You don't have access to this dashboard.

\n Ask the owner to add your Val Town username to the{\" \"}\n ADMIN_USERNAMES environment variable.\n

\n \n

\n ,\n 403,\n );\n }\n c.set(\"user\", result);\n await next();\n});\n\nadmin.get(\"/\", c => renderDashboard(c));\n\n/* ---------------------------------- receivers ---------------------------------- */\n\nadmin.post(\"/receivers\", async (c) => {\n const body = await c.req.parseBody({ all: true });\n const input = receiverFromBody(body);\n if (!input.topic) return back(\"err\", \"A topic is required\");\n await db.createReceiver({ ...input, auth: str(body.auth).trim() || null });\n return back(\"ok\", `Receiver “${input.name}” added`);\n});\n\nadmin.post(\"/receivers/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const body = await c.req.parseBody({ all: true });\n const action = str(body._action);\n\n const receiver = await db.getReceiver(id);\n if (!receiver) return back(\"err\", \"Receiver not found\");\n\n if (action === \"delete\") {\n await db.deleteReceiver(id);\n return back(\"ok\", `Receiver “${receiver.name}” deleted`);\n }\n\n if (action === \"test\") {\n const result = await sendTest(receiver, new URL(c.req.url).origin);\n return result.ok\n ? back(\"ok\", `Test sent to ${receiver.server}/${receiver.topic} (filters bypassed)`)\n : back(\"err\", `Test failed (${result.status ?? \"network\"}): ${result.error ?? \"unknown error\"}`);\n }\n\n const input = receiverFromBody(body);\n if (!input.topic) return back(\"err\", \"A topic is required\");\n\n // Auth: blank input keeps the stored secret, \"clear_auth\" removes it.\n const newAuth = str(body.auth).trim();\n const auth = body.clear_auth ? null : newAuth ? newAuth : undefined;\n\n await db.updateReceiver(id, { ...input, ...(auth === undefined ? {} : { auth }) });\n return back(\"ok\", `Receiver “${input.name}” saved`);\n});\n\n/* -------------------------------- filter tester -------------------------------- */\n\nadmin.post(\"/filter-test\", async (c) => {\n const body = await c.req.parseBody();\n const email = str(body.email).trim() || \"someone@example.com\";\n const detailsText = str(body.details);\n\n let details: Record | null = null;\n let parseError: string | undefined;\n const trimmed = detailsText.trim();\n if (trimmed) {\n try {\n const parsed = JSON.parse(trimmed);\n if (parsed === null || typeof parsed !== \"object\" || Array.isArray(parsed)) {\n parseError = \"expected a JSON object, e.g. {\\\"plan\\\": \\\"enterprise\\\"}\";\n } else {\n details = parsed as Record;\n }\n } catch (err: any) {\n parseError = err?.message ?? String(err);\n }\n }\n\n if (parseError) {\n return renderDashboard(c, { email, detailsText, parseError, rows: [] });\n }\n\n const receivers = await db.listReceivers();\n const sample: db.Subscriber = {\n id: 0,\n email,\n details,\n developer_notes: null,\n created_at: \"(dry run)\",\n updated_at: \"(dry run)\",\n };\n\n const rows = receivers.map((receiver) => {\n const decision = decideForReceiver(receiver, sample);\n return {\n receiver: receiver.name,\n enabled: !!receiver.enabled,\n events: receiver.events,\n listens: receiver.events.split(\",\").map(e => e.trim()).includes(\"signup\"),\n send: decision.send,\n outcome: decision.outcome,\n reason: decision.reason,\n };\n });\n\n return renderDashboard(c, { email, detailsText, rows });\n});\n\n/* --------------------------------- subscribers --------------------------------- */\n\nadmin.post(\"/subscribers/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const body = await c.req.parseBody();\n const action = str(body._action);\n\n if (action === \"delete\") {\n await db.deleteSubscriber(id);\n return back(\"ok\", `Signup #${id} deleted`);\n }\n\n await db.updateSubscriber(id, { developer_notes: str(body.developer_notes) });\n return back(\"ok\", `Notes saved for #${id}`);\n});\n","label",[183,67],"admin","pulls","branches",1,"forks","envVars",{"_192":26,"_194":26},"connections",{"_192":26,"_193":26},"count","unfilledCount","emptyCount",{"_35":312,"_13":183,"_65":174,"_45":-5,"_37":38,"_175":299,"_176":168,"_39":313,"_41":26,"_68":274,"_179":-5,"_70":24,"_181":-5,"_215":314,"_17":315},{"_35":304,"_13":305,"_65":306,"_45":174,"_37":38,"_175":307,"_176":168,"_39":308,"_41":26,"_68":69,"_179":309,"_70":24,"_181":-5,"_215":310,"_17":311},{"_35":296,"_13":297,"_65":298,"_45":174,"_37":38,"_175":299,"_176":168,"_39":300,"_41":26,"_68":69,"_179":301,"_70":24,"_181":-5,"_215":302,"_17":303},{"_35":288,"_13":289,"_65":290,"_45":174,"_37":38,"_175":291,"_176":168,"_39":292,"_41":186,"_68":69,"_179":293,"_70":24,"_181":-5,"_215":294,"_17":295},{"_35":280,"_13":281,"_65":282,"_45":174,"_37":38,"_175":283,"_176":168,"_39":284,"_41":26,"_68":69,"_179":285,"_70":24,"_181":-5,"_215":286,"_17":287},{"_35":173,"_13":67,"_65":66,"_45":174,"_37":38,"_175":92,"_176":168,"_39":277,"_41":178,"_68":69,"_179":180,"_70":24,"_181":-5,"_215":278,"_17":279},{"_35":269,"_13":270,"_65":271,"_45":-5,"_37":38,"_175":272,"_176":168,"_39":273,"_41":26,"_68":274,"_179":-5,"_70":24,"_181":-5,"_215":275,"_17":276},{"_35":261,"_13":262,"_65":263,"_45":-5,"_37":38,"_175":137,"_176":168,"_39":264,"_41":265,"_68":21,"_179":266,"_70":24,"_181":-5,"_215":267,"_17":268},{"_35":253,"_13":254,"_65":255,"_45":-5,"_37":38,"_175":256,"_176":168,"_39":257,"_41":26,"_68":69,"_179":258,"_70":24,"_181":-5,"_215":259,"_17":260},{"_35":245,"_13":246,"_65":247,"_45":-5,"_37":38,"_175":248,"_176":168,"_39":249,"_41":186,"_68":69,"_179":250,"_70":24,"_181":-5,"_215":251,"_17":252},{"_35":237,"_13":238,"_65":239,"_45":-5,"_37":38,"_175":240,"_176":168,"_39":241,"_41":223,"_68":69,"_179":242,"_70":24,"_181":-5,"_215":243,"_17":244},{"_35":227,"_13":228,"_65":229,"_45":-5,"_37":38,"_175":230,"_176":168,"_39":231,"_41":232,"_68":233,"_179":234,"_70":24,"_181":14,"_215":235,"_17":236},{"_35":218,"_13":219,"_65":220,"_45":-5,"_37":38,"_175":221,"_176":168,"_39":222,"_41":223,"_68":69,"_179":224,"_70":24,"_181":-5,"_215":225,"_17":226},{"_35":209,"_13":210,"_65":211,"_45":-5,"_37":38,"_175":212,"_176":168,"_39":213,"_41":178,"_68":69,"_179":214,"_70":24,"_181":-5,"_215":216,"_17":217},"3a591dfe-b686-44e1-a3b5-4aef78fe49a7","post-login.ts","51348738-9aff-11f1-9d2d-1607ee4eb77e",34,["D",1787055738792],"/**\n * Return-to-destination across the OAuth round trip.\n *\n * std/oauth's callback page always lands on \"/\" when login happens as a full-page\n * navigation (it only postMessages back when it was opened as a popup), and it has no\n * \"redirect back to X\" option. So we stash the intended path in a short-lived cookie\n * before sending the user to /auth/login, then resume it on the next visit to \"/\".\n */\n\nimport type { Context, Next } from \"npm:hono\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\n\nconst COOKIE = \"post_login_redirect\";\nconst MAX_AGE = 600; // 10 minutes — just long enough to finish logging in\n\nfunction readCookie(req: Request, name: string): string | null {\n const header = req.headers.get(\"Cookie\");\n if (!header) return null;\n for (const part of header.split(\";\")) {\n const [key, ...rest] = part.trim().split(\"=\");\n if (key === name) return rest.join(\"=\") || null;\n }\n return null;\n}\n\n/** Only same-origin absolute paths — never honour a full URL or protocol-relative path. */\nexport function safePath(raw: string): string | null {\n let value: string;\n try {\n value = decodeURIComponent(raw);\n } catch {\n return null;\n }\n if (!value.startsWith(\"/\") || value.startsWith(\"//\")) return null;\n return value;\n}\n\n/** 302 to the Val Town login flow, remembering where the user was headed. */\nexport function loginAndReturnTo(dest: string): Response {\n return new Response(null, {\n status: 302,\n headers: {\n \"Location\": \"/auth/login\",\n // SameSite=None (like std/oauth's own session cookie) so this survives the\n // login round trip even when the app is embedded in an iframe.\n \"Set-Cookie\":\n `${COOKIE}=${encodeURIComponent(dest)}; Path=/; HttpOnly; Secure; SameSite=None; Max-Age=${MAX_AGE}`,\n },\n });\n}\n\n/**\n * Mount on GET \"/\" ahead of the API docs route: if the visitor just came back from\n * login and has a pending destination, send them there instead.\n */\nexport async function resumeAfterLogin(c: Context, next: Next) {\n const cookie = readCookie(c.req.raw, COOKIE);\n const dest = cookie ? safePath(cookie) : null;\n\n if (dest && await getOAuthUserData(c.req.raw)) {\n return new Response(null, {\n status: 302,\n headers: {\n \"Location\": dest,\n \"Set-Cookie\": `${COOKIE}=; Path=/; HttpOnly; Secure; SameSite=None; Max-Age=0`,\n },\n });\n }\n\n await next();\n}\n","children",[],[210],"e5b64d47-fef3-4af3-8a9c-c9e96f6d3b2e","ntfy.ts","c9b89cf0-9af8-11f1-9164-1607ee4eb77e",50,["D",1787078354879],2,"/**\n * ntfy.sh publishing.\n *\n * Uses ntfy's \"publish as JSON\" API: POST the message object (including `topic`)\n * to the server ROOT url — not the topic url.