[{"_1":2,"_340":-5,"_341":-5},"loaderData",{"_3":4,"_91":92,"_288":289},"root",{"_5":6,"_34":35,"_64":65},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":22,"_29":22,"_30":22,"_31":32,"_33":22},"auth",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"tokenType","session_token","sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","ENV",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","230fbbe1911b69d46be82b6db4e617b331d282a6","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_66":67},"__internal_clerk_state",{"_68":69,"_70":45,"_71":72,"_73":72,"_74":22,"_75":72,"_76":72,"_77":72,"_78":72,"_79":80,"_89":22,"_90":22},"__clerk_ssr_state",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_81":22,"_21":22,"_82":72,"_83":84,"_85":72,"_86":45,"_87":22,"_88":72},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/_app.x.$handle.$name",{"_93":94,"_95":96,"_97":-7,"_98":99,"_100":-7,"_101":102,"_147":148,"_265":266,"_267":268,"_277":278,"_163":279,"_282":-5,"_283":-5,"_284":22,"_285":22,"_286":287},"handle","drewmcdonald","name","inbox","branchName","path","httpHandler.ts","version","project",{"_103":104,"_95":96,"_105":106,"_107":-5,"_108":22,"_109":110,"_111":-5,"_112":-5,"_14":113,"_114":-5,"_115":22,"_116":-5,"_117":32,"_16":118,"_119":120,"_121":120,"_122":123,"_124":123,"_125":123,"_126":120,"_127":120,"_23":128,"_131":132,"_134":135,"_146":22},"id","a6919e76-ad18-11f0-8387-0224a6c84d84","createdAt",["D",1760898183380],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","b8db9d60-1994-11f0-a97f-49be2029e0a3","pinnedFileId","pinPreview","screenshotVersion","likeCount","5affebf8-2371-44b9-a6da-146d4a0e1f13","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_93":94,"_129":130},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ydmtBUlRqVEEwb1lKTWo3UHNHN25IZlo0UFYifQ","org",{"_93":94,"_133":130},"avatar","branch",{"_100":136,"_95":43,"_103":137,"_138":104,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":96,"_145":94},55,"a6921cac-ad18-11f0-8387-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","tree",[149,171,181,190,200,209,218,227,237,246,256],{"_103":150,"_95":151,"_152":153,"_154":-5,"_155":137,"_156":157,"_158":159,"_105":160,"_100":161,"_162":163,"_164":165,"_166":22,"_167":-5,"_168":169,"_98":170},"33f59da6-ad1b-11f0-b734-0224a6c84d84",".vtignore","fileId","e17e0452-ad18-11f0-a853-0224a6c84d84","parentId","branchId","branchVersion",26,"latest",true,["D",1760899279407],2,"fileType","file","content",".env\n.git\n.vscode\n.cursor\n.DS_Store\n.zed\nnode_modules\nvendor\n","deleted","label","children",[],[151],{"_103":172,"_95":173,"_152":174,"_154":-5,"_155":137,"_156":175,"_158":159,"_105":176,"_100":32,"_162":177,"_164":178,"_166":22,"_167":-5,"_168":179,"_98":180},"e1a2f6ae-ad18-11f0-aeab-0224a6c84d84","AttachmentService.ts","e1a2f73a-ad18-11f0-aeab-0224a6c84d84",16,["D",1760898282151],"script","import { blob } from \"https://esm.town/v/std/blob\";\n\nexport interface FileMetadata {\n filename: string;\n contentType: string;\n size: number;\n}\n\nexport interface StoredAttachment {\n filename: string;\n contentType: string;\n size: number;\n data: ArrayBuffer;\n}\n\nconst getFileMetadata = (file: File): FileMetadata => {\n return {\n filename: file.name,\n contentType: file.type,\n size: file.size,\n };\n};\n\nconst AttachmentService = {\n async save(file: File): Promise {\n const key = crypto.randomUUID();\n const metadata = getFileMetadata(file);\n await Promise.all([\n blob.set(key, await file.arrayBuffer()),\n blob.setJSON(`${key}:meta`, metadata),\n ]);\n return key;\n },\n\n async get(key: string): Promise {\n const [data, metadata] = await Promise.all([\n blob.get(key),\n blob.getJSON(`${key}:meta`) as Promise,\n ]);\n\n if (!data || !metadata) {\n return null;\n }\n\n return {\n filename: