------------------------------------------\n\n/** Resolved once per isolate; concurrent callers await the same promise. */\nlet initialised: Promise | null = null;\n\n/**\n * Called by every exported operation, so a fresh val or a new branch builds\n * its own schema on first use with no manual setup step. On failure the cached\n * promise is dropped so the next request retries rather than inheriting a\n * permanently poisoned isolate.\n */\nexport function init(): Promise {\n if (!initialised) {\n initialised = (async () => {\n await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS ${TAKEN} (course_key TEXT PRIMARY KEY)`,\n `CREATE TABLE IF NOT EXISTS ${SEQ} (\n uid TEXT PRIMARY KEY,\n seq INTEGER NOT NULL DEFAULT 0,\n fingerprint TEXT\n )`,\n `CREATE TABLE IF NOT EXISTS ${META} (key TEXT PRIMARY KEY, value TEXT NOT NULL)`,\n `CREATE TABLE IF NOT EXISTS ${FIRST_SEEN} (\n event_id TEXT PRIMARY KEY,\n first_seen TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS ${SESSIONS} (\n id TEXT PRIMARY KEY,\n expires_at TEXT NOT NULL\n )`,\n ]);\n await importLegacy();\n })().catch((e) => {\n initialised = null;\n throw e;\n });\n }\n return initialised;\n}\n\nconst TAKEN_STEP = \"taken:imported\";\nconst SEQ_STEP = \"sequences:imported\";\n\nasync function imported(step: string): Promise {\n const r = await sqlite.execute({ sql: `SELECT 1 FROM ${META} WHERE key = ?`, args: [step] });\n return r.rows.length > 0;\n}\n\n/**\n * The import inserts, unlike HIDE_SQL, re-check the marker *inside* the\n * statement, and that is the whole point of them.\n *\n * `imported()` and the inserts are separate round trips, so two isolates that\n * cold-start at the same moment can both see no marker. The second one's insert\n * then lands after the first has already imported, written the marker, and\n * served the owner's DELETE — resurrecting a key he just removed. That is the\n * original production bug wearing a different hat, and no amount of batching\n * alone fixes it, because a transaction that never re-reads the marker will\n * happily re-insert rows a committed transaction already retired.\n *\n * Gating each insert on the marker turns the loser of that race into a no-op\n * the instant the winner commits, and appending the marker to the same\n * statement list means the marker is never written ahead of the rows it\n * certifies. The marker, not table-emptiness, remains the gate: nothing here\n * looks at a row count, so the list the owner clears right after deploying\n * stays cleared, including across a cold start.\n */\nexport const IMPORT_TAKEN_SQL = `INSERT OR IGNORE INTO ${TAKEN} (course_key)\n SELECT ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\nexport const IMPORT_SEQ_SQL = `INSERT OR IGNORE INTO ${SEQ} (uid, seq, fingerprint)\n SELECT ?, ?, ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\nfunction markStmt(step: string): Stmt {\n return {\n sql: `INSERT OR IGNORE INTO ${META} (key, value) VALUES (?, ?)`,\n args: [step, new Date().toISOString()],\n };\n}\n\n/**\n * The marker, not row-emptiness, is what decides this. That distinction is\n * load-bearing: the owner intends to clear the bad list through the app right\n * after deploying, and an emptiness test would read that empty table on the\n * very next request and helpfully restore every entry he just deleted.\n *\n * A blob read that *throws* is a different thing from a blob key that is\n * absent. Absent means there is nothing to import and the step is done. A\n * throw means we do not know, so it propagates: the caller turns it into a\n * 503 and the step is retried next time, rather than marking an empty import\n * as complete and losing the list. A value that is present but not the shape\n * we expect is the third case and behaves like the throw, not like the absent\n * one — see `normalizeTaken`.\n *\n * The marker is never written on its own: it is the last statement of the same\n * list as the rows it certifies, and each of those rows re-checks it, so the\n * check and the write cannot be interleaved by a second isolate.\n */\nasync function importLegacy(): Promise {\n if (!(await imported(TAKEN_STEP))) {\n let raw: unknown;\n try {\n raw = await blob.getJSON(\"taken\");\n } catch (e) {\n throw new Error(`legacy taken-list read failed, import not attempted: ${e}`);\n }\n // Throws on a present-but-unreadable value, before a single statement\n // runs, so no marker is ever written over a list we could not parse.\n const keys = normalizeTaken(raw);\n await chunked([\n ...keys.map((key) => ({ sql: IMPORT_TAKEN_SQL, args: [key, TAKEN_STEP] })),\n markStmt(TAKEN_STEP),\n ]);\n }\n\n if (!(await imported(SEQ_STEP))) {\n let seqRaw: unknown;\n let printRaw: unknown;\n try {\n seqRaw = await blob.getJSON(\"sequences\");\n printRaw = await blob.getJSON(\"prints\");\n } catch (e) {\n throw new Error(`legacy sequence read failed, import not attempted: ${e}`);\n }\n const seqs = normalizeSequences(seqRaw);\n const prints = normalizePrints(printRaw);\n const uids = [...new Set([...Object.keys(seqs), ...Object.keys(prints)])];\n await chunked([\n ...uids.map((uid) => ({\n sql: IMPORT_SEQ_SQL,\n args: [uid, seqs[uid] ?? 0, prints[uid] ?? null, SEQ_STEP],\n })),\n markStmt(SEQ_STEP),\n ]);\n }\n}\n\n// ---------------------------------------------------------------------------\n// Taken list\n// ---------------------------------------------------------------------------\n\nexport async function takenKeys(): Promise {\n await init();\n const r = await sqlite.execute(`SELECT course_key FROM ${TAKEN} ORDER BY course_key`);\n return (r.rows as unknown[]).map(courseKeyOf);\n}\n\nexport async function hide(key: string): Promise {\n await init();\n await sqlite.execute({ sql: HIDE_SQL, args: [key] });\n}\n\nexport async function unhide(key: string): Promise {\n await init();\n await sqlite.execute({ sql: UNHIDE_SQL, args: [key] });\n}\n\n/**\n * Only future offerings of a finished class are dropped. Past events stay, so\n * the calendar remains a record of what you actually did.\n */\nexport function filterTaken(\n events: T[],\n done: string[],\n today: string,\n): T[] {\n const hidden = new Set(done);\n return events.filter((e) => !(e.courseKey && hidden.has(e.courseKey) && e.start >= today));\n}\n\n// ---------------------------------------------------------------------------\n// SEQUENCE map\n// ---------------------------------------------------------------------------\n\nexport interface SeqRow {\n seq: number;\n fingerprint: string | null;\n}\n\n/**\n * Read side for /all.ics and /new.ics: just uid -> seq.\n *\n * An empty table is a valid answer here, not an error, and is deliberately not\n * gated. It occurs in exactly one situation: a val that has never completed a\n * cron run and had no legacy sequences to import — and there `SEQUENCE:0` is\n * the true answer, because no subscriber has ever been handed a higher number\n * for these UIDs. Every other route to an empty read is already covered: a row\n * shape that cannot be decoded throws (see `int`) and http.ts answers 503, a\n * failed `putSequences` leaves yesterday's rows in place rather than none, a\n * legacy blob that cannot be parsed refuses to mark itself imported, and\n * nothing in this file ever deletes from the table. Gating the feed on a\n * non-empty table would trade that correct zero for a 503 on every fresh val\n * until the first nightly scrape lands, which is the worse failure.\n */\nexport async function sequenceMap(): Promise> {\n await init();\n const r = await sqlite.execute(`SELECT uid, seq FROM ${SEQ}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n out[String(col(row, \"uid\", 0))] = int(col(row, \"seq\", 1));\n }\n return out;\n}\n\n/** Read side for cron: it needs the stored fingerprint to decide on a bump. */\nexport async function sequenceRows(): Promise> {\n await init();\n const r = await sqlite.execute(`SELECT uid, seq, fingerprint FROM ${SEQ}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n const fp = col(row, \"fingerprint\", 2);\n out[String(col(row, \"uid\", 0))] = {\n seq: int(col(row, \"seq\", 1)),\n fingerprint: fp == null ? null : String(fp),\n };\n }\n return out;\n}\n\n/**\n * Unchanged rule, moved out of cron.ts so it can be tested: bump only when we\n * have a previous fingerprint and it differs. A UID we have never seen, or one\n * stored before fingerprints were kept, starts where it is.\n */\nexport function nextSequence(prev: SeqRow | undefined, fingerprint: string): number {\n const seq = prev?.seq ?? 0;\n const was = prev?.fingerprint;\n return was && was !== fingerprint ? seq + 1 : seq;\n}\n\nexport async function putSequences(\n entries: { uid: string; seq: number; fingerprint: string }[],\n): Promise {\n await init();\n await chunked(entries.map((e) => ({\n sql: `INSERT INTO ${SEQ} (uid, seq, fingerprint) VALUES (?, ?, ?)\n ON CONFLICT(uid) DO UPDATE SET seq = excluded.seq, fingerprint = excluded.fingerprint`,\n args: [e.uid, e.seq, e.fingerprint],\n })));\n}\n\n// ---------------------------------------------------------------------------\n// Fullness snapshot\n// ---------------------------------------------------------------------------\n//\n// Blob, not a sqlite table, and a separate key rather than a field on each\n// event. Three reasons, in order of weight:\n//\n// 1. The migration at the top of this file was not about sqlite being nicer.\n// It was about read-modify-write: two overlapping HTTP requests editing one\n// JSON document silently discard one of the writes. Fullness has no HTTP\n// mutation path at all — no request ever writes it. cron.ts is the sole\n// writer and it replaces the entire document every run, which is the exact\n// shape the header of this file already calls out as correct for blob.\n// Putting it in sqlite would import the ceremony without the reason.\n// 2. A separate key keeps the `events` document byte-for-byte what it is\n// today. Folding a field into every event would rewrite the one document\n// http.ts's 503 semantics and the previous version's rollback both depend\n// on, to carry data that changes on a different schedule and matters less.