\n * https://docs.ntfy.sh/publish/#publish-as-json\n *\n * Auth (https://docs.ntfy.sh/publish/#authentication):\n * - access token -> Authorization: Bearer tk_…\n * - user:password -> Authorization: Basic base64(user:password)\n *\n * FORMATTING: messages are PLAIN TEXT on purpose. ntfy renders Markdown in the web app only\n * (https://docs.ntfy.sh/publish/#markdown-formatting) — the Android/iOS apps show the raw\n * characters, so `**bold**` and `- item` arrive as literal punctuation on a phone. Multi-line\n * \"key: value\" text looks correct on every client, so that's what we send.\n */\n\nimport {\n logDelivery,\n type NtfyEvent,\n type Receiver,\n receiversForEvent,\n type Subscriber,\n} from \"./db.ts\";\nimport { type Decision, evaluateFilter, parseFilter } from \"./filter.ts\";\n\nexport interface NtfyMessage {\n topic: string;\n message: string;\n title?: string;\n tags?: string[];\n priority?: number;\n click?: string;\n actions?: Array<{ action: string; label: string; url?: string; clear?: boolean }>;\n}\n\nexport interface PublishResult {\n ok: boolean;\n status: number | null;\n error: string | null;\n}\n\n/** What happened for one receiver on one event. */\nexport interface NotifyResult {\n receiver: string;\n outcome: \"sent\" | \"failed\" | \"skipped\";\n reason: string | null;\n}\n\nfunction authHeader(auth: string | null): Record {\n const value = auth?.trim();\n if (!value) return {};\n // Access tokens are prefixed tk_; anything with a colon is user:password.\n if (value.startsWith(\"tk_\") || !value.includes(\":\")) {\n return { Authorization: `Bearer ${value}` };\n }\n return { Authorization: `Basic ${btoa(value)}` };\n}\n\nexport function normalizeServer(server: string): string {\n const trimmed = (server || \"https://ntfy.sh\").trim().replace(/\\/+$/, \"\");\n return /^https?:\\/\\//.test(trimmed) ? trimmed : `https://${trimmed}`;\n}\n\n/** Publish a single message to one receiver's server + topic. */\nexport async function publish(\n receiver: Pick,\n message: Omit & { tags?: string[] },\n): Promise {\n const body: NtfyMessage = {\n topic: receiver.topic.trim(),\n priority: receiver.priority,\n tags: message.tags ?? receiver.tags?.split(\",\").map(t => t.trim()).filter(Boolean),\n ...message,\n };\n\n try {\n const res = await fetch(normalizeServer(receiver.server) + \"/\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\", ...authHeader(receiver.auth) },\n body: JSON.stringify(body),\n signal: AbortSignal.timeout(10_000),\n });\n if (!res.ok) {\n const text = (await res.text().catch(() => \"\")).slice(0, 300);\n return { ok: false, status: res.status, error: text || res.statusText };\n }\n await res.body?.cancel();\n return { ok: true, status: res.status, error: null };\n } catch (err: any) {\n return { ok: false, status: null, error: err?.message ?? String(err) };\n }\n}\n\n/* -------------------------------- message shaping -------------------------------- */\n\n/** Keep notifications glanceable, and well under ntfy's 4,096 byte message limit. */\nconst MAX_FIELDS = 12;\nconst MAX_VALUE_CHARS = 120;\n\nfunction formatValue(value: unknown): string {\n if (value === null || value === undefined) return \"—\";\n if (typeof value === \"string\") return value.trim() || \"—\";\n if (typeof value === \"object\") return JSON.stringify(value);\n return String(value);\n}\n\n/** Collapse to one line and clip, so one long answer can't swamp the notification. */\nfunction oneLine(text: string, max = MAX_VALUE_CHARS): string {\n const flat = text.replace(/\\s*[\\r\\n]+\\s*/g, \" \").trim();\n return flat.length > max ? `${flat.slice(0, max - 1)}…` : flat;\n}\n\nfunction detailLines(details: Record | null): string[] {\n if (!details) return [];\n const entries = Object.entries(details);\n const lines = entries\n .slice(0, MAX_FIELDS)\n .map(([key, value]) => `${key}: ${oneLine(formatValue(value))}`);\n const hidden = entries.length - MAX_FIELDS;\n if (hidden > 0) lines.push(`(+${hidden} more field${hidden === 1 ? \"\" : \"s\"})`);\n return lines;\n}\n\nexport function buildMessage(\n event: NtfyEvent,\n subscriber: Subscriber,\n adminUrl?: string,\n): Omit {\n const fields = detailLines(subscriber.details);\n const lines = [subscriber.email];\n if (fields.length) lines.push(\"\", ...fields);\n lines.push(\"\", `signup #${subscriber.id} · ${subscriber.created_at} UTC`);\n\n return {\n title: event === \"signup\" ? \"New newsletter signup\" : \"Newsletter signup updated\",\n message: lines.join(\"\\n\"),\n click: adminUrl,\n actions: adminUrl\n ? [{ action: \"view\", label: \"Open admin\", url: adminUrl, clear: false }]\n : undefined,\n };\n}\n\n/* ----------------------------------- dispatch ------------------------------------ */\n\n/** Run a receiver's filter against a signup. Never throws; a broken filter sends anyway. */\nexport function decideForReceiver(receiver: Receiver, subscriber: Subscriber): Decision {\n return evaluateFilter(\n parseFilter(receiver.filter),\n receiver.filter_mode,\n { email: subscriber.email, details: subscriber.details },\n );\n}\n\n/**\n * Fan a signup event out to every enabled receiver whose filter matches.\n * Never throws — sends, failures and filtered-out skips all land in ntfy_deliveries\n * so the dashboard can explain why a notification did or didn't arrive.\n */\nexport async function notify(\n event: NtfyEvent,\n subscriber: Subscriber,\n origin?: string,\n): Promise {\n const receivers = await receiversForEvent(event).catch(() => []);\n if (!receivers.length) return [];\n\n const adminUrl = origin ? `${origin.replace(/\\/+$/, \"\")}/admin` : undefined;\n const payload = buildMessage(event, subscriber, adminUrl);\n\n return await Promise.all(receivers.map(async (receiver): Promise => {\n const decision = decideForReceiver(receiver, subscriber);\n\n if (!decision.send) {\n await logDelivery({\n receiver_id: receiver.id,\n receiver_name: receiver.name,\n subscriber_id: subscriber.id,\n event,\n outcome: \"skipped\",\n status: null,\n error: decision.reason,\n }).catch(() => {});\n return { receiver: receiver.name, outcome: \"skipped\", reason: decision.reason };\n }\n\n const result = await publish(receiver, payload);\n if (!result.ok) {\n console.error(\n `ntfy: ${receiver.name} (${receiver.topic}) failed:`,\n result.status,\n result.error,\n );\n }\n await logDelivery({\n receiver_id: receiver.id,\n receiver_name: receiver.name,\n subscriber_id: subscriber.id,\n event,\n outcome: result.ok ? \"sent\" : \"failed\",\n status: result.status,\n error: result.ok ? null : result.error,\n }).catch(() => {});\n return {\n receiver: receiver.name,\n outcome: result.ok ? \"sent\" : \"failed\",\n reason: result.ok ? decision.reason : result.error,\n };\n }));\n}\n\n/** Send a \"does this config work?\" message to one receiver. Bypasses the filter on purpose. */\nexport async function sendTest(receiver: Receiver, origin?: string): Promise {\n const adminUrl = origin ? `${origin.replace(/\\/+$/, \"\")}/admin` : undefined;\n const result = await publish(receiver, {\n title: \"Newsletter signup test\",\n message: `Test notification for \"${receiver.name}\".\\nIf you can read this, alerts work. 🎉`,\n click: adminUrl,\n });\n await logDelivery({\n receiver_id: receiver.id,\n receiver_name: receiver.name,\n subscriber_id: null,\n event: \"test\",\n outcome: result.ok ? \"sent\" : \"failed\",\n status: result.status,\n error: result.error,\n }).catch(() => {});\n return result;\n}\n",[],[219],"d965e792-2865-42ad-86c7-3fecac2e98be","main.ts","d73071ea-fed2-11f0-a1dd-42dde27851f2",31,["D",1787055692887],16,"http","/**\n * Newsletter Signup API + ntfy.sh alerts + admin dashboard.\n *\n * Routes:\n * - POST /subscribe public signup, pushes to every enabled ntfy receiver\n * - PUT /subscribe/:id/details public, merge extra info into a signup\n * - GET /subscribers list signups (X-API-Key: ADMIN_API_KEY)\n * - PUT /subscribers/:id update details / developer notes (X-API-Key)\n * - DELETE /subscribers/:id remove a signup (X-API-Key)\n * - GET /admin dashboard behind Val Town login\n * - GET /auth/login|callback, POST /auth/logout provided by std/oauth\n *\n * Environment variables:\n * - ADMIN_API_KEY (optional) enables the X-API-Key JSON admin endpoints\n * - ADMIN_USERNAMES (optional) extra Val Town usernames allowed into /admin,\n * comma-separated. Members of this val's org always have access.\n *\n * ntfy receivers are configured in the dashboard, not in env vars — see db.ts / ntfy.ts.\n */\n\nimport { Hono } from \"npm:hono\";\nimport { oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { admin } from \"./admin/routes.tsx\";\nimport { api } from \"./api.ts\";\nimport { resumeAfterLogin } from \"./post-login.ts\";\n\nconst app = new Hono();\napp.onError((err) => Promise.reject(err));\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.route(\"/admin\", admin);\n// Login always returns to \"/\" — bounce back to wherever the user was headed.\napp.get(\"/\", resumeAfterLogin);\napp.route(\"/\", api);\n\nexport default oauthMiddleware(app.fetch);\n",[],[228],"98787bc4-40f7-4c14-8363-b75858353a21","filter.ts","1685ed6a-9b00-11f1-bb89-1607ee4eb77e",41,["D",1787056066921],"/**\n * Per-receiver notification filters.