metadata.filename,\n contentType: metadata.contentType,\n size: metadata.size,\n data: await data.arrayBuffer(),\n };\n },\n\n async delete(key: string): Promise {\n await Promise.all([\n blob.delete(key),\n blob.delete(`${key}:meta`),\n ]);\n },\n} as const;\n\nexport default AttachmentService;\n",[],[173],{"_103":182,"_95":183,"_152":184,"_154":-5,"_155":137,"_156":185,"_158":159,"_105":186,"_100":32,"_162":163,"_164":187,"_166":22,"_167":-5,"_168":188,"_98":189},"e18fd70e-ad18-11f0-9137-0224a6c84d84","CLAUDE.md","e18fd7c2-ad18-11f0-9137-0224a6c84d84",13,["D",1760898282257],"# Claude Code Instructions for Obsidian Inbox\n\n## Project Overview\nSee PROJECT.md for full architecture. This is a Val.town service providing a temporary inbox for content before Obsidian vault processing.\n\n## Quick Context\n- **Platform**: Val.town (Deno serverless)\n- **Stack**: TypeScript, Hono, SQLite, Blob storage\n- **Purpose**: Buffer layer between input sources (email/HTTP) and Obsidian clients\n- **Current State**: Core internals focused, client integration TBD\n\n## AI Assistant Guidelines\n\n### When Working on This Project\n\n1. **Consult PROJECT.md first** for architecture and data flow\n2. **Consult .cursor/rules/townie.mdc** for Val.town platform specifics\n3. **Keep it simple** - this is a buffer service, not a full application\n4. **Manual testing only** - use Val.town web interface\n\n### Common Tasks\n\n**Schema Changes**:\n- Update `inboxRecordSchema` in InboxService.ts\n- Change SQLite table name (append `_2`, `_3`, etc.) - don't use ALTER TABLE\n- Update handlers if record structure changes\n\n**Adding Endpoints**:\n- Modify httpHandler.ts (Hono app)\n- Add bearer auth middleware to protected routes\n- Return proper status codes (200/201/400/401/404/500)\n\n**Modifying Processing Logic**:\n- Email processing → emailHandler.ts\n- HTTP processing → httpHandler.ts\n- Keep services (InboxService, AttachmentService) as pure data operations\n\n### Key Constraints\n\n- **No external services** - use Val.town stdlib (sqlite, blob, email)\n- **No binary files in project** - only text files allowed\n- **Environment variables** - never hardcode secrets, use `Deno.env.get()`\n- **Val.town quirks** - redirects need manual Response, not Response.redirect()\n- **Imports** - always use `https://esm.sh` for npm packages\n\n### Code Style\n\n- TypeScript with explicit types on public interfaces\n- Functional style preferred over classes\n- Keep functions small and focused\n- Export const objects for services (e.g., `InboxService`, `AttachmentService`)\n- Avoid try-catch unless you have a clear local resolution\n\n### Error Handling Philosophy\n\n- Let errors bubble up with full context\n- Don't catch just to log and re-throw\n- Use Zod validation for input schemas\n- Return descriptive error messages in HTTP responses\n\n### Testing Approach\n\nTest manually via Val.town web interface:\n- Email trigger: send test emails from allowlisted addresses\n- HTTP API: use curl/Postman with bearer token\n- Focus on edge cases: malformed input, auth failures, missing data\n\n### TODO Items to Consider\n\nWhen suggesting improvements, be aware of known TODOs:\n- Error handling and retry logic currently not implemented\n- Client architecture still being finalized\n- Consider push notifications vs polling for clients\n\n### File Navigation\n\nCore files you'll modify most:\n- `InboxService.ts` - data persistence layer\n- `emailHandler.ts` - email input processing\n- `httpHandler.ts` - HTTP API endpoints\n- `auth.ts` - authentication logic\n- `AttachmentService.ts` - blob storage operations\n\nSee PROJECT.md for full file reference and component descriptions.