\n// 3. Reading it must never be able to fail the page. A sqlite read goes\n// through init(), which builds schema and can reach the legacy taken-list\n// blob — so a fullness read would inherit failure modes belonging to\n// hiding classes. readFullness() deliberately calls neither.\n//\n// The snapshot carries its own fetched-at because a stale answer here is worse\n// than no answer: \"FULL\" on a class that opened up last night sends the owner\n// to a waitlist he does not need, and nothing on the page would show that the\n// claim is a day old. Past its window it is dropped and every event reads\n// \"unknown\", which renders exactly as the page did before this existed.\n\nconst FULLNESS_KEY = \"guild_fullness\";\n\n/**\n * Cron runs daily, so a healthy snapshot is always under 24h old. 26 gives a\n * late or slow run two hours of slack while still expiring one *missed* run\n * rather than showing yesterday's answer as if it were today's.\n */\nexport const FULLNESS_MAX_AGE_MS = 26 * 60 * 60 * 1000;\n\nexport interface FullnessSnapshot {\n fetchedAt: string;\n states: Record;\n}\n\nexport async function putFullness(states: Record): Promise {\n const snap: FullnessSnapshot = { fetchedAt: new Date().toISOString(), states };\n await blob.setJSON(FULLNESS_KEY, snap);\n}\n\n/**\n * The pure half, so the expiry and the shape checks are testable without a\n * store. Unlike normalizeTaken and normalizeSequences, this NEVER throws, and\n * the difference is deliberate rather than an oversight.\n *\n * Those two guard data that cannot be re-derived: refusing to read a garbled\n * taken-list is what stops an import from marking itself done and losing the\n * owner's choices for good. This document is regenerated in full by the next\n * cron run and holds nothing a user typed. Every failure it can have — absent,\n * wrong shape, undatable, expired, junk values — has the same correct answer,\n * which is \"we do not know\", and \"we do not know\" is a state this feature is\n * built to render. Throwing would convert a missing decoration into a 503 on\n * the class list.\n *\n * A timestamp in the future is treated as unusable rather than as\n * indefinitely fresh, so a clock skew cannot pin a stale snapshot open.\n */\nexport function normalizeFullness(raw: unknown, now: number): Record {\n const out: Record = {};\n if (!raw || typeof raw !== \"object\" || Array.isArray(raw)) return out;\n\n const snap = raw as Partial;\n const at = Date.parse(String(snap.fetchedAt ?? \"\"));\n if (!Number.isFinite(at)) return out;\n if (now - at > FULLNESS_MAX_AGE_MS) return out;\n if (at - now > 60 * 60 * 1000) return out;\n\n const states = snap.states;\n if (!states || typeof states !== \"object\" || Array.isArray(states)) return out;\n for (const [id, v] of Object.entries(states as Record)) {\n // A stored \"unknown\" is dropped rather than kept: absent already means\n // unknown, and one spelling of it is enough.\n if (/^\\d+$/.test(id) && (v === \"full\" || v === \"open\")) out[id] = v;\n }\n return out;\n}\n\n/**\n * Never throws, never 503s, never calls init(). An empty map is a complete and\n * honest answer meaning every event is \"unknown\".\n */\nexport async function readFullness(): Promise> {\n try {\n return normalizeFullness(await blob.getJSON(FULLNESS_KEY), Date.now());\n } catch {\n return {};\n }\n}\n\n// ---------------------------------------------------------------------------\n// First-seen — \"what is newly posted\"\n// ---------------------------------------------------------------------------\n//\n// Wild Apricot publishes no posting date anywhere in the markup, so there is\n// nothing to scrape and nothing to backfill. The only thing that can be known\n// is when WE first saw an event, which means this is a going-forward record\n// and the day it starts is the day it becomes meaningful.\n//\n// sqlite, not blob, and for the reason at the top of this file rather than by\n// habit: this is an accumulating set that must never lose an entry, and the\n// write is \"insert the ones I have not got\" — one INSERT OR IGNORE per id,\n// no read-modify-write. A blob would be read whole, edited and written back,\n// which is the exact shape that already cost a click in production. cron is\n// the only writer today, but the primitive should not be the thing standing\n// between us and a second one.\n//\n// KEYED ON THE EVENT ID ALONE, not on the `${id}:${start}` pair the scrape\n// dedups with. Those are two different identities and the difference is\n// visible in the live data: 12 of 206 ids on the Sep-Dec grid carry more than\n// one start, because a multi-session class is one Wild Apricot event posted\n// once and drawn on several days (event-6756661 sits on 01, 08 and 15 Sep).\n// The id is the posting; the pair is one occurrence of it. Keying on the pair\n// would mint a brand-new key every time the Guild moved a session by a day,\n// and the class would badge itself \"new\" again on a reschedule — which is\n// precisely the thing this feature must not do. Keying on the id, a moved\n// session keeps the date its posting was first seen, and a genuinely new\n// posting gets a genuinely new row.\n\n/** Marker key in the meta table, same table and same discipline as the two imports. */\nconst BASELINE_STEP = \"firstSeen:baselined\";\n\n/** The steady-state write: remember the ones we have not got, touch nothing else. */\nexport const FIRST_SEEN_SQL =\n `INSERT OR IGNORE INTO ${FIRST_SEEN} (event_id, first_seen) VALUES (?, ?)`;\n\n/**\n * The first-run write, marker-gated inside the statement for exactly the\n * reason IMPORT_TAKEN_SQL is — see the long comment there, it applies verbatim.\n * `imported()` and the inserts are separate round trips, so two isolates can\n * both see no marker; gating each insert on the marker turns the loser into a\n * no-op the instant the winner commits, and the marker is appended to the same\n * statement list as the rows it certifies so it can never be reached ahead of\n * them.\n */\nexport const BASELINE_FIRST_SEEN_SQL =\n `INSERT OR IGNORE INTO ${FIRST_SEEN} (event_id, first_seen)\n SELECT ?, ? WHERE NOT EXISTS (SELECT 1 FROM ${META} WHERE key = ?)`;\n\n/**\n * The stamp every event already on the calendar gets on the first run after\n * deploy. The Unix epoch, deliberately, rather than \"now minus the window\":\n * it is outside any window anyone could later choose, so widening NEW_WINDOW_MS\n * from 7 days to 30 cannot retroactively light up all ~330 baselined events.\n * It is also the honest value — we do not know when these were posted, only\n * that it was before we started looking — and it never reaches the page,\n * because `isNewSince` rejects it long before anything formats a date.\n */\nexport const BASELINE_STAMP = new Date(0).toISOString();\n\n/**\n * Seven days. Cron runs daily, so a badge survives about seven sightings: long\n * enough that the owner can miss a few days and still see what arrived, short\n * enough that \"new\" keeps meaning new. Nothing else depends on the number —\n * it is one constant read by one pure function.\n */\nexport const NEW_WINDOW_MS = 7 * 24 * 60 * 60 * 1000;\n\n/**\n * Called by cron after the events snapshot is already committed. Idempotent:\n * re-running it the same day writes nothing, because every id it would insert\n * is already there.\n */\nexport async function recordFirstSeen(ids: string[], now: Date = new Date()): Promise {\n await init();\n\n const unique: string[] = [];\n const seen = new Set();\n for (const id of ids) {\n const key = String(id).trim();\n if (key && !seen.has(key)) {\n seen.add(key);\n unique.push(key);\n }\n }\n\n // First run after deploy. Everything currently on the calendar is recorded\n // as having been there all along, so the badge means something only from the\n // NEXT run onward. Without this the feature would announce all ~330 existing\n // events as new on day one, which is the one output that would teach the\n // owner to ignore it.\n if (!(await imported(BASELINE_STEP))) {\n await chunked([\n ...unique.map((id) => ({\n sql: BASELINE_FIRST_SEEN_SQL,\n args: [id, BASELINE_STAMP, BASELINE_STEP],\n })),\n markStmt(BASELINE_STEP),\n ]);\n return;\n }\n\n const at = now.toISOString();\n await chunked(unique.map((id) => ({ sql: FIRST_SEEN_SQL, args: [id, at] })));\n}\n\n/**\n * Never throws, and the reason is narrower than readFullness's.\n *\n * This one does go through init(), so it can fail the way the taken-list read\n * fails. It is still not a fourth member of http.ts's 503 set, because on the\n * page that reads it the taken-list read has already run and already 503'd if\n * sqlite was unreachable — by the time this is called, the store has answered\n * once. What is left is a failure of this table alone, and its correct answer\n * is \"nothing is known to be new\", which renders exactly as the page rendered\n * before this feature existed. Taking the class list down over a missing badge\n * would be the regression.\n */\nexport async function readFirstSeen(): Promise> {\n try {\n await init();\n const r = await sqlite.execute(`SELECT event_id, first_seen FROM ${FIRST_SEEN}`);\n const out: Record = {};\n for (const row of r.rows as unknown[]) {\n const id = col(row, \"event_id\", 0);\n const at = col(row, \"first_seen\", 1);\n // A row that does not decode to two strings is dropped, not guessed at.\n // Unlike the sequence map there is nothing to poison here: a dropped row\n // is one course that does not get a badge.\n if (typeof id === \"string\" && id && typeof at === \"string\" && at) out[id] = at;\n }\n return out;\n } catch {\n return {};\n }\n}\n\n/**\n * The earliest first-seen across a course's occurrences, or null if none of\n * them is recorded yet.\n *\n * Earliest, not latest: a course is new when the course is new. A long-running\n * class that posts a fresh cohort has occurrences we first saw months ago, so\n * its earliest stays old and the row stays unbadged — the cohort is new, the\n * course is not. ISO-8601 strings compare correctly with `<`, so no parsing.