\n *\n * A filter is plain text, one rule per line, so it round-trips through a textarea with no\n * client-side JS and stays readable in the database:\n *\n * plan = enterprise # equals (case-insensitive, numeric-aware)\n * company exists # field was provided and isn't empty\n * phone missing # field absent / null / empty\n * country in US, CA, MX # any of\n * email ~ @acme.com # contains\n * seats >= 10 # numeric comparison\n * # comments and blank lines are ignored\n *\n * Paths are resolved against the signup's `details` object, plus `email` at the top level.\n * Dot/bracket paths reach into nested data: `utm.source`, `answers[0].value`.\n *\n * Design decisions worth knowing:\n * - A filter that fails to parse FAILS OPEN (the notification is still sent, and the error is\n * surfaced in the dashboard). Losing a signup alert to a typo is worse than an extra push.\n * - Array values match if ANY element matches, so `interests = ai` works on `[\"ai\",\"design\"]`.\n * - `!=` is also true when the field is absent. Pair it with `exists` if you need presence.\n * - `false` and `0` count as present — they were deliberately submitted.\n */\n\nexport type Op =\n | \"exists\"\n | \"missing\"\n | \"eq\"\n | \"neq\"\n | \"contains\"\n | \"in\"\n | \"gt\"\n | \"gte\"\n | \"lt\"\n | \"lte\";\n\nexport type MatchMode = \"all\" | \"any\";\n\nexport interface Rule {\n path: string;\n op: Op;\n value: string;\n source: string;\n}\n\nexport interface FilterError {\n line: number;\n source: string;\n message: string;\n}\n\nexport interface ParsedFilter {\n rules: Rule[];\n errors: FilterError[];\n}\n\nexport interface Scope {\n email: string;\n details: Record | null;\n}\n\nexport type Decision = {\n /** Should the notification go out? */\n send: boolean;\n outcome: \"no-filter\" | \"match\" | \"no-match\" | \"error\";\n /** Human-readable explanation, shown in the dashboard and delivery log. */\n reason: string;\n};\n\nconst OP_ALIASES: Record = {\n \"=\": \"eq\",\n \"==\": \"eq\",\n \"is\": \"eq\",\n \"!=\": \"neq\",\n \"<>\": \"neq\",\n \"isnt\": \"neq\",\n \"~\": \"contains\",\n \"contains\": \"contains\",\n \"includes\": \"contains\",\n \"in\": \"in\",\n \">\": \"gt\",\n \">=\": \"gte\",\n \"<\": \"lt\",\n \"<=\": \"lte\",\n \"exists\": \"exists\",\n \"present\": \"exists\",\n \"has\": \"exists\",\n \"missing\": \"missing\",\n \"absent\": \"missing\",\n \"empty\": \"missing\",\n};\n\nconst OP_LABELS: Record = {\n exists: \"exists\",\n missing: \"missing\",\n eq: \"=\",\n neq: \"!=\",\n contains: \"~\",\n in: \"in\",\n gt: \">\",\n gte: \">=\",\n lt: \"<\",\n lte: \"<=\",\n};\n\nconst NUMERIC_OPS: Op[] = [\"gt\", \"gte\", \"lt\", \"lte\"];\nconst VALUELESS_OPS: Op[] = [\"exists\", \"missing\"];\n\n// path, then a symbol or word operator, then the rest of the line as the value.\nconst LINE_RE = /^([A-Za-z0-9_\\-.[\\]]+)\\s*(!=|<>|>=|<=|==|=|~|>|<|[A-Za-z]+)\\s*(.*)$/;\n\nfunction unquote(value: string): string {\n const trimmed = value.trim();\n if (isQuoted(trimmed)) return trimmed.slice(1, -1);\n return trimmed;\n}\n\nfunction isQuoted(value: string): boolean {\n if (value.length < 2) return false;\n const first = value[0];\n return (first === '\"' || first === \"'\") && first === value[value.length - 1];\n}\n\n/**\n * A value made only of operator punctuation is almost certainly a typo'd operator\n * (`plan === pro` → path `plan`, op `==`, value `=`). Left alone it would compile to a rule\n * that can never match, silently swallowing every notification — so reject it loudly and\n * let the fail-open path take over. Quote the value if you really mean it (`mood = \"<3\"`).\n */\nconst OPERATOR_ONLY_RE = /^[=!~<>]+$/;\n\nexport function parseFilter(raw: string | null | undefined): ParsedFilter {\n const rules: Rule[] = [];\n const errors: FilterError[] = [];\n\n (raw ?? \"\").split(/\\r?\\n/).forEach((line, index) => {\n const source = line.trim();\n if (!source || source.startsWith(\"#\")) return;\n\n const lineNumber = index + 1;\n const match = LINE_RE.exec(source);\n if (!match) {\n errors.push({\n line: lineNumber,\n source,\n message: \"expected `field operator value`, e.g. `plan = enterprise`\",\n });\n return;\n }\n\n const [, path, rawOp, rest] = match;\n const op = OP_ALIASES[rawOp.toLowerCase()];\n if (!op) {\n errors.push({ line: lineNumber, source, message: `unknown operator “${rawOp}”` });\n return;\n }\n\n // Strip trailing comments from the value, but only when clearly a comment.\n const withoutComment = rest.replace(/\\s+#.*$/, \"\").trim();\n const quoted = isQuoted(withoutComment);\n const value = VALUELESS_OPS.includes(op) ? \"\" : unquote(withoutComment);\n\n if (!VALUELESS_OPS.includes(op) && value === \"\") {\n errors.push({ line: lineNumber, source, message: `“${rawOp}” needs a value` });\n return;\n }\n if (!quoted && OPERATOR_ONLY_RE.test(value)) {\n errors.push({\n line: lineNumber,\n source,\n message: `“${value}” isn't a value — check the operator, or quote it as \"${value}\"`,\n });\n return;\n }\n if (NUMERIC_OPS.includes(op) && !Number.isFinite(Number(value))) {\n errors.push({\n line: lineNumber,\n source,\n message: `“${rawOp}” needs a number, got “${value}”`,\n });\n return;\n }\n if (op === \"in\" && splitList(value).length === 0) {\n errors.push({ line: lineNumber, source, message: \"`in` needs a comma-separated list\" });\n return;\n }\n\n rules.push({ path, op, value, source });\n });\n\n return { rules, errors };\n}\n\nfunction splitList(value: string): string[] {\n return value.split(\",\").map(v => unquote(v)).filter(v => v !== \"\");\n}\n\n/** Signup fields visible to filters: everything in `details`, plus `email`. */\nexport function buildScope(scope: Scope): Record {\n // details wins on collision — a submitted `details.email` is the more specific value.\n return { email: scope.email, ...(scope.details ?? {}) };\n}\n\nfunction tokenizePath(path: string): string[] {\n return path\n .replace(/\\[(\\d+)\\]/g, \".$1\")\n .split(\".\")\n .filter(segment => segment !== \"\");\n}\n\nexport function resolvePath(path: string, root: Record): unknown {\n let current: unknown = root;\n for (const segment of tokenizePath(path)) {\n if (current === null || current === undefined) return undefined;\n if (Array.isArray(current)) {\n const index = Number(segment);\n if (!Number.isInteger(index)) return undefined;\n current = current[index];\n continue;\n }\n if (typeof current !== \"object\") return undefined;\n current = (current as Record)[segment];\n }\n return current;\n}\n\n/** Present = supplied and not blank. `false` and `0` are present; \"\" and [] are not. */\nexport function isPresent(value: unknown): boolean {\n if (value === undefined || value === null) return false;\n if (typeof value === \"string\") return value.trim() !== \"\";\n if (Array.isArray(value)) return value.some(isPresent);\n if (typeof value === \"object\") return Object.keys(value as object).length > 0;\n return true;\n}\n\nfunction normalize(value: unknown): string {\n if (typeof value === \"string\") return value.trim().toLowerCase();\n if (value === null || value === undefined) return \"\";\n if (typeof value === \"object\") return JSON.stringify(value).toLowerCase();\n return String(value).toLowerCase();\n}\n\nfunction equals(value: unknown, target: string): boolean {\n if (Array.isArray(value)) return value.some(item => equals(item, target));\n const left = normalize(value);\n const right = target.trim().toLowerCase();\n if (left === right) return true;\n const leftNumber = Number(left);\n const rightNumber = Number(right);\n return left !== \"\" && right !== \"\" &&\n Number.isFinite(leftNumber) && Number.isFinite(rightNumber) &&\n leftNumber === rightNumber;\n}\n\nfunction containsText(value: unknown, target: string): boolean {\n if (Array.isArray(value)) return value.some(item => containsText(item, target));\n if (!isPresent(value)) return false;\n return normalize(value).includes(target.trim().toLowerCase());\n}\n\nfunction compareNumeric(value: unknown, target: string, op: Op): boolean {\n if (Array.isArray(value)) return value.some(item => compareNumeric(item, target, op));\n const left = typeof value === \"boolean\" ? NaN : Number(normalize(value));\n const right = Number(target);\n if (!Number.isFinite(left) || !Number.isFinite(right)) return false;\n switch (op) {\n case \"gt\":\n return left > right;\n case \"gte\":\n return left >= right;\n case \"lt\":\n return left < right;\n case \"lte\":\n return left <= right;\n default:\n return false;\n }\n}\n\nexport function testRule(rule: Rule, root: Record): boolean {\n const value = resolvePath(rule.path, root);\n switch (rule.op) {\n case \"exists\":\n return isPresent(value);\n case \"missing\":\n return !isPresent(value);\n case \"eq\":\n return equals(value, rule.value);\n case \"neq\":\n // Absent counts as \"not equal\" — documented, pair with `exists` if you need presence.