\n\n## Platform-Specific Reminders\n\nThis codebase runs on Val.town, which means:\n- Deno runtime (not Node.js)\n- Serverless execution model\n- Built-in SQLite and blob storage\n- Email sending/receiving capabilities\n- No filesystem access (use blob storage or SQLite)\n- All dependencies via HTTPS imports\n\nRefer to `.cursor/rules/townie.mdc` for comprehensive Val.town development guidelines including standard library usage, common gotchas, and best practices.\n",[],[183],{"_103":191,"_95":192,"_152":193,"_154":-5,"_155":137,"_156":194,"_158":159,"_105":195,"_100":196,"_162":177,"_164":197,"_166":22,"_167":-5,"_168":198,"_98":199},"c559c9be-ad27-11f0-a759-0224a6c84d84","InboxService.ts","e160826a-ad18-11f0-b2ed-0224a6c84d84",54,["D",1760904677369],14,"import { validator } from \"https://esm.sh/hono@4.8.4/validator\";\nimport { z } from \"https://esm.sh/zod@3.23.8\";\nimport { eq, isNull, sql } from \"npm:drizzle-orm\";\nimport { db, inboxRecords } from \"./db.ts\";\nimport AttachmentService from \"./AttachmentService.ts\";\n\nexport const inboxRecordSchema = z.object({\n raw: z.string(),\n summary: z.string().optional(),\n from: z.string(),\n subject: z.string(),\n date: z.coerce.date(),\n attachmentBlobIds: z.array(z.string()),\n});\n\nexport type InboxRecord = z.infer;\n\nexport const validateInboxRecord = validator(\"json\", (value, c) => {\n const parsed = inboxRecordSchema.safeParse(value);\n if (!parsed.success) {\n return c.json({ error: \"Invalid request\", details: parsed.error }, 400);\n }\n return parsed.data;\n});\n\nconst InboxService = {\n async save(data: InboxRecord): Promise {\n const id = crypto.randomUUID();\n const textData = JSON.stringify(data);\n\n await db.insert(inboxRecords).values({\n id,\n record: textData,\n });\n\n return id;\n },\n\n async markProcessed(id: string): Promise {\n const result = await db\n .update(inboxRecords)\n .set({\n processed_at: new Date().toISOString(),\n })\n .where(eq(inboxRecords.id, id))\n .returning({ id: inboxRecords.id });\n\n return result.length > 0;\n },\n\n async retrieveUnprocessed(): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(isNull(inboxRecords.processed_at));\n\n return rows.map((row) => {\n const parsed = JSON.parse(row.record);\n return inboxRecordSchema.parse(parsed);\n });\n },\n\n async getById(id: string): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(eq(inboxRecords.id, id));\n\n if (rows.length === 0) {\n return null;\n }\n\n const parsed = JSON.parse(rows[0].record);\n return inboxRecordSchema.parse(parsed);\n },\n\n /** Delete records processed more than 30 days ago */\n async hardDeleteProcessedRecords(): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(\n sql`${inboxRecords.processed_at} IS NOT NULL AND ${inboxRecords.processed_at} <= date('now', '-30 days')`,\n );\n\n const records = rows.map((row) => {\n const parsed = JSON.parse(row.record);\n return { ...inboxRecordSchema.parse(parsed), id: row.id };\n });\n\n const recordIds = records.map((record) => record.id);\n const attachmentKeys = records.flatMap((record) =>\n record.attachmentBlobIds || []\n );\n\n await Promise.all([\n ...recordIds.map((id) =>\n db.delete(inboxRecords).where(eq(inboxRecords.id, id))\n ),\n ...attachmentKeys.map((key) => AttachmentService.delete(key)),\n ]);\n },\n} as const;\n\nexport default InboxService;\n",[],[192],{"_103":201,"_95":202,"_152":203,"_154":-5,"_155":137,"_156":204,"_158":159,"_105":205,"_100":32,"_162":163,"_164":206,"_166":22,"_167":-5,"_168":207,"_98":208},"e15916c4-ad18-11f0-867e-0224a6c84d84","PROJECT.md","e159175a-ad18-11f0-867e-0224a6c84d84",6,["D",1760898281964],"# Obsidian Inbox\n\nA Val.town service that acts as a temporary inbox for raw information before it's processed into an Obsidian vault.