\n */\nexport function earliestFirstSeen(\n map: Record,\n ids: string[],\n): string | null {\n let best: string | null = null;\n for (const id of ids) {\n const at = map[id];\n if (!at) continue;\n if (best === null || at < best) best = at;\n }\n return best;\n}\n\n/**\n * Pure, so the window is testable without a clock or a database. A stamp that\n * does not parse, or one from the future, is not new — same posture as the\n * fullness snapshot: an unusable timestamp must not be able to pin a badge on.\n */\nexport function isNewSince(at: string | null, now: number): boolean {\n if (!at) return false;\n const t = Date.parse(at);\n if (!Number.isFinite(t)) return false;\n if (t > now) return false;\n return now - t <= NEW_WINDOW_MS;\n}\n\n// ---------------------------------------------------------------------------\n// Admin sessions\n// ---------------------------------------------------------------------------\n//\n// The cookie used to BE the password: login set `guild_auth=` and\n// the check string-compared the cookie back against the env var. So every copy\n// of the cookie was a copy of the secret — a curl cookie jar, a devtools\n// panel, a screenshot. Two of those leaked during testing, and each one forced\n// a rotation of GUILD_TOKEN, which logs the owner out of every device at once\n// because there was nothing else to revoke.\n//\n// A session id fixes both halves. It is minted at random, so it discloses\n// nothing about the secret and cannot be worked backwards into it; and it is a\n// row, so revoking one device is a DELETE rather than a rotation.\n//\n// sqlite rather than blob, for the reason at the top of this file rather than\n// by habit: every write here is one row and reads nothing first — a login is\n// one INSERT, a logout one DELETE, the sweep one DELETE. Two overlapping\n// logins cannot lose one another the way two overlapping clicks once lost a\n// hide.\n\n/**\n * 32 bytes of CSPRNG output rendered as 64 lowercase hex characters.\n *\n * `crypto.getRandomValues`, never `Math.random()`: Math.random is seeded state\n * that an observer of one output can often continue, which is not what this\n * value has to survive. 256 bits is far past guessable, and hex keeps the id\n * inside the cookie-value grammar, so nothing has to percent-encode it on the\n * way out or decode it on the way back in — one less place for a value to\n * change shape between being set and being looked up.\n *\n * Nothing here reads GUILD_TOKEN, hashes it, or seeds anything from it. The id\n * is independent of the secret, which is the point: holding a session id must\n * not put anyone one step closer to the password.\n */\nexport function newSessionId(): string {\n const bytes = new Uint8Array(32);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Cheap shape gate, so a cookie left over from the old scheme — or any other\n * junk a client sends — is rejected without a round trip. It is a\n * convenience, not the security boundary: the lookup is what authenticates,\n * and a well-formed id that is not in the table is exactly as unauthenticated\n * as a malformed one.\n */\nexport function isSessionId(v: unknown): v is string {\n return typeof v === \"string\" && /^[0-9a-f]{64}$/.test(v);\n}\n\n/**\n * One year, chosen to match the cookie's existing `Max-Age=31536000` exactly\n * rather than to be interesting. The owner's experience is unchanged: he logs\n * in once and stays logged in for a year. What is new is that the year is now\n * enforced on the server as well, so a cookie that outlives its row — copied,\n * restored from a browser backup, held by a client that ignores Max-Age —\n * stops working on schedule instead of never.\n */\nexport const SESSION_TTL_MS = 31536000 * 1000;\n\n/** The same number in the unit `Set-Cookie` wants, so the two cannot drift. */\nexport const SESSION_MAX_AGE_S = 31536000;\n\n/**\n * One row, nothing read first — the discipline HIDE_SQL is written to, for the\n * same reason. A plain INSERT rather than INSERT OR IGNORE: a collision on a\n * 256-bit random id is not a double-submit to be absorbed quietly, it is\n * something that cannot happen, and ignoring it would hand the caller a cookie\n * for a session row it does not own.\n */\nexport const SESSION_INSERT_SQL = `INSERT INTO ${SESSIONS} (id, expires_at) VALUES (?, ?)`;\n\n/** By primary key, so it is an index seek no matter how large the table gets. */\nexport const SESSION_SELECT_SQL = `SELECT expires_at FROM ${SESSIONS} WHERE id = ?`;\n\n/** The revocation path the old design had no way to express at all. */\nexport const SESSION_DELETE_SQL = `DELETE FROM ${SESSIONS} WHERE id = ?`;\n\n/**\n * Opportunistic cleanup, batched with a login. Deliberately not a cron job:\n * expired rows are already refused by the read path, so this is housekeeping\n * rather than a correctness requirement, and a table that gains one row per\n * login does not need a scheduled sweeper.\n *\n * `<=` rather than `<`, matching `sessionLive`, which requires the expiry to\n * be strictly in the future — so a row expiring exactly now is swept, not kept\n * for one more instant.\n */\nexport const SESSION_SWEEP_SQL = `DELETE FROM ${SESSIONS} WHERE expires_at <= ?`;\n\n/**\n * The throwing validator for this table, exactly parallel to `courseKeyOf`,\n * and throwing for a sharper reason than that one.\n *\n * A row shape `col` did not understand yields `undefined` or an object here.\n * Any \"treat an unreadable expiry as fine\" default is a silent auth bypass —\n * the one failure mode this whole change exists to remove — and even a\n * \"treat it as expired\" default would quietly log the owner out on a client\n * upgrade that changed the row shape, hiding the real fault. So an expiry that\n * is not a non-empty string is not an expiry, and the throw becomes the 503\n * http.ts already has for a store it cannot read.\n */\nexport function sessionExpiryOf(row: unknown): string {\n const v = col(row, \"expires_at\", 0);\n if (typeof v !== \"string\" || !v.trim()) {\n throw new Error(`session row did not decode to an expiry (${typeof v})`);\n }\n return v;\n}\n\n/**\n * Pure, so the expiry comparison is testable without a database or a clock.\n *\n * An undatable stamp is NOT live — the same posture `isNewSince` and\n * `normalizeFullness` take toward a timestamp they cannot read. There the cost\n * of guessing was a wrong badge; here it would be a session that never\n * expires, so the rule matters more, not less. Strictly greater than: a\n * session whose expiry is this instant has expired.\n */\nexport function sessionLive(expiresAt: string, now: number): boolean {\n const t = Date.parse(expiresAt);\n if (!Number.isFinite(t)) return false;\n return t > now;\n}\n\n/**\n * Mints the id, sweeps what has expired and stores the new row — sweep and\n * insert in one batch, so a login costs one round trip rather than two.\n *\n * Returns the id, which is the only value that ever reaches the cookie.\n * GUILD_TOKEN is not a parameter of this function and is not reachable from\n * it; store.ts does not read the environment at all.\n */\nexport async function createSession(now: Date = new Date()): Promise {\n await init();\n const id = newSessionId();\n const at = now.getTime();\n await sqlite.batch([\n { sql: SESSION_SWEEP_SQL, args: [new Date(at).toISOString()] },\n { sql: SESSION_INSERT_SQL, args: [id, new Date(at + SESSION_TTL_MS).toISOString()] },\n ]);\n return id;\n}\n\n/**\n * The authentication check. Every path out of it is `false` or a throw: there\n * is no cookie value and no row shape that returns true without a matching,\n * unexpired row having actually come back from sqlite.\n *\n * It does not throw on \"no such session\" — an unknown id is a normal, expected\n * answer meaning not logged in. It throws only when the store could not be\n * read or a row would not decode, and the caller turns that into a 503. That\n * is the fail-closed contract: unreadable is never authenticated.\n *\n * A cookie left over from the old raw-secret scheme arrives here as an unknown\n * id and is refused by the shape gate before a query is even sent. There is\n * deliberately no comparison against GUILD_TOKEN on this path: a compatibility\n * fallback that still accepted the raw secret from a cookie would preserve the\n * exact hole being closed.\n */\nexport async function sessionValid(id: unknown, now: Date = new Date()): Promise {\n if (!isSessionId(id)) return false;\n await init();\n const r = await sqlite.execute({ sql: SESSION_SELECT_SQL, args: [id] });\n if (r.rows.length === 0) return false;\n return sessionLive(sessionExpiryOf(r.rows[0]), now.getTime());\n}\n\n/**\n * Logout. One row, by id, and it has to actually run: clearing the cookie\n * alone — which is all the old logout did — leaves the value replayable by\n * anyone holding a copy, and on the old scheme that meant leaving the password\n * live. A caller that cannot complete this must not report a successful\n * logout.\n */\nexport async function destroySession(id: unknown): Promise {\n if (!isSessionId(id)) return;\n await init();\n await sqlite.execute({ sql: SESSION_DELETE_SQL, args: [id] });\n}\n","children",[],[61],"277194de-c412-41c5-b05b-6093be4b50f9","parse.ts","3c0d9964-a98a-11f1-b3ec-1607ee4eb77e",15,["D",1788830855526],"// Parses Guild of Oregon Woodworkers calendar pages (Wild Apricot).\n//\n// The grid markup gives us everything we need inside each event anchor's\n// `title` attribute. Observed shapes:\n//\n// n[9:00 AM]26 Jul 2026, 9:00 AM 1:00 PM\n// Guild Workshop, 7634 SW 34th Ave, Portland, OR 97219\n//\n// y[5:30 PM]1 of 5\n// 27 Jul 2026, 5:30 PM 9:00 PM\n// Guild Studio, 7634 SW 34th Ave, Portland, OR 97219\n//\n// n[]01 Aug 2026\n// Guild Workshop, 7634 SW 34th Ave, Portland, OR 97219\n//\n// n[9:00 AM]26 Jul 2026, 9:00 AM (start time only)\n// n[9:00 AM]26 Jul 2026 - 28 Jul 2026, 9:00 AM 5:00 PM (multi-day span)\n//\n// The same anchor also carries a `data-tags` attribute, which is how the\n// Guild's own on-page filter works. Verified against the live pages on\n// 2026-09-07, five months of grid (Sep-Dec), 174/174 event anchors carried it\n// and it was the first attribute every time, ahead of `href`:\n//\n// Chair Making SIG\n//\n// It is read positionally-agnostically anyway, like `href` and `title`, and a\n// missing attribute is an empty tag list rather than a skipped event.