\n return !equals(value, rule.value);\n case \"contains\":\n return containsText(value, rule.value);\n case \"in\":\n return splitList(rule.value).some(item => equals(value, item));\n case \"gt\":\n case \"gte\":\n case \"lt\":\n case \"lte\":\n return compareNumeric(value, rule.value, rule.op);\n default:\n return false;\n }\n}\n\nexport function ruleToText(rule: Rule): string {\n const label = OP_LABELS[rule.op];\n return VALUELESS_OPS.includes(rule.op)\n ? `${rule.path} ${label}`\n : `${rule.path} ${label} ${rule.value}`;\n}\n\nfunction preview(value: unknown): string {\n if (value === undefined) return \"absent\";\n if (value === null) return \"null\";\n const text = typeof value === \"string\" ? value : JSON.stringify(value);\n const trimmed = String(text);\n return trimmed.length > 60 ? `${trimmed.slice(0, 57)}…` : trimmed;\n}\n\n/** Decide whether a receiver should be notified about this signup. */\nexport function evaluateFilter(\n parsed: ParsedFilter,\n mode: MatchMode,\n scope: Scope,\n): Decision {\n if (parsed.errors.length) {\n const first = parsed.errors[0];\n return {\n send: true,\n outcome: \"error\",\n reason: `filter error on line ${first.line} (${first.message}) — sent anyway`,\n };\n }\n\n if (!parsed.rules.length) {\n return { send: true, outcome: \"no-filter\", reason: \"no filter\" };\n }\n\n const root = buildScope(scope);\n const results = parsed.rules.map(rule => ({ rule, pass: testRule(rule, root) }));\n\n if (mode === \"any\") {\n const hit = results.find(r => r.pass);\n if (hit) {\n return { send: true, outcome: \"match\", reason: `matched ${ruleToText(hit.rule)}` };\n }\n return {\n send: false,\n outcome: \"no-match\",\n reason: `no rule matched (${parsed.rules.length} tried)`,\n };\n }\n\n const miss = results.find(r => !r.pass);\n if (miss) {\n const actual = preview(resolvePath(miss.rule.path, root));\n return {\n send: false,\n outcome: \"no-match\",\n reason: `failed ${ruleToText(miss.rule)} — ${miss.rule.path} is ${actual}`,\n };\n }\n return {\n send: true,\n outcome: \"match\",\n reason: `matched all ${parsed.rules.length} rule${parsed.rules.length === 1 ? \"\" : \"s\"}`,\n };\n}\n\n/** Short label for the dashboard, e.g. \"2 rules · all must match\". */\nexport function summarizeFilter(raw: string | null, mode: MatchMode): string {\n const parsed = parseFilter(raw);\n if (parsed.errors.length) {\n return `${parsed.errors.length} error${parsed.errors.length === 1 ? \"\" : \"s\"} — sends everything`;\n }\n if (!parsed.rules.length) return \"no filter — notifies on every matching event\";\n const count = `${parsed.rules.length} rule${parsed.rules.length === 1 ? \"\" : \"s\"}`;\n return mode === \"any\" ? `${count} · any may match` : `${count} · all must match`;\n}\n",[],[238],"9e1cd65d-a4f9-491e-8c50-f359f40ee992","db.ts","bddbfe22-9af8-11f1-9164-1607ee4eb77e",42,["D",1787056142588],"/**\n * Database schema + queries.\n *\n * Tables:\n * - newsletter_subscribers: signups (email + flexible JSON details + notes)\n * - ntfy_receivers: configurable ntfy.sh destinations, each with an optional filter\n * - ntfy_deliveries: audit log of notification attempts (sent / failed / skipped)\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport type { MatchMode } from \"./filter.ts\";\n\nexport type NtfyEvent = \"signup\" | \"details\";\nexport type DeliveryOutcome = \"sent\" | \"failed\" | \"skipped\";\n\nexport interface Subscriber {\n id: number;\n email: string;\n details: Record | null;\n developer_notes: string | null;\n created_at: string;\n updated_at: string;\n}\n\nexport interface Receiver {\n id: number;\n name: string;\n server: string;\n topic: string;\n priority: number;\n tags: string | null;\n /** ntfy access token (tk_…) or \"user:password\" for basic auth. */\n auth: string | null;\n /** Comma-separated list of NtfyEvent values. */\n events: string;\n /** Filter rules, one per line — see filter.ts. Null/empty means \"notify always\". */\n filter: string | null;\n filter_mode: MatchMode;\n enabled: number;\n created_at: string;\n updated_at: string;\n}\n\nexport interface Delivery {\n id: number;\n receiver_id: number | null;\n receiver_name: string;\n subscriber_id: number | null;\n event: string;\n outcome: DeliveryOutcome;\n ok: number;\n status: number | null;\n /** Failure message, or the filter reason for skipped deliveries. */\n error: string | null;\n created_at: string;\n}\n\nawait sqlite.execute(`\n CREATE TABLE IF NOT EXISTS newsletter_subscribers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL,\n details TEXT,\n developer_notes TEXT,\n created_at TEXT DEFAULT (datetime('now')),\n updated_at TEXT DEFAULT (datetime('now'))\n )\n`);\n\nawait sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ntfy_receivers (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL,\n server TEXT NOT NULL DEFAULT 'https://ntfy.sh',\n topic TEXT NOT NULL,\n priority INTEGER NOT NULL DEFAULT 3,\n tags TEXT,\n auth TEXT,\n events TEXT NOT NULL DEFAULT 'signup',\n filter TEXT,\n filter_mode TEXT NOT NULL DEFAULT 'all',\n enabled INTEGER NOT NULL DEFAULT 1,\n created_at TEXT DEFAULT (datetime('now')),\n updated_at TEXT DEFAULT (datetime('now'))\n )\n`);\n\nawait sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ntfy_deliveries (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n receiver_id INTEGER,\n receiver_name TEXT NOT NULL,\n subscriber_id INTEGER,\n event TEXT NOT NULL,\n outcome TEXT NOT NULL DEFAULT 'sent',\n ok INTEGER NOT NULL,\n status INTEGER,\n error TEXT,\n created_at TEXT DEFAULT (datetime('now'))\n )\n`);\n\n/** Adds columns to already-existing tables (SQLite has no IF NOT EXISTS for columns). */\nasync function ensureColumns(table: string, columns: Record) {\n const info = await sqlite.execute(`PRAGMA table_info(${table})`);\n const existing = new Set(\n info.rows.map((row: any) => String(row.name ?? row[1] ?? \"\")),\n );\n for (const [name, definition] of Object.entries(columns)) {\n if (existing.has(name)) continue;\n await sqlite.execute(`ALTER TABLE ${table} ADD COLUMN ${name} ${definition}`);\n }\n}\n\nawait ensureColumns(\"ntfy_receivers\", {\n filter: \"TEXT\",\n filter_mode: \"TEXT NOT NULL DEFAULT 'all'\",\n});\nawait ensureColumns(\"ntfy_deliveries\", {\n outcome: \"TEXT NOT NULL DEFAULT 'sent'\",\n});\n\nfunction parseDetails(raw: unknown): Record | null {\n if (!raw || typeof raw !== \"string\") return null;\n try {\n return JSON.parse(raw);\n } catch {\n return { _unparsed: raw };\n }\n}\n\nfunction toSubscriber(row: any): Subscriber {\n return {\n id: Number(row.id),\n email: String(row.email),\n details: parseDetails(row.details),\n developer_notes: row.developer_notes ?? null,\n created_at: String(row.created_at),\n updated_at: String(row.updated_at),\n };\n}\n\n/* ---------------------------------- subscribers --------------------------------- */\n\nexport async function insertSubscriber(email: string, details: unknown): Promise {\n const res = await sqlite.execute({\n sql: \"INSERT INTO newsletter_subscribers (email, details) VALUES (?, ?)\",\n args: [email, details ? JSON.stringify(details) : null],\n });\n return Number(res.lastInsertRowid);\n}\n\nexport async function getSubscriber(id: number | string): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM newsletter_subscribers WHERE id = ?\",\n args: [id],\n });\n return res.rows.length ? toSubscriber(res.rows[0]) : null;\n}\n\nexport async function listSubscribers(limit = 500): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM newsletter_subscribers ORDER BY id DESC LIMIT ?\",\n args: [limit],\n });\n return res.rows.map(toSubscriber);\n}\n\nexport async function countSubscribers(): Promise {\n const res = await sqlite.execute(\"SELECT COUNT(*) AS n FROM newsletter_subscribers\");\n return Number((res.rows[0] as any).n);\n}\n\n/** Shallow-merges `details` into the subscriber's existing details. */\nexport async function mergeSubscriberDetails(\n id: number | string,\n details: Record,\n): Promise | null> {\n const existing = await getSubscriber(id);\n if (!existing) return null;\n const merged = { ...(existing.details ?? {}), ...details };\n await sqlite.execute({\n sql: \"UPDATE newsletter_subscribers SET details = ?, updated_at = datetime('now') WHERE id = ?\",\n args: [JSON.stringify(merged), id],\n });\n return merged;\n}\n\nexport async function updateSubscriber(\n id: number | string,\n fields: { details?: unknown; developer_notes?: string },\n): Promise {\n const updates: string[] = [];\n const args: any[] = [];\n if (fields.details !== undefined) {\n updates.push(\"details = ?\");\n args.push(fields.details ? JSON.stringify(fields.details) : null);\n }\n if (fields.developer_notes !== undefined) {\n updates.push(\"developer_notes = ?\");\n args.push(fields.developer_notes);\n }\n if (!updates.length) return false;\n updates.push(\"updated_at = datetime('now')\");\n args.push(id);\n await sqlite.execute({\n sql: `UPDATE newsletter_subscribers SET ${updates.join(\", \")} WHERE id = ?