\n\n## Purpose\n\nThis service provides a buffer layer between various information sources (email, HTTP POST) and Obsidian vault management systems. It:\n- Receives raw information from multiple sources\n- Stores unprocessed items with attachments\n- Provides a simple API for clients to retrieve and process items\n- Manages the lifecycle of inbox items (unprocessed → processed → deleted)\n\n## Architecture\n\n### Platform\n- **Runtime**: Deno on Val.town serverless environment\n- **Database**: SQLite (Val.town standard library)\n- **Storage**: Blob storage (Val.town standard library)\n- **Language**: TypeScript\n\n### Core Components\n\n#### 1. Input Handlers\n- **emailHandler.ts**: Email trigger that processes incoming emails\n - Validates sender against allowlist\n - Extracts email content and metadata\n - Saves attachments to blob storage\n - Creates inbox record\n \n- **httpHandler.ts**: HTTP API using Hono framework\n - `GET /` - Retrieve all unprocessed items\n - `POST /` - Create new inbox item (for non-email sources)\n - `PATCH /:id/processed` - Mark item as processed (returns 404 if record not found)\n - `GET /:recordId/attachments` - Get attachment metadata for a record\n\n#### 2. Services\n- **InboxService.ts**: Core data persistence for inbox records\n - Stores records in SQLite with UUID keys\n - Tracks processing state (unprocessed/processed timestamp)\n - Provides lifecycle operations (save, markProcessed, retrieveUnprocessed)\n - Auto-deletes processed records after 30 days\n\n- **AttachmentService.ts**: Blob storage for email attachments\n - Stores binary data and metadata separately\n - Supports get/save/delete operations\n - Uses UUID keys for blob identification\n\n- **auth.ts**: Authentication and authorization\n - Bearer token auth for HTTP endpoints (via `API_TOKEN` env var)\n - Email sender allowlist (via `INCOMING_EMAIL_ALLOWLIST` env var)\n\n### Data Model\n\n#### InboxRecord\n```typescript\n{\n raw: string, // Full text content (email body, etc.)\n summary?: string, // Optional summary\n from: string, // Source identifier (email address, etc.)\n subject: string, // Subject line or title\n date: Date, // When item was received\n attachmentBlobIds: string[] // References to blob storage\n}\n```\n\nStored in SQLite table `inbox_records` with:\n- `id` (UUID primary key)\n- `record` (JSON-serialized InboxRecord)\n- `created_at` (timestamp)\n- `processed_at` (nullable timestamp)\n\n#### AttachmentMetadata\n```typescript\n{\n filename: string,\n contentType: string,\n size: number,\n data: ArrayBuffer // The actual binary content\n}\n```\n\nStored in blob storage as:\n- `{uuid}` - binary data\n- `{uuid}:meta` - JSON metadata\n\n## Processing Lifecycle\n\n1. **Ingestion**: Item arrives via email or HTTP POST\n2. **Storage**: Saved to SQLite with `processed_at = null`\n3. **Retrieval**: Client calls `GET /` to fetch unprocessed items\n4. **Processing**: Client transforms item into Obsidian note(s) (outside this service)\n5. **Completion**: Client calls `PATCH /:id/processed` to mark as done\n6. **Cleanup**: After 30 days, processed records auto-delete (including attachments)\n\n**Note**: Clients are responsible for idempotency. If processing fails partway through, the client should handle re-processing gracefully.\n\n## Environment Variables\n\nRequired configuration via Val.town secrets:\n- `API_TOKEN` - Bearer token for HTTP API authentication\n- `INCOMING_EMAIL_ALLOWLIST` - Comma-separated email addresses allowed to send\n\n## Client Integration\n\nClients that consume this inbox should:\n1. Poll `GET /` endpoint for unprocessed items (or use webhooks if added)\n2. Get attachment metadata via `GET /:recordId/attachments` and download blobs\n3. Process items into Obsidian vault format\n4. Mark each item as processed via `PATCH /:id/processed`\n5. Handle failures gracefully (service doesn't retry)\n\nClient type is TBD - may be MCP servers, custom scripts, or other automation.