\n//\n// We parse by pattern rather than by DOM position, so a reskin of their\n// class names won't break us. If Wild Apricot changes the title format\n// itself, the invariant checks in cron.ts will fail loudly.\n\nexport interface GuildEvent {\n id: string;\n name: string;\n cancelled: boolean;\n allDay: boolean;\n /** Floating local datetime, e.g. \"20260726T090000\". Guild time is America/Los_Angeles. */\n start: string;\n end: string | null;\n location: string;\n session: string | null; // \"1 of 5\"\n courseKey: string | null; // set for EDS-/EDG- classes and for `sig`-tagged events\n calendar: string;\n url: string;\n /**\n * The anchor's `data-tags`, split and lower-cased: [\"education\",\"sig\",\"studio\"].\n * Empty when the attribute is absent, which is not a failure — it is simply\n * an anchor the Guild did not tag.\n */\n tags: string[];\n}\n\nconst MONTHS: Record = {\n jan: 1, feb: 2, mar: 3, apr: 4, may: 5, jun: 6,\n jul: 7, aug: 8, sep: 9, oct: 10, nov: 11, dec: 12,\n};\n\n/** Wild Apricot double-encodes some titles (\"Dub's Tavern\"), so decode twice. */\nexport function decodeEntities(input: string): string {\n const once = (s: string) =>\n s\n .replace(/&#(\\d+);/g, (_, d) => String.fromCharCode(Number(d)))\n .replace(/"/g, '\"')\n .replace(/'/g, \"'\")\n .replace(/'/g, \"'\")\n .replace(/ /g, \" \")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/&/g, \"&\");\n return once(once(input)).trim();\n}\n\n// Second date and second time are both optional: a title may carry one date and\n// one time (\"26 Jul 2026, 9:00 AM\"), or span days (\"26 Jul 2026 - 28 Jul 2026\").\nconst DATE_RE =\n /(\\d{1,2})\\s+([A-Za-z]{3})[a-z]*\\s+(\\d{4})(?:\\s*[-–—]\\s*(\\d{1,2})\\s+([A-Za-z]{3})[a-z]*\\s+(\\d{4}))?(?:\\s*,\\s*(\\d{1,2}:\\d{2}\\s*[AP]M)(?:\\s+(\\d{1,2}:\\d{2}\\s*[AP]M))?)?/i;\n\nconst SESSION_RE = /\\b(\\d+)\\s+of\\s+(\\d+)\\b/i;\n\n/** \"9:00 AM\" -> \"090000\" */\nfunction toClock(t: string): string {\n const m = t.trim().match(/^(\\d{1,2}):(\\d{2})\\s*([AP])M$/i);\n if (!m) throw new Error(`unparsed time: ${t}`);\n let h = Number(m[1]) % 12;\n if (m[3].toUpperCase() === \"P\") h += 12;\n return `${String(h).padStart(2, \"0\")}${m[2]}00`;\n}\n\nfunction toDate(day: string, mon: string, year: string): string {\n const m = MONTHS[mon.slice(0, 3).toLowerCase()];\n if (!m) throw new Error(`unparsed month: ${mon}`);\n return `${year}${String(m).padStart(2, \"0\")}${day.padStart(2, \"0\")}`;\n}\n\n/** \"20260726\" -> \"20260727\" */\nfunction nextDate(yyyymmdd: string): string {\n const d = new Date(\n Number(yyyymmdd.slice(0, 4)),\n Number(yyyymmdd.slice(4, 6)) - 1,\n Number(yyyymmdd.slice(6, 8)) + 1,\n );\n return `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, \"0\")}${\n String(d.getDate()).padStart(2, \"0\")\n }`;\n}\n\n/**\n * Cohort tags, in every shape seen so far: \" 26-37\", \" (26-37)\", \"-26-37\",\n * \" 26-37AB\", and any of those with an en/em dash. The leading separator is\n * part of the match so it goes with the tag. Two digits minimum on the left,\n * so \"SHOP 101\" and \"WOODTURNING 1-2\" — where the number is the course name —\n * are left alone.\n */\nexport const COHORT_RE = /(?:\\s+|\\s*[-–—]\\s*)\$?\\d{2,4}[-–—]\\d+[a-z]{0,2}\$?(?![\\w-])/gi;\n\n/**\n * Time-of-day slots: the same class runs \"- MORNING\", \"- AFTERNOON\" and\n * \"- EVENING\", and the owner takes it once. Trailing only, so \"MORNING GLORY\n * CARVING\" keeps its name, and the separator comes off with the word.\n */\nexport const SLOT_RE = /(?:\\s*[-–—]\\s*|\\s+)(?:morning|afternoon|evening)\\s*$/i;\n\nexport const GUILD_HOST = \"https://www.guildoforegonwoodworkers.com\";\n\n/** The public page for one event id, in one place so the two callers agree. */\nexport function eventUrl(id: string): string {\n return `${GUILD_HOST}/event-${id}`;\n}\n\n/**\n * `data-tags=\"education,sig,studio\"` -> [\"education\",\"sig\",\"studio\"].\n *\n * Split on commas and compared whole, never as a substring. The live tag\n * vocabulary contains \"class si\" and \"shop skills\", and the Guild's own filter\n * script uses a CSS `data-tags*=` substring match — copying that would make\n * either of those a candidate for matching some future tag by accident. A tag\n * is a token or it is nothing.\n */\nexport function parseTags(raw: string | undefined): string[] {\n if (!raw) return [];\n const out: string[] = [];\n for (const part of decodeEntities(raw).split(\",\")) {\n const tag = part.trim().toLowerCase();\n if (tag && !out.includes(tag)) out.push(tag);\n }\n return out;\n}\n\n/** The tag the Guild puts on Special Interest Group events. */\nexport const SIG_TAG = \"sig\";\n\n/**\n * Which events get a row on the class list, and therefore an \"I've taken this\"\n * button.\n *\n * Two independent rules, deliberately OR'd rather than merged. The name rule\n * is the original one and is unchanged. The tag rule was added because the\n * SIGs — Chair Making, Box, CNC, Hand Tool, Lutherie, Marquetry — are in the\n * feeds but are named nothing like a class, so the name rule never saw them.\n * The Guild already labels them for its own filter; we read that label rather\n * than guessing from the name, which is why \"Women in the Shop\" (tagged\n * `education,shop,sig` on the live pages, and not named \"SIG\" at all) is\n * correctly included too.\n */\nexport function isCourse(name: string, tags: string[] = []): boolean {\n if (/^\\s*ED[SG]\\b/i.test(name)) return true;\n return tags.includes(SIG_TAG);\n}\n\n/**\n * Classes are offered in cohorts and time slots: \"CORE TOOL CERTIFICATION -\n * EVENING 26-37\", \"26-38\", \"- AFTERNOON 26-41\" are the same class over and\n * over. Strip both so \"taken\" attaches to the course, not to one occurrence\n * of it.\n *\n * `tags` is optional and defaults to none, so a call with a name alone still\n * means exactly what it meant before: the EDS-/EDG- rule and nothing else. A\n * SIG carries no cohort and no slot word, so the strips below run over its\n * name and change nothing — its key is simply its cleaned, upper-cased name.\n * That is on purpose: no new grouping rule is invented for them.\n */\nexport function courseKeyFor(name: string, tags: string[] = []): string | null {\n if (!isCourse(name, tags)) return null;\n return name\n // \"DOVETAIL BOX – MAKE\" and \"DOVETAIL BOX - MAKE\" are one course.\n .replace(/[–—]/g, \"-\")\n // Cohort first: the slot word sits to its left (\"- AFTERNOON 26-41\").\n .replace(COHORT_RE, \"\")\n .replace(SLOT_RE, \"\")\n .replace(/\\s{2,}/g, \" \")\n .trim()\n .toUpperCase();\n}\n\n/** Cancellations live in the event name, not a status field. */\nexport function readCancellation(raw: string): { name: string; cancelled: boolean } {\n const cancelled = /cancell?ed/i.test(raw);\n if (!cancelled) return { name: raw, cancelled };\n const name = raw\n // leading, with a reason: \"CANCELLED due to Weather - Women in the Shop\"\n .replace(/^\\s*cancell?ed\\b[^-–—!.:]*[-–—!.:]\\s*/i, \"\")\n // leading, bare: \"CANCELLED Women in the Shop\"\n .replace(/^\\s*cancell?ed\\b\\s*[-–—:,]?\\s*/i, \"\")\n // trailing: \"Project Build - Afternoon Cancelled due to heat\", and the\n // separator or bracket that introduced it — \"Women in the Shop -\n // CANCELLED\", \"(CANCELLED)\", \"[Cancelled]\" — which otherwise stays behind\n // and corrupts the course key.\n .replace(/\\s*[-–—:,(\\[]?\\s*\\bcancell?ed\\b[^-–—!.:]*[)\\]!.]?\\s*$/i, \"\")\n .trim();\n return { name: name || raw.trim(), cancelled };\n}\n\nconst ANCHOR_RE = /]*)>([\\s\\S]*?)<\\/a>/gi;\n\nexport function parseCalendarPage(html: string, calendar: string): GuildEvent[] {\n const out = new Map();\n\n for (const m of html.matchAll(ANCHOR_RE)) {\n const attrs = m[1];\n const href = attrs.match(/href\\s*=\\s*\"([^\"]*)\"/i)?.[1];\n const title = attrs.match(/title\\s*=\\s*\"([^\"]*)\"/i)?.[1];\n if (!href || !title) continue;\n\n // Read like the two above and gated like neither: an anchor with no\n // `data-tags` is still an event, it just has no tags. Nothing about which\n // anchors become events changed when this line was added.\n const tags = parseTags(attrs.match(/data-tags\\s*=\\s*\"([^\"]*)\"/i)?.[1]);\n\n const idMatch = href.match(/event-(\\d+)/);\n if (!idMatch) continue;\n\n const rawName = decodeEntities(m[2].replace(/<[^>]*>/g, \" \").replace(/\\s+/g, \" \"));\n if (!rawName) continue;\n\n const info = decodeEntities(title).replace(/\\r/g, \"\");\n const dm = info.match(DATE_RE);\n if (!dm) continue; // not an event tooltip\n\n const date = toDate(dm[1], dm[2], dm[3]);\n const endDate = dm[4] ? toDate(dm[4], dm[5], dm[6]) : date;\n const allDay = !dm[7];\n const start = allDay ? date : `${date}T${toClock(dm[7])}`;\n let end: string | null = null;\n if (allDay) {\n end = dm[4] ? endDate : null; // date-only, and only for a multi-day span\n } else if (dm[8]) {\n end = `${endDate}T${toClock(dm[8])}`;\n // \"9:00 PM 12:00 AM\" ends the following morning, not before it started.\n if (end <= start) end = `${nextDate(endDate)}T${toClock(dm[8])}`;\n }\n\n const tail = info.slice(dm.index! + dm[0].length);\n const location = tail\n .split(\"\\n\")\n .map((s) => s.trim())\n .filter(Boolean)\n .join(\", \")\n .replace(/^,\\s*/, \"\");\n\n const sm = info.slice(0, dm.index).match(SESSION_RE);\n const { name, cancelled } = readCancellation(rawName);\n\n const ev: GuildEvent = {\n id: idMatch[1],\n name,\n cancelled,\n allDay,\n start,\n end,\n location,\n session: sm ? `${sm[1]} of ${sm[2]}` : null,\n courseKey: courseKeyFor(name, tags),\n calendar,\n url: eventUrl(idMatch[1]),\n tags,\n };\n\n // Same event can appear twice on one page (multi-day spans). Last write wins.