`,\n args,\n });\n return true;\n}\n\nexport async function deleteSubscriber(id: number | string): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM newsletter_subscribers WHERE id = ?\",\n args: [id],\n });\n}\n\n/* ----------------------------------- receivers ---------------------------------- */\n\nfunction toReceiver(row: any): Receiver {\n return {\n id: Number(row.id),\n name: String(row.name),\n server: String(row.server),\n topic: String(row.topic),\n priority: Number(row.priority),\n tags: row.tags ?? null,\n auth: row.auth ?? null,\n events: String(row.events),\n filter: row.filter ?? null,\n filter_mode: row.filter_mode === \"any\" ? \"any\" : \"all\",\n enabled: Number(row.enabled),\n created_at: String(row.created_at),\n updated_at: String(row.updated_at),\n };\n}\n\nexport async function listReceivers(): Promise {\n const res = await sqlite.execute(\"SELECT * FROM ntfy_receivers ORDER BY id ASC\");\n return res.rows.map(toReceiver);\n}\n\nexport async function getReceiver(id: number | string): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM ntfy_receivers WHERE id = ?\",\n args: [id],\n });\n return res.rows.length ? toReceiver(res.rows[0]) : null;\n}\n\n/** Enabled receivers subscribed to a given event (filters are applied later, per signup). */\nexport async function receiversForEvent(event: NtfyEvent): Promise {\n const all = await listReceivers();\n return all.filter(r => r.enabled && r.events.split(\",\").map(e => e.trim()).includes(event));\n}\n\nexport type ReceiverInput = {\n name: string;\n server: string;\n topic: string;\n priority: number;\n tags: string | null;\n auth: string | null;\n events: string;\n filter: string | null;\n filter_mode: MatchMode;\n enabled: number;\n};\n\nexport async function createReceiver(input: ReceiverInput): Promise {\n const res = await sqlite.execute({\n sql: `INSERT INTO ntfy_receivers\n (name, server, topic, priority, tags, auth, events, filter, filter_mode, enabled)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n input.name,\n input.server,\n input.topic,\n input.priority,\n input.tags,\n input.auth,\n input.events,\n input.filter,\n input.filter_mode,\n input.enabled,\n ],\n });\n return Number(res.lastInsertRowid);\n}\n\nexport async function updateReceiver(\n id: number | string,\n input: Partial,\n): Promise {\n const updates: string[] = [];\n const args: any[] = [];\n for (const [key, value] of Object.entries(input)) {\n if (value === undefined) continue;\n updates.push(`${key} = ?`);\n args.push(value as any);\n }\n if (!updates.length) return;\n updates.push(\"updated_at = datetime('now')\");\n args.push(id);\n await sqlite.execute({\n sql: `UPDATE ntfy_receivers SET ${updates.join(\", \")} WHERE id = ?`,\n args,\n });\n}\n\nexport async function deleteReceiver(id: number | string): Promise {\n await sqlite.execute({ sql: \"DELETE FROM ntfy_receivers WHERE id = ?\", args: [id] });\n}\n\n/* ---------------------------------- deliveries ---------------------------------- */\n\nexport async function logDelivery(entry: {\n receiver_id: number | null;\n receiver_name: string;\n subscriber_id: number | null;\n event: string;\n outcome: DeliveryOutcome;\n status: number | null;\n error: string | null;\n}): Promise {\n await sqlite.execute({\n sql: `INSERT INTO ntfy_deliveries\n (receiver_id, receiver_name, subscriber_id, event, outcome, ok, status, error)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n entry.receiver_id,\n entry.receiver_name,\n entry.subscriber_id,\n entry.event,\n entry.outcome,\n entry.outcome === \"sent\" ? 1 : 0,\n entry.status,\n entry.error,\n ],\n });\n}\n\nexport async function recentDeliveries(limit = 25): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT * FROM ntfy_deliveries ORDER BY id DESC LIMIT ?\",\n args: [limit],\n });\n return res.rows.map((row: any) => ({\n id: Number(row.id),\n receiver_id: row.receiver_id === null ? null : Number(row.receiver_id),\n receiver_name: String(row.receiver_name),\n subscriber_id: row.subscriber_id === null ? null : Number(row.subscriber_id),\n event: String(row.event),\n outcome: (row.outcome ?? (Number(row.ok) ? \"sent\" : \"failed\")) as DeliveryOutcome,\n ok: Number(row.ok),\n status: row.status === null ? null : Number(row.status),\n error: row.error ?? null,\n created_at: String(row.created_at),\n }));\n}\n",[],[246],"3ba4ab03-e1a6-49e6-9561-a3bd02238abd","api.ts","d6ea0706-9af8-11f1-bee9-1607ee4eb77e",19,["D",1787052897308],"/**\n * Public + API-key protected JSON API.\n * Response shapes are unchanged from the original version, so existing clients keep working.\n */\n\nimport { Hono } from \"npm:hono\";\nimport { cors } from \"npm:hono/cors\";\nimport * as db from \"./db.ts\";\nimport { notify } from \"./ntfy.ts\";\n\nconst EMAIL_RE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nfunction isAuthorized(req: Request): boolean {\n const adminKey = Deno.env.get(\"ADMIN_API_KEY\");\n return !!adminKey && req.headers.get(\"X-API-Key\") === adminKey;\n}\n\nexport const api = new Hono();\n\napi.use(\n \"*\",\n cors({\n origin: \"*\",\n allowMethods: [\"GET\", \"POST\", \"PUT\", \"DELETE\", \"OPTIONS\"],\n allowHeaders: [\"Content-Type\", \"X-API-Key\"],\n }),\n);\n\n/* -------------------------------- public routes -------------------------------- */\n\n// POST /subscribe — sign up, then alert every enabled ntfy receiver\napi.post(\"/subscribe\", async (c) => {\n const body = await c.req.json().catch(() => ({} as any));\n const { email, details } = body ?? {};\n\n if (!email || typeof email !== \"string\") {\n return c.json({ error: \"Email is required\" }, 400);\n }\n if (!EMAIL_RE.test(email)) {\n return c.json({ error: \"Invalid email format\" }, 400);\n }\n\n const id = await db.insertSubscriber(email.toLowerCase().trim(), details);\n\n // Notify receivers. Failures are logged, never surfaced to the subscriber.\n const subscriber = await db.getSubscriber(id);\n if (subscriber) {\n await notify(\"signup\", subscriber, new URL(c.req.url).origin).catch((err) =>\n console.error(\"ntfy notify failed:\", err)\n );\n }\n\n return c.json({ success: true, message: \"Successfully subscribed!\", id }, 201);\n});\n\n// PUT /subscribe/:id/details — merge extra info collected after signup\napi.put(\"/subscribe/:id/details\", async (c) => {\n const id = c.req.param(\"id\");\n if (!/^\\d+$/.test(id)) return c.json({ error: \"Invalid id\" }, 400);\n\n const body = await c.req.json().catch(() => ({} as any));\n const { details } = body ?? {};\n if (details === undefined || details === null || typeof details !== \"object\") {\n return c.json({ error: \"details object is required\" }, 400);\n }\n\n const merged = await db.mergeSubscriberDetails(id, details);\n if (!merged) return c.json({ error: \"Subscriber not found\" }, 404);\n\n const subscriber = await db.getSubscriber(id);\n if (subscriber) {\n await notify(\"details\", subscriber, new URL(c.req.url).origin).catch((err) =>\n console.error(\"ntfy notify failed:\", err)\n );\n }\n\n return c.json({ success: true, message: \"Details updated\", details: merged });\n});\n\n/* ------------------------- API-key protected admin routes ----------------------- */\n\napi.use(\"/subscribers/*\", async (c, next) => {\n if (!isAuthorized(c.req.raw)) return c.json({ error: \"Unauthorized\" }, 401);\n await next();\n});\napi.use(\"/subscribers\", async (c, next) => {\n if (!isAuthorized(c.req.raw)) return c.json({ error: \"Unauthorized\" }, 401);\n await next();\n});\n\napi.get(\"/subscribers\", async (c) => {\n const subscribers = await db.listSubscribers();\n return c.json({ subscribers });\n});\n\napi.put(\"/subscribers/:id\", async (c) => {\n const body = await c.req.json().catch(() => ({} as any));\n const { details, developer_notes } = body ?? {};\n const updated = await db.updateSubscriber(c.req.param(\"id\"), { details, developer_notes });\n if (!updated) return c.json({ error: \"No fields to update\" }, 400);\n return c.json({ success: true, message: \"Subscriber updated\" });\n});\n\napi.delete(\"/subscribers/:id\", async (c) => {\n await db.deleteSubscriber(c.req.param(\"id\"));\n return c.json({ success: true, message: \"Subscriber removed\" });\n});\n\n/* ------------------------------------ docs ------------------------------------- */\n\napi.get(\"/\", (c) =>\n c.json({\n name: \"Newsletter Signup API\",\n admin: new URL(\"/admin\", c.req.url).toString(),\n endpoints: {\n \"POST /subscribe\": {\n description:\n \"Subscribe to the newsletter. Notifies all enabled ntfy receivers. Returns subscriber id.\",\n body: { email: \"string (required)\", details: \"object (optional metadata)\" },\n response: { success: \"boolean\", message: \"string\", id: \"number\" },\n },\n \"PUT /subscribe/:id/details\": {\n description:\n \"Add or update details for an existing subscriber (public, no auth). Shallow-merges with existing details.