\n\n## Development Guidelines\n\n### Val.town Specifics\n- All code must be compatible with Deno runtime\n- Use `https://esm.sh` for npm imports\n- Storage limited to SQLite + blob storage (no filesystem)\n- See `.cursor/rules/townie.mdc` for full Val.town development guidelines\n\n### Common Modification Patterns\n\n**Schema Changes**:\n- Modify `inboxRecordSchema` in InboxService.ts\n- Change table name (e.g., `inbox_records` → `inbox_records_2`) to avoid migration issues\n- Update both email and HTTP handlers if needed\n\n**Adding Input Sources**:\n1. Create new handler file (e.g., `webhookHandler.ts`)\n2. Map to appropriate trigger type (HTTP, cron, etc.)\n3. Transform input to InboxRecord format\n4. Call `InboxService.save()`\n\n**Processing Logic Changes**:\n- Most business logic lives in handlers (emailHandler.ts, httpHandler.ts)\n- Keep services (InboxService, AttachmentService) focused on data operations\n- Prefer small, focused functions over complex class hierarchies\n\n### Testing\n- Manual testing via Val.town web interface\n- No formal test suite currently\n- Focus on edge cases: malformed emails, missing attachments, auth failures\n\n## Known TODOs\n\n- [ ] Error handling and retry logic for failed processing\n- [ ] Consider webhook/push notification when new items arrive (vs polling)\n- [ ] Finalize client architecture (MCP vs custom scripts)\n- [ ] Evaluate if 30-day retention is appropriate for all use cases\n\n## File Reference\n\n```\n.\n├── emailHandler.ts # Email trigger entry point\n├── httpHandler.ts # HTTP API entry point (Hono app)\n├── service.ts # Main service entry point (routes to handlers)\n├── InboxService.ts # Inbox record persistence\n├── AttachmentService.ts # Blob storage for attachments\n├── auth.ts # Authentication/authorization\n├── deno.json # Deno/Val.town configuration\n└── .cursor/rules/\n └── townie.mdc # Val.town development guidelines\n```\n\n## Design Principles\n\n1. **Simple buffer**: This is NOT a full email client or note-taking app. It's a temporary holding area.\n2. **Client-side processing**: Complex transformations happen in clients, not here.\n3. **Stateless**: Each inbox item is independent. No complex workflows or state machines.\n4. **Val.town native**: Leverage platform services (SQLite, blob, email) rather than external dependencies.\n5. **Fail-fast**: Let errors bubble up with context rather than hiding them.\n",[],[202],{"_103":210,"_95":211,"_152":212,"_154":-5,"_155":137,"_156":213,"_158":159,"_105":214,"_100":32,"_162":163,"_164":215,"_166":22,"_167":-5,"_168":216,"_98":217},"e17608c4-ad18-11f0-867e-0224a6c84d84","TODO.md","e17609b4-ad18-11f0-867e-0224a6c84d84",10,["D",1760898282101],"# TODO\n\n## High Priority\n\n### Error Handling & Retry\nImplement consistent error handling strategy across the codebase:\n- **Issue**: Email handler catches and sends error emails (inconsistent with \"fail fast\" philosophy)\n- **Decision needed**: Should we retry on transient failures (SQLite lock, network issues)?\n- **Consider**: Dead-letter queue for failed email processing\n- **File**: emailHandler.ts:29-39\n\n### Cleanup Cron Job\nThe `hardDeleteProcessedRecords()` function is implemented but never invoked.\n- **Action**: Create Val.town cron trigger to run cleanup periodically (daily or weekly)\n- **Function**: InboxService.hardDeleteProcessedRecords() (InboxService.ts:88)\n- **Recommendation**: Daily cron at low-traffic time\n\n## Medium Priority\n\n### Attachment Download Endpoint\nCurrent implementation returns attachment metadata. Consider adding direct download capability:\n- **Current**: `GET /:recordId/attachments` → returns JSON list of attachments\n- **Add option 1**: `GET /:recordId/attachments/:blobId` → download specific attachment\n- **Add option 2**: `GET /attachments/:blobId` → direct blob download (simpler)\n- **File**: httpHandler.ts:30-56\n\n### Rate Limiting\nEmail endpoint could be spammed even with allowlist (minor concern for personal use).