\n out.set(`${ev.id}:${ev.start}`, ev);\n }\n\n return [...out.values()];\n}\n\n// ---------------------------------------------------------------------------\n// Fullness — the hidden \"Upcoming Events\" widget\n// ---------------------------------------------------------------------------\n\n/**\n * Whether registration is still open, and the third state is the whole point.\n *\n * Wild Apricot deletes the registration block outright once an event has\n * started, so a course with no button is not \"open\" and not \"full\" — it is a\n * question the page stopped answering. Collapsing that to a boolean would\n * paint every past occurrence as bookable. Callers must render \"unknown\" as\n * they rendered everything before this feature existed.\n */\nexport type Fullness = \"full\" | \"open\" | \"unknown\";\n\n/**\n * One registration control, matched whole, from the widget the calendar grid\n * does not show. Verified against the live pages on 2026-09-07:\n *\n * OPEN\n * Register\n *\n * FULL\n * Join waitlist\n *\n * The `_bt` input's class is the deciding capture, because the button is the\n * authority here and the neighbouring \"Spaces left\" counter is not: an event\n * that has already started still advertises \"Spaces left 4\" long after Wild\n * Apricot removed the button (live example on 2026-09-07: event-6756663,\n * started 03 Sep, four spaces \"left\", no registration block at all). The\n * anchor is matched only to carry the event id, which the input does not hold.\n *\n * Note what this does NOT do: it never segments the document into per-event\n * blocks. It does not need to. Every quantifier is a negated class fenced in\n * by the literal that follows it, so the whole thing is one forward scan with\n * no backtracking to speak of — which matters, because the Guild widget is a\n * 21MB string. Measured: 176/176 controls found on 21.4MB in 859ms, 74/74 on\n * 4.6MB in 170ms, both exactly equal to an independent count of the class\n * attribute, so no misses and no false positives.\n */\nconst REGISTRATION_CONTROL_RE =\n /event-(\\d+)\\/(?:Registration|JoinWaitlist)\"[^>]*>[^<]*<\\/a>]*eventRegistrationActions_(?:RegistrationLink|lobJoinWaitlist)_bt\"[^>]*class=\"typeButton (registerButton|joinWaitlistButton)\"/g;\n\n/**\n * Widget HTML in, event id -> state out.\n *\n * Only ids the widget actually answered for appear in the map. An id that is\n * absent is \"unknown\", which keeps the map small (a few dozen keys out of a\n * page with a thousand event links) and, more importantly, keeps \"we did not\n * fetch the widget\" and \"the widget said nothing about this event\" the same\n * answer — because they are the same answer.\n *\n * \"unknown\" is stored explicitly in exactly one case: an id that shows up with\n * both a Register and a Join-waitlist control. That has never been observed\n * (zero overlap across both live widgets), and if it ever happens it is a\n * contradiction, not a tie to break in favour of the last one parsed.\n */\nexport function parseFullnessWidget(html: string): Record {\n const out: Record = {};\n for (const m of html.matchAll(REGISTRATION_CONTROL_RE)) {\n const id = m[1];\n const state: Fullness = m[2] === \"joinWaitlistButton\" ? \"full\" : \"open\";\n const seen = out[id];\n if (seen === undefined) out[id] = state;\n else if (seen !== state) out[id] = \"unknown\";\n }\n return out;\n}\n\n/** The three-state read. Absent, stale-dropped and contradicted all land here. */\nexport function fullnessOf(\n map: Record | undefined,\n id: string,\n): Fullness {\n return map?.[id] ?? \"unknown\";\n}\n",[],[71],"ee259e8f-8049-46aa-9af6-786d60d03eb7","ics.ts","3c55ca04-a98a-11f1-96d5-1607ee4eb77e",11,["D",1788829780794],1,"import { type Fullness, fullnessOf, type GuildEvent } from \"./parse.ts\";\n\nexport const TZ = \"America/Los_Angeles\";\n\nfunction esc(s: string): string {\n return s\n .replace(/\\\\/g, \"\\\\\\\\\")\n .replace(/;/g, \"\\\\;\")\n .replace(/,/g, \"\\\\,\")\n .replace(/\\n/g, \"\\\\n\");\n}\n\n/** RFC 5545 wants lines folded at 75 octets. */\nfunction fold(line: string): string {\n const bytes = new TextEncoder().encode(line);\n if (bytes.length <= 75) return line;\n const parts: string[] = [];\n let buf = \"\";\n let len = 0;\n for (const ch of line) {\n const n = new TextEncoder().encode(ch).length;\n if (len + n > (parts.length === 0 ? 75 : 74)) {\n parts.push(buf);\n buf = \"\";\n len = 0;\n }\n buf += ch;\n len += n;\n }\n if (buf) parts.push(buf);\n return parts.join(\"\\r\\n \");\n}\n\nfunction stamp(): string {\n return new Date().toISOString().replace(/[-:]/g, \"\").replace(/\\.\\d{3}/, \"\");\n}\n\nfunction nextDay(yyyymmdd: string): string {\n const d = new Date(\n Number(yyyymmdd.slice(0, 4)),\n Number(yyyymmdd.slice(4, 6)) - 1,\n Number(yyyymmdd.slice(6, 8)) + 1,\n );\n return `${d.getFullYear()}${String(d.getMonth() + 1).padStart(2, \"0\")}${\n String(d.getDate()).padStart(2, \"0\")\n }`;\n}\n\n/** Content hash — bump SEQUENCE only when something a subscriber would notice changes. */\nexport function fingerprint(ev: GuildEvent): string {\n return [ev.name, ev.start, ev.end, ev.location, ev.cancelled, ev.session].join(\"|\");\n}\n\nfunction toIcsDateTime(v: string): string {\n return v.replace(\"T\", \"T\");\n}\n\nexport interface RenderOpts {\n calName: string;\n /** Base URL of your val, used to link back to the class list. */\n base?: string;\n sequences?: Record;\n /** Event id -> state. Absent, and absent ids, both mean \"unknown\". */\n fullness?: Record;\n}\n\nfunction describe(ev: GuildEvent, o: RenderOpts): string {\n const lines: string[] = [];\n if (ev.session) lines.push(`Session ${ev.session}`);\n // The class list gets orange, an icon and a tooltip. iCalendar has none of\n // those — no colour, no markup, no hover — so a sentence in the body is the\n // only representation that survives the trip to Google and Apple. SUMMARY is\n // left alone on purpose: it is the string every client shows in month view\n // and in notifications, and a state that can flip back tomorrow does not\n // belong in it.\n //\n // Cancelled wins outright. A cancelled session is not \"full\", it is not\n // happening, and STATUS:CANCELLED below already says so.\n if (!ev.cancelled && fullnessOf(o.fullness, ev.id) === \"full\") {\n lines.push(\"This session is full. Registration is closed; a waitlist is open.\");\n }\n if (ev.cancelled) lines.push(\"This session was cancelled by the Guild.\");\n lines.push(ev.url);\n if (ev.courseKey && o.base) {\n // Bare link, never a tokenised one: this body syncs to Google and Apple.\n lines.push(`Taken it? Hide future offerings: ${new URL(\"/\", o.base).toString()}`);\n }\n return lines.join(\"\\n\");\n}\n\n/**\n * RFC 5545 §3.2.19 wants every referenced TZID defined in the same object.\n * Google and Apple resolve the bare IANA name; Outlook/Exchange treats an\n * unresolvable TZID as UTC and shifts everything 7-8 hours.\n */\nconst VTIMEZONE = [\n \"BEGIN:VTIMEZONE\",\n `TZID:${TZ}`,\n `X-LIC-LOCATION:${TZ}`,\n \"BEGIN:DAYLIGHT\",\n \"TZOFFSETFROM:-0800\",\n \"TZOFFSETTO:-0700\",\n \"TZNAME:PDT\",\n \"DTSTART:19700308T020000\",\n \"RRULE:FREQ=YEARLY;BYMONTH=3;BYDAY=2SU\",\n \"END:DAYLIGHT\",\n \"BEGIN:STANDARD\",\n \"TZOFFSETFROM:-0700\",\n \"TZOFFSETTO:-0800\",\n \"TZNAME:PST\",\n \"DTSTART:19701101T020000\",\n \"RRULE:FREQ=YEARLY;BYMONTH=11;BYDAY=1SU\",\n \"END:STANDARD\",\n \"END:VTIMEZONE\",\n];\n\nexport function renderIcs(events: GuildEvent[], o: RenderOpts): string {\n const now = stamp();\n const lines: string[] = [\n \"BEGIN:VCALENDAR\",\n \"VERSION:2.0\",\n \"PRODID:-//guild-calendar-bridge//EN\",\n \"CALSCALE:GREGORIAN\",\n \"METHOD:PUBLISH\",\n `X-WR-CALNAME:${esc(o.calName)}`,\n `X-WR-TIMEZONE:${TZ}`,\n ...VTIMEZONE,\n ];\n\n for (const ev of events) {\n const uid = `${ev.id}-${ev.start}@guildoforegonwoodworkers`;\n lines.push(\"BEGIN:VEVENT\");\n lines.push(`UID:${uid}`);\n lines.push(`DTSTAMP:${now}`);\n lines.push(`SEQUENCE:${o.sequences?.[uid] ?? 0}`);\n if (ev.allDay) {\n lines.push(`DTSTART;VALUE=DATE:${ev.start}`);\n // DTEND is exclusive, and ev.end is set only for a multi-day span.\n lines.push(`DTEND;VALUE=DATE:${nextDay(ev.end ?? ev.start)}`);\n } else {\n lines.push(`DTSTART;TZID=${TZ}:${toIcsDateTime(ev.start)}`);\n if (ev.end) lines.push(`DTEND;TZID=${TZ}:${toIcsDateTime(ev.end)}`);\n }\n lines.push(`SUMMARY:${esc(ev.name)}`);\n if (ev.location) lines.push(`LOCATION:${esc(ev.location)}`);\n lines.push(`DESCRIPTION:${esc(describe(ev, o))}`);\n lines.push(`URL:${ev.url}`);\n if (ev.cancelled) lines.push(\"STATUS:CANCELLED\");\n lines.push(`CATEGORIES:${esc(ev.calendar)}`);\n lines.push(\"END:VEVENT\");\n }\n\n lines.push(\"END:VCALENDAR\");\n return lines.map(fold).join(\"\\r\\n\") + \"\\r\\n\";\n}\n",[],[79],"38a7dea0-d79d-4db6-a2bc-d4123f7a6fb9","http.ts","3cdb4b5c-a98a-11f1-9fa3-1607ee4eb77e",21,["D",1788882913290],6,"http","import { blob } from \"https://esm.town/v/std/blob\";\nimport {\n COHORT_RE,\n eventUrl,\n type Fullness,\n fullnessOf,\n type GuildEvent,\n SLOT_RE,\n} from \"./parse.ts\";\nimport { renderIcs, TZ } from \"./ics.ts\";\nimport {\n createSession,\n destroySession,\n earliestFirstSeen,\n filterTaken,\n hide,\n isNewSince,\n readFirstSeen,\n readFullness,\n sequenceMap,\n SESSION_MAX_AGE_S,\n sessionValid,\n takenKeys,\n unhide,\n} from \"./store.ts\";\n\nconst TOKEN = Deno.env.get(\"GUILD_TOKEN\") ?? \"\";\nconst COOKIE = \"guild_auth\";\n\ntype Stored =\n | { ok: true; events: GuildEvent[] }\n | { ok: false; status: number; message: string };\n\n/**\n * Never answer with an empty-but-valid calendar. getJSON returns undefined for\n * a missing key and throws only on a real failure; either way a subscribed\n * client would read zero VEVENTs as \"every event was deleted\", so both cases\n * have to surface as an error instead of as a feed.\n */\nasync function events(): Promise {\n let raw: unknown;\n try {\n raw = await blob.getJSON(\"events\");\n } catch (e) {\n return { ok: false, status: 503, message: `Event store unavailable: ${e}` };\n }\n if (raw == null) {\n return {\n ok: false,\n status: 503,\n message: \"No calendar data yet. cron.ts has not completed a scrape.