\",\n body: { details: \"object (required)\" },\n },\n \"GET /subscribers\": { description: \"List all subscribers (X-API-Key)\" },\n \"PUT /subscribers/:id\": {\n description: \"Update subscriber details or developer notes (X-API-Key)\",\n body: { details: \"object (optional)\", developer_notes: \"string (optional)\" },\n },\n \"DELETE /subscribers/:id\": { description: \"Remove a subscriber (X-API-Key)\" },\n \"GET /admin\": {\n description: \"Admin dashboard — review signups and configure ntfy receivers (Val Town login)\",\n },\n },\n }));\n",[],[254],"1275d992-1819-4c90-994b-ba000e226b07","README.md","be6f332a-fed3-11f0-bfa2-42dde27851f2",["D",1787078389740],5,"# Newsletter Signup API\n\nEmail signup endpoint with flexible metadata storage, **ntfy.sh push notifications** for new\nsubmissions, and an admin dashboard behind Val Town login.\n\n🔗 · 🛠 \n\n## How it works\n\n```mermaid\nflowchart LR\n F[Your form] -->|POST /subscribe| A[main.ts]\n A --> D[(SQLite)]\n A --> N[ntfy.ts]\n N -->|JSON publish| S1[ntfy.sh / self-hosted]\n S1 --> P[phone / desktop / web app]\n N --> L[(ntfy_deliveries log)]\n U[You] -->|Val Town login| AD[/admin/]\n AD --> D\n AD --> L\n```\n\nEvery signup fans out to **every enabled receiver** configured in the dashboard. Delivery failures\nare logged, never surfaced to the person signing up — a broken receiver can't break your form.\n\n## Setup\n\n1. Open and log in with Val Town.\n2. Add a receiver: pick an **unguessable topic** (the topic name is effectively the password —\n anyone who knows it can read your notifications).\n3. Subscribe to that same topic in the [ntfy app](https://ntfy.sh/app) (iOS, Android, web, CLI).\n4. Hit **Send test** to confirm it arrives.\n\n### Receiver options\n\n| Field | Notes |\n|-------|-------|\n| Name | Label shown in the dashboard |\n| Topic | ntfy topic — keep it long and random |\n| Server | `https://ntfy.sh` or your own self-hosted ntfy |\n| Priority | 1 (min) … 5 (max) — controls how loudly the app alerts |\n| Tags | Comma-separated; ntfy maps many to [emoji](https://docs.ntfy.sh/emojis/) |\n| Auth | Access token (`tk_…`) or `user:password` — only needed for protected topics |\n| Notify on | New signup and/or details updated |\n| Enabled | Pause a receiver without deleting it |\n\nNotifications include a click action + \"Open admin\" button pointing back at the dashboard.\nUses ntfy's [publish-as-JSON API](https://docs.ntfy.sh/publish/#publish-as-json).\n\n### Message format\n\nMessages are **plain text**, deliberately. ntfy's\n[Markdown support](https://docs.ntfy.sh/publish/#markdown-formatting) is web-app only — the\nAndroid/iOS apps render the raw characters, so `**bold**` and `- item` arrive as literal\npunctuation on a phone. Multi-line `key: value` text looks right on every client:\n\n```\nNew newsletter signup ← title\n\ndana@acme.com ← body\n\nplan: enterprise\ncompany: Acme Corp\nseats: 25\ninterests: [\"ai\",\"design\"]\n\nsignup #22 · 2026-08-18 18:39:21 UTC\n```\n\nGuardrails in `ntfy.ts`: at most 12 fields (then `(+N more fields)`), each value collapsed to one\nline and clipped at 120 chars, keeping messages glanceable and well under ntfy's 4,096-byte limit.\nNested objects/arrays are shown as compact JSON.\n\n## Filters\n\nEach receiver can require specific fields before it fires — one rule per line, evaluated against\nthe signup's `details` object plus `email`:\n\n```\nplan = enterprise # equals (case-insensitive, numeric-aware)\nplan != trial # not equals\ncompany exists # provided and not empty\nphone missing # absent, null or empty\ncountry in US, CA, MX # any of\nemail ~ @acme.com # contains\nseats >= 10 # numeric: > >= < <=\nutm.source = hn # nested paths, and answers[0].value\n# comments and blank lines are ignored\n```\n\nSet the mode to **all rules must match** or **any rule may match**. No filter = notify on\nevery subscribed event. So a \"sales\" receiver can watch `plan = enterprise`, while a catch-all\nphone receiver stays unfiltered.\n\n### Semantics (the sharp edges)\n\n| Case | Behaviour |\n|------|-----------|\n| Array value, e.g. `[\"ai\",\"design\"]` | Matches if **any** element matches |\n| `!=` on an absent field | **True** — pair with `field exists` if presence matters |\n| `false`, `0` | Count as present; `\"\"`, `\" \"`, `[]`, `{}` do not |\n| Numeric compare on non-numeric value | No match (never throws) |\n| Filter that fails to parse | **Fails open** — sends anyway, error shown in the dashboard |\n| Value that's only operator punctuation (`plan === pro`) | Rejected as an error, so a typo can't silently create a rule that never matches |\n| `Send test` button | Bypasses filters on purpose — it tests connectivity |\n\nFilters are deliberately fail-open: a broken filter that silently swallowed every alert would be\nworse than an extra push.\n\n### Seeing what filters did\n\nSilence is ambiguous, so filtering is observable in two places:\n\n- **Test filters** card — paste (or reuse the latest signup's) email + `details` JSON and see per\n receiver whether it *would send* or *would skip*, and why. Nothing is sent or saved.\n- **Recent notifications** — logs `sent` / `failed` / `skipped`, with the skip reason spelled out,\n e.g. `failed plan = enterprise — plan is free`.\n\n## Login flow\n\n`std/oauth`'s callback always returns to `/` — it has no \"return to where I was\" option, so\nvisiting `/admin` while logged out would otherwise dump you on the API docs after signing in.\n`post-login.ts` fixes that: the admin gate stashes the intended path in a short-lived\n`post_login_redirect` cookie, and a middleware on `GET /` resumes it once a session exists.\nOnly same-origin absolute paths are honoured (no open redirects).\n\n```mermaid\nsequenceDiagram\n participant B as Browser\n participant V as Val\n participant T as val.town\n B->>V: GET /admin (no session)\n V-->>B: 302 /auth/login + post_login_redirect=/admin\n B->>T: OAuth login\n T-->>B: back to /auth/callback → session cookie\n B->>V: GET / (callback lands here)\n V-->>B: 302 /admin (cookie cleared)\n```\n\n## Environment variables\n\n| Key | Required | Purpose |\n|-----|----------|---------|\n| `ADMIN_API_KEY` | for JSON admin endpoints | `X-API-Key` value for `/subscribers*` |\n| `ADMIN_USERNAMES` | optional | Extra Val Town usernames allowed into `/admin`, comma-separated. Members of this val's org always have access. |\n\n👉 Add ADMIN_USERNAMES here: https://www.val.town/x/colel/newsletter-signup/environment-variables?key=ADMIN_USERNAMES\n\nntfy credentials live in the database (managed from the dashboard), not in env vars.\n\n## Endpoints\n\n| Method | Path | Auth | Description |\n|--------|------|------|-------------|\n| POST | `/subscribe` | Public | Submit a signup → notifies receivers |\n| PUT | `/subscribe/:id/details` | Public | Merge extra details into a signup |\n| GET | `/subscribers` | API Key | List all subscribers |\n| PUT | `/subscribers/:id` | API Key | Update details or notes |\n| DELETE | `/subscribers/:id` | API Key | Remove a subscriber |\n| GET | `/admin` | Val Town login | Dashboard: review signups, configure receivers |\n\n## Usage\n\n**Subscribe (public):**\n```bash\ncurl -X POST https://newsletter-signup.val.run/subscribe \\\n -H \"Content-Type: application/json\" \\\n -d '{\"email\": \"user@example.com\", \"details\": {\"any\": \"json\"}}'\n```\n\n**Admin requests:**\n```bash\ncurl https://newsletter-signup.val.run/subscribers \\\n -H \"X-API-Key: your-admin-key\"\n```\n\n## Files\n\n| File | Role |\n|------|------|\n| `main.ts` | Hono app; mounts API + admin, wraps everything in Val Town OAuth |\n| `api.ts` | Public + API-key JSON routes |\n| `ntfy.ts` | ntfy publishing, message formatting, filter gate, test sends |\n| `filter.ts` | Filter parsing + evaluation (pure, no I/O) |\n| `db.ts` | Schema, migrations + queries (subscribers, receivers, delivery log) |\n| `post-login.ts` | Return-to-destination across the OAuth round trip |\n| `admin/routes.tsx` | Auth gate + dashboard routes and form handling |\n| `admin/Layout.tsx`, `admin/Receivers.tsx`, `admin/Subscribers.tsx`, `admin/FilterTest.tsx` | React (SSR) UI |\n\n## Schema\n\n**`newsletter_subscribers`** — `id`, `email`, `details` (JSON), `developer_notes`, `created_at`, `updated_at`\n\n**`ntfy_receivers`** — `id`, `name`, `server`, `topic`, `priority`, `tags`, `auth`, `events`,\n`filter`, `filter_mode`, `enabled`, timestamps\n\n**`ntfy_deliveries`** — `id`, `receiver_id`, `receiver_name`, `subscriber_id`, `event`, `outcome`\n(`sent`/`failed`/`skipped`), `ok`, `status`, `error` (failure message or filter reason), `created_at`\n\nNew columns are added by `ensureColumns()` in `db.ts` on boot, so deploys migrate in place.\n",[],[262],"4f20e196-0364-4fa0-bc2e-058d5d3d1377","scripts","013cb2e4-c52a-417b-a150-124dc8a68c51",25,["D",1787053034424],"directory",[],[270],["D",1787056304828],[],[183,67],"6eb89ce3-a586-46a0-aa2d-100ac5a04ae3","Subscribers.tsx","fbee90e4-9af8-11f1-96e3-1607ee4eb77e",22,["D",1787052959417],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { Subscriber } from \"../db.ts\";\nimport { Card } from \"./Layout.tsx\";\n\nfunction DetailsCell({ details }: { details: Record | null }) {\n if (!details || !Object.keys(details).length) {\n return —;\n }\n return (\n