\n- **Note**: Val.town provides some platform-level rate limiting\n- **Consider**: Application-level throttling for email processing\n- **Consider**: Max emails per sender per time window\n\n## Low Priority\n\n### Attachment Array Ordering\n`attachmentBlobIds` array has no guaranteed order preservation.\n- **Impact**: Low - usually not critical for inbox use case\n- **Consider**: Add explicit ordering metadata if needed\n- **File**: InboxService.ts (inboxRecordSchema)\n\n## Documentation Updates Needed\n\nAfter implementing fixes, update the following:\n- [ ] PROJECT.md - Update API documentation for `GET /:recordId/attachments` endpoint\n- [ ] PROJECT.md - Document that cleanup requires cron setup (once implemented)\n- [ ] CLAUDE.md - Add note about error handling philosophy consistency\n",[],[211],{"_103":219,"_95":220,"_152":221,"_154":-5,"_155":137,"_156":222,"_158":159,"_105":223,"_100":32,"_162":177,"_164":224,"_166":22,"_167":-5,"_168":225,"_98":226},"e187d108-ad18-11f0-b841-0224a6c84d84","auth.ts","e187d1c6-ad18-11f0-b841-0224a6c84d84",12,["D",1760898282285],"import type { Context } from \"https://esm.sh/hono@4.8.4/dist/types/context\";\n\nconst ENV_VAR = \"API_TOKEN\";\nexport const ALLOWLIST_ENV_VAR = \"INCOMING_EMAIL_ALLOWLIST\";\n\nconst authConfig = _getAuthConfig();\n\nexport async function bearerAuth(c: Context, next: () => Promise) {\n const expectedToken = authConfig.token;\n\n if (!expectedToken) {\n return c.json({ error: \"Server configuration error\" }, 500);\n }\n\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n const token = authHeader.substring(7);\n if (token !== expectedToken) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n await next();\n}\n\nexport function isAllowedSender({ from }: Email): boolean {\n // Extract email address from 'Full Name ' or just 'email@domain'\n const match = from.match(/<([^>]+)>/);\n const emailAddress = match ? match[1] : from;\n\n const isAllowed = authConfig.allowlist.includes(emailAddress);\n\n if (!isAllowed) {\n console.error(\n `Email from ${from} (parsed: ${emailAddress}) not in allow list`,\n { from },\n );\n }\n\n return isAllowed;\n}\n\nfunction _getAuthConfig(): {\n token: string;\n allowlist: string[];\n} {\n const config = {\n token: Deno.env.get(ENV_VAR),\n allowlist: Deno.env.get(ALLOWLIST_ENV_VAR)?.split(\",\")\n ?.map((addr) => addr.trim()),\n };\n if (!config.token || !config.allowlist?.length) {\n throw new Error(\"Server configuration error\");\n }\n return config;\n}\n",[],[220],{"_103":228,"_95":229,"_152":230,"_154":-5,"_155":137,"_156":231,"_158":159,"_105":232,"_100":233,"_162":177,"_164":234,"_166":22,"_167":-5,"_168":235,"_98":236},"c5512f84-ad27-11f0-ba7a-0224a6c84d84","db.ts","33e17d6c-ad1b-11f0-87af-0224a6c84d84",53,["D",1760904677373],5,"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { sql } from \"npm:drizzle-orm\";\nimport { drizzle } from \"npm:drizzle-orm/libsql\";\nimport { sqliteTable, text } from \"npm:drizzle-orm/sqlite-core\";\n\nexport const inboxRecords = sqliteTable(\"inbox_records\", {\n id: text(\"id\").primaryKey(),\n record: text(\"record\").notNull(),\n created_at: text(\"created_at\").default(sql`current_timestamp`),\n processed_at: text(\"processed_at\"),\n});\n\nexport const db = drizzle(sqlite as any);\n\nexport type InboxRecordRow = typeof inboxRecords.$inferSelect;\nexport type InboxRecordInsert = typeof inboxRecords.