\",\n };\n }\n if (!Array.isArray(raw) || raw.length === 0) {\n return { ok: false, status: 503, message: \"Event store is empty or malformed.\" };\n }\n return { ok: true, events: raw as GuildEvent[] };\n}\n\nfunction problem(s: { status: number; message: string }): Response {\n return new Response(`${s.message}\\n`, {\n status: s.status,\n headers: { \"content-type\": \"text/plain; charset=utf-8\" },\n });\n}\n\ntype Taken =\n | { ok: true; keys: string[] }\n | { ok: false; status: number; message: string };\n\ntype Sequences =\n | { ok: true; map: Record }\n | { ok: false; status: number; message: string };\n\n/**\n * These two used to swallow every failure and answer with an empty default.\n * For the taken-list that is the worst possible response: /new.ics would serve\n * every class the owner had hidden, and it would look exactly like a correct\n * feed. A store that cannot be read is not the same as a store that is empty —\n * an empty table is a real, valid answer meaning nothing has been hidden yet,\n * while an error has to surface as a 503 the way a missing event store does.\n */\nasync function taken(): Promise {\n try {\n return { ok: true, keys: await takenKeys() };\n } catch (e) {\n return { ok: false, status: 503, message: `Hidden-class store unavailable: ${e}` };\n }\n}\n\n/**\n * Same reasoning, one step weaker: a missing SEQUENCE is not a wrong event, it\n * is an event a subscriber may refuse to update because the number went\n * backwards. Fail rather than publish a feed that quietly resets every\n * counter to zero.\n */\nasync function sequences(): Promise {\n try {\n return { ok: true, map: await sequenceMap() };\n } catch (e) {\n return { ok: false, status: 503, message: `Sequence store unavailable: ${e}` };\n }\n}\n\nfunction ics(body: string, filename: string) {\n return new Response(body, {\n headers: {\n \"content-type\": \"text/calendar; charset=utf-8\",\n \"content-disposition\": `inline; filename=\"${filename}\"`,\n \"cache-control\": \"public, max-age=1800\",\n },\n });\n}\n\n/** Val Town runs in UTC, so \"today\" has to be asked for in Guild time. */\nfunction todayStamp(): string {\n const parts = new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: TZ,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n }).formatToParts(new Date());\n const get = (t: string) => parts.find((p) => p.type === t)!.value;\n return `${get(\"year\")}${get(\"month\")}${get(\"day\")}`;\n}\n\n/**\n * Pulls the raw `guild_auth` value out of the Cookie header and does nothing\n * else with it — no comparison, no decision. Whatever comes back is an opaque\n * candidate session id that only the store can rule on.\n *\n * Not `decodeURIComponent`d, on purpose. A session id is 64 hex characters,\n * which needs no escaping in either direction, so decoding could only ever\n * change the value — and on malformed input (`%`, a stray `%zz`) it throws a\n * URIError, which on this path would be a crash instead of a login page. The\n * old code had to decode because it was carrying a user-chosen password.\n */\nfunction sessionCookie(req: Request): string | null {\n for (const part of (req.headers.get(\"cookie\") ?? \"\").split(\";\")) {\n const eq = part.indexOf(\"=\");\n if (eq < 0) continue;\n if (part.slice(0, eq).trim() !== COOKIE) continue;\n return part.slice(eq + 1).trim();\n }\n return null;\n}\n\ntype Auth =\n | { ok: true; sid: string | null }\n | { ok: false; status: number; message: string };\n\n/**\n * The authentication check, shaped like `taken()` and `sequences()` above\n * because it has the same problem: a store that cannot be read is not the same\n * as a store that says no.\n *\n * `ok: true, sid: null` means \"no valid session\" — no cookie, an unknown id,\n * an expired one. `ok: false` means the store could not answer, and the caller\n * turns it into a 503 exactly as it does for the taken-list.\n *\n * THE FAIL-CLOSED LINE IS THE `catch` BELOW. Every throw reachable from\n * `sessionValid` — a sqlite outage, an `init()` that could not build schema or\n * reach the legacy blob, a row that would not decode (`sessionExpiryOf`) —\n * lands there and becomes a 503. There is no `catch` branch that yields an\n * `sid`, and no default that treats an unreadable store as authenticated. The\n * only way to get a non-null `sid` out of this function is for sqlite to have\n * actually returned a matching, unexpired row.\n *\n * A cookie set by the previous scheme holds the raw GUILD_TOKEN. It reaches\n * `sessionValid` as an unknown id, fails the shape gate, and returns null —\n * the owner lands on the login page and logs in once. That is deliberate and\n * is the migration: accepting a raw-secret cookie here, even temporarily,\n * would keep the hole open.\n */\nasync function auth(req: Request): Promise {\n const sid = sessionCookie(req);\n if (!sid) return { ok: true, sid: null };\n try {\n return { ok: true, sid: (await sessionValid(sid)) ? sid : null };\n } catch (e) {\n return { ok: false, status: 503, message: `Session store unavailable: ${e}` };\n }\n}\n\n/** One place for the cookie flags, so login and logout can never drift apart. */\nfunction cookie(value: string, maxAge: number): string {\n return `${COOKIE}=${value}; Path=/; Max-Age=${maxAge}; HttpOnly; Secure; SameSite=Strict`;\n}\n\nfunction esc(s: string) {\n return s.replace(/[&<>\"]/g, (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[c]!));\n}\n\nconst CSS = `\n/* Two fullness colours, and they have to be told apart at a glance. --brick is\n a true red (hue 34, contrast 7.48:1 on --paper); --ember is retuned from the\n old #a8460c, which sat at hue 53 and read as red rather than orange, to the\n most saturated orange that still clears 4.5:1 here (hue 65, 4.83:1 — better\n than --muted, which this page has always used for body text). They differ by\n dE76 36, and still by 12.6 under simulated deuteranopia, but see .fullmark:\n the colour is never the only carrier. */\n:root{--paper:#fbfbf8;--ink:#1d1d1a;--muted:#6f736c;--rule:#e0e0d8;--fir:#2f5d3f;\n --brick:#a4161a;--ember:#a85c00}\n*{box-sizing:border-box}\nbody{margin:0;background:var(--paper);color:var(--ink);\n font:16px/1.5 ui-sans-serif,system-ui,-apple-system,Segoe UI,Roboto,sans-serif;\n padding:1.5rem 1.25rem 4rem;max-width:38rem;margin-inline:auto}\nh1{font-size:1.35rem;font-weight:650;margin:0 0 .25rem}\np.sub{color:var(--muted);margin:0 0 2rem;font-size:.9rem}\nh2{font-size:.95rem;font-weight:650;margin:2rem 0 .5rem;padding-bottom:.4rem;\n border-bottom:1px solid var(--rule)}\nul{list-style:none;margin:0;padding:0}\nli{display:flex;gap:1rem;align-items:baseline;justify-content:space-between;\n padding:.85rem 0;border-bottom:1px solid var(--rule)}\n.name{flex:1;min-width:0}\n.when{display:block;color:var(--muted);font-size:.8rem;margin-top:.15rem}\n.act{flex-shrink:0;color:var(--fir);text-decoration:none;font-size:.85rem;\n font-family:inherit;background:none;cursor:pointer;\n border:1px solid var(--fir);border-radius:2px;padding:.45rem .7rem;min-height:44px;\n display:inline-flex;align-items:center}\n.act:focus-visible{outline:2px solid var(--fir);outline-offset:2px}\nli>form{flex-shrink:0;margin:0}\nli.done .name{color:var(--muted)}\nli.done .act{color:var(--muted);border-color:var(--rule)}\nli.full-all .name{color:var(--brick)}\nli.full-all .when{color:var(--brick)}\nli.full-next .name{color:var(--ember)}\nli.full-next .when{color:var(--ember)}\n/* The icon carries meaning colour alone would not, for anyone who cannot see\n red and orange apart — and that pair is one of the harder ones. So the two\n states get two different glyphs, of two different silhouettes, not one glyph\n in two colours. Not decorative, so each keeps its own accessible name. */\n.fullmark{margin-right:.35rem}\n/* The course name links to that course's next occurrence on the Guild site.\n It lives INSIDE .name, which is a sibling of the form, so the button is\n never inside the link and a click on it cannot navigate. Colour is\n inherited rather than set, so the muted (li.done), brick (li.full-all) and\n ember (li.full-next) row states still reach the text; the rule underneath\n is the whole decoration, which is why an already-quiet row does not\n suddenly grow a blue link. */\na.course{color:inherit;text-decoration:none;border-bottom:1px solid var(--rule)}\na.course:hover{border-bottom-color:currentColor}\na.course:focus-visible{outline:2px solid var(--fir);outline-offset:2px;border-radius:2px}\n/* \"New\" borrows the button's outline vocabulary at a smaller size rather than\n introducing a colour this page does not already use. */\n.new{display:inline-block;margin-left:.4rem;padding:0 .3rem;font-size:.7rem;\n font-weight:650;letter-spacing:.04em;text-transform:uppercase;color:var(--fir);\n border:1px solid var(--fir);border-radius:2px;vertical-align:.08em}\nli.done .new{color:var(--muted);border-color:var(--rule)}\n.empty{color:var(--muted);padding:.85rem 0}\ncode{background:#eeeee6;padding:.15rem .35rem;border-radius:2px;font-size:.85em}\n.feeds{margin:0 0 1rem;font-size:.9rem;color:var(--muted)}\nform.login{max-width:20rem;margin:0}\nform.login label{display:block;font-size:.85rem;color:var(--muted);margin:0 0 .35rem}\nform.login input{width:100%;font:inherit;color:var(--ink);background:#fff;\n border:1px solid var(--rule);border-radius:2px;padding:.5rem .6rem;min-height:44px}\nform.login input:focus-visible{outline:2px solid var(--fir);outline-offset:2px}\nform.login .act{margin-top:1rem}\np.error{color:#8c2f2f;font-size:.9rem;margin:0 0 1rem}\nform.logout{margin:2.5rem 0 0}\n`;\n\n/**\n * A POSTed field, unlike a query string, stays out of browser history, Referer\n * headers and request logs. The field is never re-populated on a failed try, so\n * a wrong (or right) guess is not echoed back into the HTML.\n */\nfunction loginPage(failed: boolean): Response {\n return new Response(\n `\n\nGuild classes\n