\n {Object.keys(details).length} field{Object.keys(details).length === 1 ? \"\" : \"s\"}\n

\n        {JSON.stringify(details, null, 2)}\n

\n );\n}\n\nexport function Subscribers(\n { subscribers, total }: { subscribers: Subscriber[]; total: number },\n) {\n return (\n \n {subscribers.length === 0\n ?

No signups yet.

\n : (\n

\n \n \n \n \n \n \n \n \n \n \n \n \n {subscribers.map((s) => (\n \n \n \n \n \n \n \n \n ))}\n \n

#	Email	Details	Created (UTC)	Notes
{s.id}	{s.email}	\n \n	{s.created_at}	\n \n \n \n Save\n \n \n	\n \n \n Delete\n \n \n

\n )}\n \n );\n}\n",[],[183,281],"49020ae2-44f1-4431-9987-243a6867b588","Receivers.tsx","f55367e6-9af8-11f1-9164-1607ee4eb77e",44,["D",1787056244788],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport type { Delivery, Receiver } from \"../db.ts\";\nimport { parseFilter, summarizeFilter } from \"../filter.ts\";\nimport { Card } from \"./Layout.tsx\";\n\nconst PRIORITIES = [\n [1, \"1 · min\"],\n [2, \"2 · low\"],\n [3, \"3 · default\"],\n [4, \"4 · high\"],\n [5, \"5 · max\"],\n] as const;\n\nconst input =\n \"w-full px-2.5 py-1.5 rounded-md border border-slate-300 text-sm focus:outline-none focus:ring-2 focus:ring-slate-400\";\nconst label = \"block text-xs font-medium text-slate-500 mb-1\";\n\nfunction Field(\n { name, title, defaultValue, placeholder, type = \"text\", hint, required, className = \"\" }: {\n name: string;\n title: string;\n defaultValue?: string | number | null;\n placeholder?: string;\n type?: string;\n hint?: string;\n required?: boolean;\n className?: string;\n },\n) {\n return (\n

\n {title}\n \n {hint &&

{hint}

}\n

\n );\n}\n\nfunction EventChecks({ events }: { events: string }) {\n const list = events.split(\",\").map(e => e.trim());\n return (\n

\n Notify on\n

\n \n \n New signup\n \n \n \n Details updated\n \n

\n );\n}\n\nexport function FilterSyntax() {\n return (\n

Filter syntax

\n One rule per line. Fields come from the signup's details object, plus{\" \"}\n email. Nested paths work: utm.source, answers[0].value.\n

\n{`plan = enterprise      # equals (case-insensitive)\nplan != trial          # not equals\ncompany exists         # provided and not empty\nphone missing          # absent, null or empty\ncountry in US, CA, MX  # any of\nemail ~ @acme.com      # contains\nseats >= 10            # numeric: > >= < <=\n# lines starting with # are comments`}\n

Array values match if any element matches.
\n != is also true when the field is absent — add field exists{\" \"}\n if you need it present.\n
false and 0 count as present; \"\" and [] don't.
A filter that can't be parsed sends anyway, so a typo never silently drops alerts.