$inferInsert;\n",[],[229],{"_103":238,"_95":239,"_152":240,"_154":-5,"_155":137,"_156":241,"_158":159,"_105":242,"_100":32,"_162":163,"_164":243,"_166":22,"_167":-5,"_168":244,"_98":245},"e1671986-ad18-11f0-9137-0224a6c84d84","deno.json","e1671a4e-ad18-11f0-9137-0224a6c84d84",8,["D",1760898282044],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"include\": [\n \"deno:/https/esm.town/**/*\"\n ]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\",\n \"no-unversioned-import\",\n \"no-import-prefix\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}\n",[],[239],{"_103":247,"_95":248,"_152":249,"_154":-5,"_155":137,"_156":196,"_158":159,"_105":250,"_100":32,"_162":251,"_164":252,"_166":22,"_167":253,"_168":254,"_98":255},"e19590b8-ad18-11f0-a8a2-0224a6c84d84","emailHandler.ts","e1959162-ad18-11f0-a8a2-0224a6c84d84",["D",1760898282374],"email","import { email as sendEmail } from \"https://esm.town/v/std/email?v=13\";\n\nimport { dedent } from \"npm:ts-dedent\";\nimport { isAllowedSender } from \"./auth.ts\";\nimport InboxService from \"./InboxService.ts\";\nimport AttachmentService from \"./AttachmentService.ts\";\n\nconst emailToText = (email: Email): string => {\n return dedent`\n From: ${email.from}\n Subject: ${email.subject}\n\n ${email.text}\n `;\n};\n\nexport default async function emailHandler(email: Email) {\n if (!isAllowedSender(email)) {\n return;\n }\n\n // Process attachments\n const attachmentBlobIds: string[] = [];\n for (const attachment of email.attachments) {\n try {\n const blobId = await AttachmentService.save(attachment);\n attachmentBlobIds.push(blobId);\n } catch (err) {\n console.error(\"Failed to save attachment\", {\n filename: attachment.name,\n error: err instanceof Error ? err.message : String(err),\n });\n // Continue processing - omit failed attachments\n }\n }\n\n try {\n await InboxService.save({\n raw: emailToText(email),\n from: email.from,\n subject: email.subject,\n date: new Date(),\n attachmentBlobIds,\n });\n } catch (err) {\n const error = err instanceof Error ? err.message : String(err);\n console.error(\"Error processing email\", { email, error });\n await sendEmail({\n to: email.from,\n subject: \"Email handler error\",\n text: error,\n });\n }\n}\n","dmcd-inbox",[],[248],{"_103":257,"_95":99,"_152":258,"_154":-5,"_155":137,"_156":259,"_158":159,"_105":260,"_100":32,"_162":261,"_164":262,"_166":22,"_167":253,"_168":263,"_98":264},"e16e42ce-ad18-11f0-b4c5-0224a6c84d84","e16e438c-ad18-11f0-b4c5-0224a6c84d84",9,["D",1760898281962],"http","import { type Context, Hono } from \"https://esm.sh/hono@4.8.4\";\nimport InboxService, { validateInboxRecord } from \"./InboxService.ts\";\nimport AttachmentService from \"./AttachmentService.ts\";\nimport { bearerAuth } from \"./auth.ts\";\n\nconst app = new Hono().use(bearerAuth);\n\napp.get(\"/\", async (c: Context) => {\n const unprocessed = await InboxService.retrieveUnprocessed();\n return c.json(unprocessed, 200);\n});\n\napp.post(\n \"/\",\n validateInboxRecord,\n async (c) => {\n const key = await InboxService.save(c.req.valid(\"json\"));\n return c.json({ key }, 201);\n },\n);\n\napp.patch(\n \"/:id/processed\",\n async (c) => {\n const key = c.req.param(\"id\");\n const wasUpdated = await InboxService.markProcessed(key);\n\n if (!wasUpdated) {\n return c.json({ error: \"Record not found\" }, 404);\n }\n\n return c.json({ key, processed: true }, 200);\n },\n);\n\napp.get(\"/:recordId/attachments\", async (c) => {\n const recordId = c.req.param(\"recordId\");\n const record = await InboxService.getById(recordId);\n\n if (!record) {\n return c.json({ error: \"Record not found\" }, 404);\n }\n\n // Return attachment metadata with download links\n const attachments = await Promise.all(\n record.attachmentBlobIds.map(async (blobId) => {\n const attachment = await AttachmentService.get(blobId);\n return attachment\n ? {\n blobId,\n filename: attachment.filename,\n contentType: attachment.contentType,\n size: attachment.size,\n }\n : null;\n }),\n );\n\n return c.json({\n recordId,\n attachments: attachments.filter((a) => a !