Guild classes

\n${failed ? '

Incorrect password.

' : \"\"}\n\n`,\n {\n status: failed ? 401 : 200,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n },\n );\n}\n\nfunction pretty(key: string, all: GuildEvent[]): string {\n const ev = all.find((e) => e.courseKey === key);\n // Same strips as courseKeyFor, in the same order, so the label matches the key.\n return ev ? ev.name.replace(COHORT_RE, \"\").replace(SLOT_RE, \"\").trim() : key;\n}\n\n/**\n * Sort key for a display name: \"EDG-Fundamentals\" and \"EDG - Fundamentals\"\n * are the same course, but a hyphen and a space sort apart under plain ASCII\n * comparison. Collapsing every separator to a space and folding case groups\n * siblings regardless of which punctuation the scrape happened to keep — the\n * displayed text itself is never touched.\n */\nexport function sortKey(name: string): string {\n return name.replace(/[-–—]/g, \" \").replace(/\\s+/g, \" \").trim().toLowerCase();\n}\n\n/** Alphabetical by display name, using the normalized key above. */\nexport function compareNames(a: string, b: string): number {\n return sortKey(a).localeCompare(sortKey(b));\n}\n\n/**\n * \"Coming up\" is a schedule, not a list: it has to read chronologically or\n * the soonest class ends up buried under whatever course starts with an\n * early letter. A course with no next occurrence sorts last; two courses\n * landing on the same day tie-break on the normalized name so the order is\n * deterministic instead of tracking scrape order.\n */\nexport function compareUpcoming(\n a: { name: string; nextDay: string | null },\n b: { name: string; nextDay: string | null },\n): number {\n if (a.nextDay !== b.nextDay) {\n if (a.nextDay == null) return 1;\n if (b.nextDay == null) return -1;\n return a.nextDay < b.nextDay ? -1 : 1;\n }\n return compareNames(a.name, b.name);\n}\n\n/**\n * The row's name, linked or not.\n *\n * Exported so the properties that matter can be asserted without rendering a\n * page: a new-tab link carrying rel=\"noopener noreferrer\" — the destination is\n * not ours, so no window.opener handle and no Referer with this page's URL —\n * and a fragment containing no form, because the hide/show button is a sibling\n * of this and must never become a child of the link.\n *\n * `label` arrives already escaped: the caller escapes once and uses it in both\n * branches, so the unlinked case cannot quietly become the unescaped one.\n */\nexport function courseLink(label: string, href: string | null): string {\n if (!href) return label;\n return `${label}`;\n}\n\n/**\n * Exactly what each tooltip says, in one place so the row cannot drift from it.\n * Two states, two sentences: they make different claims and must not be\n * interchangeable. The orange one deliberately says \"may still\", because it\n * also covers the case where the later sessions are simply beyond the\n * widget's horizon and nobody knows.\n */\nconst FULL_ALL_TIP =\n \"Every scheduled session of this class is full — registration is closed and only a waitlist is open.\";\nconst FULL_NEXT_TIP =\n \"The next session is full, but a later one may still have room — check the other dates before joining the waitlist.\";\n\n/**\n * The whole two-state rule, as one pure function so it can be tested without a\n * renderer, a request or a snapshot.\n *\n * red the next session is full, and there is no other way in: either it\n * is the only session scheduled, or every other future session is\n * KNOWN full. This is the strong claim, so it takes positive\n * evidence — a single unknown anywhere later withdraws it.\n * orange the next session is full and something later might not be. That\n * covers a later session known open AND a later session nobody has\n * data for, because the fullness widget only reaches ~3.5 months out\n * and beyond that everything is \"unknown\". Under-claiming here is the\n * cheap mistake; over-claiming \"no way in\" is the expensive one.\n * null the next session is open, or nobody knows what it is. Unchanged\n * from before the second state existed: no icon, no colour, nothing.\n *\n * \"unknown\" is never read as full and never read as open. It only ever has the\n * effect of pulling red down to orange.\n *\n * Takes the id/start pairs it actually needs rather than whole GuildEvents, so\n * a test can state a case in one line. Sorts its own input by `start`, the\n * same rule nextOccurrence() uses, so the row's date and the row's colour\n * cannot end up describing two different sessions.\n */\nexport function courseFullState(\n occurrences: { id: string; start: string }[],\n fullness: Record | undefined,\n): \"red\" | \"orange\" | null {\n const sorted = [...occurrences].sort((a, b) => a.start.localeCompare(b.start));\n const next = sorted[0];\n if (!next) return null;\n if (fullnessOf(fullness, next.id) !== \"full\") return null;\n\n const later = sorted.slice(1).map((e) => fullnessOf(fullness, e.id));\n // Nothing else is scheduled. There is genuinely no other date to take, so\n // this is the \"no way in\" state even though there is no second session to\n // corroborate it — the claim is about the schedule, and the schedule is one\n // full session long.\n if (later.length === 0) return \"red\";\n // every() over a non-empty list, so red always rests on at least one other\n // session positively known to be full.\n return later.every((s) => s === \"full\") ? \"red\" : \"orange\";\n}\n\n/** An ISO instant as a Guild-time \"Sep 5\". Same timezone rule as todayStamp(). */\nfunction guildDate(iso: string): string {\n return new Intl.DateTimeFormat(\"en-US\", {\n timeZone: TZ,\n month: \"short\",\n day: \"numeric\",\n }).format(new Date(iso));\n}\n\nfunction page(\n all: GuildEvent[],\n done: string[],\n origin: string,\n fullness: Record = {},\n firstSeen: Record = {},\n): Response {\n const today = todayStamp();\n const now = Date.now();\n const upcoming = all.filter((e) => e.courseKey && e.start >= today && !e.cancelled);\n\n const keys = [...new Set(upcoming.map((e) => e.courseKey!))];\n\n /** Every upcoming occurrence of a course. One filter, three readers below. */\n const occurrences = (k: string): GuildEvent[] => upcoming.filter((x) => x.courseKey === k);\n\n // The earliest upcoming occurrence of a course, or undefined. Everything\n // per-row is read off this one event so the date shown, the state shown and\n // the row's sort position can never describe three different occurrences.\n const nextOccurrence = (k: string): GuildEvent | undefined =>\n occurrences(k).sort((a, b) => a.start.localeCompare(b.start))[0];\n\n // Link target for the row's name: the Guild's page for the same occurrence\n // the \"next on\" line names. Built from the id rather than read off ev.url,\n // so a snapshot written by an older version, or one whose url field is\n // anything unexpected, can never put a junk string in an href.\n const nextUrl = (k: string): string | null => {\n const ev = nextOccurrence(k);\n if (!ev || !/^\\d+$/.test(String(ev.id))) return null;\n return eventUrl(String(ev.id));\n };\n\n // When this course first turned up in a scrape, across all of its upcoming\n // occurrences. Earliest, so a long-running class that posts a fresh cohort\n // does not read as new — the cohort is new, the course is not.\n const firstSeenAt = (k: string): string | null =>\n earliestFirstSeen(firstSeen, occurrences(k).map((e) => e.id));\n\n // Earliest occurrence's floating-local start, e.g. \"20260909T170000\" or\n // the all-day \"20260801\"; null when nothing for this key is upcoming.\n const nextStart = (k: string): string | null => nextOccurrence(k)?.start ?? null;\n\n // A row is one course, and the colour is now a claim about the course, not\n // only about the occurrence the \"next on\" line names: a full next session\n // with a later cohort that has room is a different situation from a course\n // that is full all the way down, and the two get told apart. All of the\n // branching lives in courseFullState(); this is only the lookup.\n const fullState = (k: string) => courseFullState(occurrences(k), fullness);\n\n // Calendar day only (first 8 chars), so two courses starting at different\n // times on the same day still count as a tie for sorting purposes.\n const nextDay = (k: string): string | null => nextStart(k)?.slice(0, 8) ?? null;\n\n const nextDate = (k: string) => {\n const s = nextStart(k);\n if (!s) return \"\";\n const d = new Date(\n Number(s.slice(0, 4)),\n Number(s.slice(4, 6)) - 1,\n Number(s.slice(6, 8)),\n );\n return d.toLocaleDateString(\"en-US\", { month: \"short\", day: \"numeric\" });\n };\n\n // A POST, not a link: link prefetchers and mail scanners fire GETs, and were\n // silently marking classes taken.\n const button = (k: string, isDone: boolean) =>\n ``;\n\n // `showFullness` is passed explicitly at both call sites and never through\n // `.map(row)`: Array#map hands the callback an index as its second argument,\n // which would arrive here as a truthy flag on every row but the first.\n const row = (k: string, showFullness: boolean) => {\n const isDone = done.includes(k);\n // Three states, three renderings, and the third one is \"render it the way\n // this page rendered every row before the feature existed\" — no icon, no\n // colour, no tooltip. There is nothing to say about an occurrence the\n // widget did not describe, and a guess would be worse than silence.\n //\n // The two that do render differ by glyph as well as by colour: 🛑 is a\n // wide octagon, ⏳ a tall hourglass, so they are separable by shape alone\n // when the red and the orange are not separable at all. The accessible\n // names and the tooltips differ too, so nothing about the distinction is\n // carried by sight only.\n const state = showFullness ? fullState(k) : null;\n const mark = state === \"red\"\n ? `🛑`\n : state === \"orange\"\n ? `⏳`\n : \"\";\n const tip = state === \"red\"\n ? ` title=\"${esc(FULL_ALL_TIP)}\"`\n : state === \"orange\"\n ? ` title=\"${esc(FULL_NEXT_TIP)}\"`\n : \"\";\n const stateClass = state === \"red\" ? \" full-all\" : state === \"orange\" ? \" full-next\" : \"\";\n\n // The link wraps the name text and nothing else. It is inside .name, which\n // is a sibling of the form, so the hide/show button stays outside it.\n // New tab, and rel=\"noopener noreferrer\" because the destination is not\n // ours: no window.opener handle and no Referer carrying this page's URL.\n const named = courseLink(esc(pretty(k, all)), nextUrl(k));\n\n // Two showings of one fact: a pill so the row is scannable, and the date\n // in the line that already carries dates. Both appear only inside the\n // window, so an event baselined at the epoch reaches neither.\n const since = firstSeenAt(k);\n const isNew = isNewSince(since, now);\n const badge = isNew ? `new` : \"\";\n const appeared = isNew ? ` · first seen ${esc(guildDate(since!))}` : \"\";\n\n return `

${mark}${named}${badge}\n next on ${esc(nextDate(k))}${appeared}\n ${button(k, isDone)}

`;\n };\n\n // The schedule: soonest class first. Both sort inputs are computed once per\n // key rather than inside the comparator — pretty() and nextDay() each scan\n // the whole event list, and a comparator runs O(n log n) times. Same\n // comparator, same values, same input order, so the resulting order is\n // unchanged; only the number of scans is.\n const open = keys.filter((k) => !done.includes(k))\n .map((k) => ({ k, name: pretty(k, all), nextDay: nextDay(k) }))\n .sort(compareUpcoming)\n .map((e) => e.k);\n // Lookup lists, not schedules: name order, not date order.\n const hidden = keys.filter((k) => done.includes(k)).sort((a, b) =>\n compareNames(pretty(a, all), pretty(b, all))\n );\n const orphans = done.filter((k) => !keys.includes(k)).sort((a, b) =>\n compareNames(pretty(a, all), pretty(b, all))\n );\n\n return new Response(\n `\n\nGuild classes\n

Guild classes

Hide a class and it drops out of your filtered feed. Everything still shows in the full one.