\n );\n}\n\nfunction FilterBox({ receiver }: { receiver?: Receiver }) {\n const parsed = parseFilter(receiver?.filter ?? null);\n return (\n

\n Filter (optional)\n \n \n \n \n

\n \n {parsed.errors.length > 0\n ? (\n

\n line {err.line} {err.source} — {err.message} (sending everything\n until fixed)\n

\n )\n : (\n

\n {summarizeFilter(receiver?.filter ?? null, receiver?.filter_mode ?? \"all\")}\n

\n )}\n

\n );\n}\n\nfunction ReceiverFields({ receiver }: { receiver?: Receiver }) {\n return (\n <>\n

\n \n \n \n

\n Priority\n \n

\n \n \n

\n \n

\n \n \n Enabled\n \n {receiver?.auth && (\n \n \n Clear saved auth\n \n )}\n

\n \n );\n}\n\nconst DOT_COLORS: Record = {\n sent: \"bg-emerald-500\",\n failed: \"bg-red-500\",\n skipped: \"bg-amber-400\",\n};\n\nfunction StatusDot({ outcome }: { outcome?: string }) {\n return (\n \n );\n}\n\nfunction lastLine(last?: Delivery): string {\n if (!last) return \"no deliveries yet\";\n if (last.outcome === \"sent\") return `last ${last.event} sent · ${last.created_at}`;\n if (last.outcome === \"skipped\") return `last ${last.event} filtered out · ${last.created_at}`;\n return `last ${last.event} failed (${last.status ?? \"network\"}) · ${last.created_at}`;\n}\n\nexport function Receivers(\n { receivers, deliveries }: { receivers: Receiver[]; deliveries: Delivery[] },\n) {\n const lastByReceiver = new Map();\n for (const d of deliveries) {\n if (d.receiver_id !== null && !lastByReceiver.has(d.receiver_id)) lastByReceiver.set(d.receiver_id, d);\n }\n\n return (\n \n \n\n {receivers.length === 0 && (\n

\n No receivers yet — add one below, then subscribe to that topic in the{\" \"}\n ntfy web app or mobile app.\n

\n )}\n\n

\n {receivers.map((receiver) => {\n const last = lastByReceiver.get(receiver.id);\n return (\n \n

\n \n {receiver.name}\n \n {receiver.server.replace(/^https?:\\/\\//, \"\")}/{receiver.topic}\n \n {!receiver.enabled && (\n \n disabled\n \n )}\n

{lastLine(last)}

\n\n \n\n

\n \n Save\n \n \n Send test\n \n \n Delete\n \n

\n \n );\n })}\n

\n\n

\n + Add receiver\n

\n \n );\n}\n\nconst OUTCOME_STYLES: Record = {\n sent: \"text-emerald-600\",\n failed: \"text-red-600\",\n skipped: \"text-amber-600\",\n};\n\nexport function Deliveries({ deliveries }: { deliveries: Delivery[] }) {\n if (!deliveries.length) return null;\n return (\n \n

\n \n \n \n \n \n \n \n \n \n \n \n {deliveries.map((d) => (\n \n \n \n \n \n \n \n ))}\n \n

When (UTC)	Receiver	Event	Signup	Result
{d.created_at}	{d.receiver_name}	{d.event}	\n {d.subscriber_id ? `#${d.subscriber_id}` : \"—\"}\n	\n \n {d.outcome === \"failed\" ? `failed ${d.status ?? \"network\"}` : d.outcome}\n \n {d.error && · {d.error}}\n

\n \n );\n}\n",[],[183,289],"246d6b1f-bdb2-46dc-aaa0-dfcdeb912df0","Layout.tsx","dd81d7ce-9af8-11f1-8710-1607ee4eb77e",20,["D",1787052908390],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\n\nexport interface FlashMessage {\n kind: \"ok\" | \"error\";\n text: string;\n}\n\nexport function Layout(\n { title, user, flash, children }: {\n title: string;\n user: { username: string | null; profileImageUrl?: string | null };\n flash?: FlashMessage | null;\n children: React.ReactNode;\n },\n) {\n return (\n \n \n \n \n {title}\n \n \n \n \n

📬 Newsletter Signups

\n Review submissions and configure ntfy.sh receivers\n

\n @{user.username ?? \"unknown\"}\n

\n\n {flash && (\n \n {flash.text}\n

\n )}\n\n {children}\n\n \n \n \n \n );\n}\n\nexport function Card(\n { title, subtitle, children }: {\n title: string;\n subtitle?: string;\n children: React.ReactNode;\n },\n) {\n return (\n

{title}

\n {subtitle &&

{subtitle}

}\n

{children}

\n );\n}\n",[],[183,297],"ec3aacd5-82f2-4a7b-ae01-b738fc43968d","FilterTest.tsx","b426c8fa-9b00-11f1-8b2d-1607ee4eb77e",45,["D",1787056274986],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport React from \"https://esm.sh/react@18.2.0\";\nimport { Card } from \"./Layout.tsx\";\n\nexport interface FilterTestRow {\n receiver: string;\n enabled: boolean;\n events: string;\n listens: boolean;\n send: boolean;\n outcome: string;\n reason: string;\n}\n\nexport interface FilterTestResult {\n email: string;\n detailsText: string;\n parseError?: string;\n rows: FilterTestRow[];\n}\n\nconst input =\n \"w-full px-2.5 py-1.5 rounded-md border border-slate-300 text-sm focus:outline-none focus:ring-2 focus:ring-slate-400\";\n\nfunction Verdict({ row }: { row: FilterTestRow }) {\n if (!row.enabled) return receiver disabled;\n if (!row.listens) return not listening for signups;\n if (row.outcome === \"error\") return would send (filter error);\n return row.send\n ? would send\n : would skip;\n}\n\n/**\n * \"What would happen if this signup arrived?\" — filters are invisible by nature, so this\n * makes them inspectable without publishing real notifications.\n */\nexport function FilterTest(\n { result, defaults }: {\n result?: FilterTestResult;\n defaults: { email: string; detailsText: string };\n },\n) {\n return (\n \n \n\n {result?.parseError && (\n

\n Couldn't parse that JSON: {result.parseError}\n

\n )}\n\n {result && !result.parseError && (\n result.rows.length === 0\n ?

No receivers configured yet.

\n : (\n

\n \n \n \n \n \n \n \n \n \n {result.rows.map((row) => (\n \n \n \n \n \n ))}\n \n

Receiver	Verdict	Why
{row.receiver}	\n \n	{row.reason}

\n )\n )}\n \n );\n}\n",[],[183,305],"964d6db5-0871-412c-97ed-cb80b4512abb",["D",1787052908390],[196,197,198,199,200],[183],["D",1769884195507],["D",1789534231467],{"_11":12,"_150":73},{"_11":12,"_146":-5,"_72":73,"_30":71,"_147":148,"_149":24},{"_41":137,"_13":16,"_35":38,"_138":100,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":14,"_145":12},"ctx",{"_55":-5,"_170":354,"_355":356,"_357":358,"_359":24,"_360":24,"_361":24,"_362":168,"_363":-5,"_364":-7,"_365":-7,"_366":26,"_367":24,"_368":24,"_369":-5,"_370":24,"_371":24,"_372":24,"_373":-5},"ENV",{"_325":326,"_327":328,"_329":16,"_330":331,"_332":333,"_334":335,"_336":337,"_338":339,"_340":341,"_342":343,"_344":345,"_346":347,"_348":349,"_350":351,"_352":353},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · routes.tsx