== null),\n }, 200);\n});\n\napp.get(\"/attachments/:blobId\", async (c) => {\n const blobId = c.req.param(\"blobId\");\n const attachment = await AttachmentService.get(blobId);\n\n if (!attachment) {\n return c.json({ error: \"Attachment not found\" }, 404);\n }\n\n return new Response(attachment.data, {\n headers: {\n \"Content-Type\": attachment.contentType,\n \"Content-Disposition\": `attachment; filename=\"${attachment.filename}\"`,\n \"Content-Length\": attachment.size.toString(),\n },\n });\n});\n\nexport default app.fetch;\n",[],[99],"files",[149,171,181,190,200,209,218,227,237,246,256],"counts",{"_269":32,"_270":271,"_272":32,"_273":274},"pulls","branches",1,"forks","envVars",{"_275":161,"_276":32},"count","emptyCount","contents",[],{"_103":257,"_155":137,"_152":258,"_95":99,"_164":262,"_162":261,"_100":32,"_154":-5,"_105":280,"_156":259,"_167":253,"_98":281},["D",1760898281962],[99],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.code.$",{"_93":94,"_95":96,"_97":43,"_100":-7,"_98":99,"_101":290,"_147":295,"_265":329,"_163":330,"_277":333,"_334":-5,"_335":-5,"_336":-5,"_337":-5,"_338":339},{"_103":104,"_95":96,"_105":291,"_107":-5,"_108":22,"_109":110,"_111":-5,"_112":-5,"_14":113,"_114":-5,"_115":22,"_116":-5,"_117":32,"_16":118,"_119":120,"_121":120,"_122":123,"_124":123,"_125":123,"_126":120,"_127":120,"_23":292,"_131":293,"_134":294,"_146":22},["D",1760898183380],{"_93":94,"_129":130},{"_93":94,"_133":130},{"_100":136,"_95":43,"_103":137,"_138":104,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":-5,"_144":96,"_145":94},[296,299,302,305,308,311,314,317,320,323,326],{"_103":150,"_95":151,"_152":153,"_154":-5,"_155":137,"_156":157,"_158":159,"_105":160,"_100":161,"_162":163,"_164":165,"_166":22,"_167":-5,"_168":297,"_98":298},[],[151],{"_103":172,"_95":173,"_152":174,"_154":-5,"_155":137,"_156":175,"_158":159,"_105":176,"_100":32,"_162":177,"_164":178,"_166":22,"_167":-5,"_168":300,"_98":301},[],[173],{"_103":182,"_95":183,"_152":184,"_154":-5,"_155":137,"_156":185,"_158":159,"_105":186,"_100":32,"_162":163,"_164":187,"_166":22,"_167":-5,"_168":303,"_98":304},[],[183],{"_103":191,"_95":192,"_152":193,"_154":-5,"_155":137,"_156":194,"_158":159,"_105":195,"_100":196,"_162":177,"_164":197,"_166":22,"_167":-5,"_168":306,"_98":307},[],[192],{"_103":201,"_95":202,"_152":203,"_154":-5,"_155":137,"_156":204,"_158":159,"_105":205,"_100":32,"_162":163,"_164":206,"_166":22,"_167":-5,"_168":309,"_98":310},[],[202],{"_103":210,"_95":211,"_152":212,"_154":-5,"_155":137,"_156":213,"_158":159,"_105":214,"_100":32,"_162":163,"_164":215,"_166":22,"_167":-5,"_168":312,"_98":313},[],[211],{"_103":219,"_95":220,"_152":221,"_154":-5,"_155":137,"_156":222,"_158":159,"_105":223,"_100":32,"_162":177,"_164":224,"_166":22,"_167":-5,"_168":315,"_98":316},[],[220],{"_103":228,"_95":229,"_152":230,"_154":-5,"_155":137,"_156":231,"_158":159,"_105":232,"_100":233,"_162":177,"_164":234,"_166":22,"_167":-5,"_168":318,"_98":319},[],[229],{"_103":238,"_95":239,"_152":240,"_154":-5,"_155":137,"_156":241,"_158":159,"_105":242,"_100":32,"_162":163,"_164":243,"_166":22,"_167":-5,"_168":321,"_98":322},[],[239],{"_103":247,"_95":248,"_152":249,"_154":-5,"_155":137,"_156":196,"_158":159,"_105":250,"_100":32,"_162":251,"_164":252,"_166":22,"_167":253,"_168":324,"_98":325},[],[248],{"_103":257,"_95":99,"_152":258,"_154":-5,"_155":137,"_156":259,"_158":159,"_105":260,"_100":32,"_162":261,"_164":262,"_166":22,"_167":253,"_168":327,"_98":328},[],[99],[296,299,302,305,308,311,314,317,320,323,326],{"_103":257,"_95":99,"_152":258,"_154":-5,"_155":137,"_156":259,"_158":159,"_105":331,"_100":32,"_162":261,"_164":262,"_166":22,"_167":253,"_98":332},["D",1760898281962],[99],[],"upstream","pull","ahead","behind","templates",[],"actionData","errors"]