Subscribe: ${esc(origin)}/new.ics · full: ${\n esc(origin)\n }/all.ics

Coming up

Nothing scheduled.

\n${\n // Fullness is shown only here. A hidden class is one the owner has\n // already taken, so whether it is full tells him nothing, and colour\n // running through a list whose whole visual job is to look muted makes\n // both signals harder to read.\n hidden.length\n ? `

Hidden

${hidden.map((k) => row(k, false)).join(\"\")}`\n : \"\"\n }\n${\n orphans.length\n // Deliberately unlinked. These keys have no upcoming occurrence at\n // all, so the only event id we could point at is one that has already\n // happened — a link to a stale page is worse than no link.\n ? `

Hidden, not currently offered

${esc(pretty(k, all))}\n ${button(k, true)}

`\n : \"\"\n }\n\n`,\n { headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const origin = url.origin;\n\n if (url.pathname === \"/all.ics\") {\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const seq = await sequences();\n if (!seq.ok) return problem(seq);\n return ics(\n renderIcs(stored.events, {\n calName: \"Guild of Oregon Woodworkers\",\n base: origin,\n sequences: seq.map,\n fullness: await readFullness(),\n }),\n \"guild-all.ics\",\n );\n }\n\n if (url.pathname === \"/new.ics\") {\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const done = await taken();\n if (!done.ok) return problem(done);\n const seq = await sequences();\n if (!seq.ok) return problem(seq);\n return ics(\n renderIcs(filterTaken(stored.events, done.keys, todayStamp()), {\n calName: \"Guild classes (filtered)\",\n base: origin,\n sequences: seq.map,\n fullness: await readFullness(),\n }),\n \"guild-new.ics\",\n );\n }\n\n // POST-only for the same reason the mutations are: a GET-triggered login or\n // logout is something a prefetcher or a mail scanner can fire on its own.\n if (url.pathname === \"/login\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n const supplied = String((await req.formData()).get(\"token\") ?? \"\");\n // THE ONLY COMPARISON AGAINST THE SECRET IN THE PROGRAM. Below this line\n // the token is out of scope: what leaves here is a random session id, and\n // TOKEN is never written to a cookie, a header, the HTML, a URL, a log\n // line, an .ics body or a bound SQL argument.\n if (!TOKEN || supplied !== TOKEN) return loginPage(true);\n let sid: string;\n try {\n sid = await createSession();\n } catch (e) {\n // No cookie on this path. A 303 carrying a session id we failed to store\n // would hand the browser a credential that authenticates nothing, and\n // the owner would see the login page again with no idea why.\n return problem({ status: 503, message: `Could not start a session: ${e}` });\n }\n return new Response(null, {\n status: 303,\n headers: {\n location: \"/\",\n \"set-cookie\": cookie(sid, SESSION_MAX_AGE_S),\n },\n });\n }\n\n if (url.pathname === \"/logout\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n // The row goes first, and if it will not go, neither does the cookie.\n // Clearing the cookie alone — all the old logout did — left the value\n // replayable by anyone who had kept a copy, which is precisely the\n // revocation the old design could not perform. Reporting a logout that did\n // not revoke anything is the one answer worse than an error here.\n try {\n await destroySession(sessionCookie(req));\n } catch (e) {\n return problem({ status: 503, message: `Could not log out: ${e}` });\n }\n return new Response(null, {\n status: 303,\n headers: { location: \"/\", \"set-cookie\": cookie(\"\", 0) },\n });\n }\n\n if (url.pathname === \"/taken\" || url.pathname === \"/untaken\") {\n if (req.method !== \"POST\") {\n return new Response(\"Use POST.\", { status: 405, headers: { allow: \"POST\" } });\n }\n const who = await auth(req);\n if (!who.ok) return problem(who);\n if (!who.sid) return new Response(\"Wrong or missing token.\", { status: 403 });\n\n const key = String((await req.formData()).get(\"key\") ?? \"\");\n if (!key) return new Response(\"Missing key.\", { status: 400 });\n\n // One row, no read first. The old code read the whole list, edited it in\n // memory and wrote it all back, so a second request that overlapped the\n // first threw one of the two changes away.\n try {\n if (url.pathname === \"/taken\") await hide(key);\n else await unhide(key);\n } catch (e) {\n // Never redirect as though the click landed: a 303 to \"/\" after a failed\n // write shows the old list back and reads as success.\n return problem({ status: 503, message: `Could not save that change: ${e}` });\n }\n\n // Redirect after POST so a refresh doesn't re-submit.\n return new Response(null, { status: 303, headers: { location: \"/\" } });\n }\n\n if (url.pathname === \"/\") {\n const who = await auth(req);\n // A session store that cannot be read is a 503, not a login page: telling\n // the owner his password is wrong when the database is down would send him\n // to rotate a secret that was never the problem.\n if (!who.ok) return problem(who);\n if (!who.sid) return loginPage(false);\n const stored = await events();\n if (!stored.ok) return problem(stored);\n const done = await taken();\n if (!done.ok) return problem(done);\n // Deliberately not a fourth member of the 503 set above. Events, the\n // taken-list and the sequence map all 503 because serving them wrong is\n // worse than serving nothing — an empty feed reads as \"every event was\n // deleted\", an unreadable taken-list reads as \"you have hidden nothing\".\n // This one has a correct answer for every failure it can have, and that\n // answer is \"unknown\", which the page already knows how to render. Taking\n // the class list down because a decoration is missing would be a\n // regression, so readFullness() swallows and returns an empty map.\n //\n // readFirstSeen() is in the same category and swallows for the same\n // reason. It differs from readFullness() in one respect worth naming: it\n // does reach sqlite, so it can fail the way the taken-list read can — but\n // taken() has already run and already 503'd if the store were unreachable,\n // so what is left here is a failure of that one table, whose right answer\n // is \"nothing is known to be new\". That renders as the page rendered\n // before the badge existed.\n return page(\n stored.events,\n done.keys,\n origin,\n await readFullness(),\n await readFirstSeen(),\n );\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n",[],[88],["D",1788830856989],[],[19],"344e43c2-1842-48d0-8dbf-76d960b13c0f",["D",1788654659900],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","1398b500-45f0-4bf4-90e5-f35150473c2e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a05927-4c0c-73bc-ab9c-dd245be766a5","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_154":150},"org",{"_11":12,"_147":148,"_149":150,"_109":110,"_151":152,"_153":52},"branch",{"_17":90,"_13":16,"_33":39,"_139":100,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":14,"_146":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Cameron Hotchkies","avatar","https://lh3.googleusercontent.com/a/ACg8ocLqBbiwSyhcuAqhs2fRy8Ap0lqA45YFLtS_JtAKAwjEYuXmcXDR=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":100,"_13":14,"_44":199,"_102":-5,"_103":52,"_104":105,"_106":105,"_107":-5,"_108":-5,"_109":110,"_111":89,"_112":43,"_113":-5,"_114":-5,"_115":116,"_117":118,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":124,"_125":124,"_126":127,"_128":127,"_129":127,"_130":124,"_131":124,"_132":200,"_134":201,"_136":202,"_138":52},[184,185,186,187,188],"files",[184,185,186,187,188],"counts",{"_175":116,"_176":83,"_177":116,"_32":178,"_179":180},[],{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":174},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],"pulls","branches","forks",{"_181":83,"_183":116},"connections",{"_181":116,"_182":116},"count","unfilledCount","emptyCount",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":97,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_67":197,"_18":198},{"_33":87,"_13":88,"_35":89,"_37":-5,"_38":39,"_40":90,"_42":43,"_44":91,"_17":92,"_47":93,"_49":94,"_51":52,"_53":-5,"_67":195,"_18":196},{"_33":78,"_13":79,"_35":80,"_37":-5,"_38":39,"_40":81,"_42":43,"_44":82,"_17":83,"_47":65,"_49":84,"_51":52,"_53":-5,"_67":193,"_18":194},{"_33":70,"_13":71,"_35":72,"_37":-5,"_38":39,"_40":73,"_42":43,"_44":74,"_17":46,"_47":65,"_49":75,"_51":52,"_53":-5,"_67":191,"_18":192},{"_33":60,"_13":61,"_35":62,"_37":-5,"_38":39,"_40":63,"_42":43,"_44":64,"_17":46,"_47":65,"_49":66,"_51":52,"_53":-5,"_67":189,"_18":190},[],[61],[],[71],[],[79],[],[88],[],[19],["D",1788654659900],{"_11":12,"_154":150},{"_11":12,"_147":148,"_149":150,"_109":110,"_151":152,"_153":52},{"_17":90,"_13":16,"_33":39,"_139":100,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":14,"_146":12},"ctx",{"_132":-5,"_171":236,"_237":238,"_239":240,"_241":52,"_242":52,"_243":52,"_244":43,"_245":-5,"_246":-7,"_247":-7,"_248":116,"_249":52,"_250":52,"_251":-5,"_252":52,"_253":52,"_254":52,"_255":-5},"ENV",{"_207":208,"_209":210,"_211":16,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]