[{"_1":2,"_475":-5,"_476":-5},"loaderData",{"_3":4,"_91":92,"_456":457},"root",{"_5":6,"_34":35,"_64":65},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":22,"_29":22,"_30":22,"_31":32,"_33":22},"auth",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"tokenType","session_token","sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","ENV",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","569c2cab8ded44a221d3e33107e42257e157d49b","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_66":67},"__internal_clerk_state",{"_68":69,"_70":45,"_71":72,"_73":72,"_74":22,"_75":72,"_76":72,"_77":72,"_78":72,"_79":80,"_89":22,"_90":22},"__clerk_ssr_state",{"_9":10,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":-5,"_20":-5,"_21":22},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_81":22,"_21":22,"_82":72,"_83":84,"_85":72,"_86":45,"_87":22,"_88":72},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/_app.x.$handle.$name",{"_93":94,"_95":96,"_97":-7,"_98":72,"_99":-7,"_100":101,"_146":147,"_397":398,"_399":400,"_409":410,"_298":-5,"_450":-5,"_451":-5,"_452":22,"_453":22,"_454":455},"handle","drewmcdonald","name","inbox","branchName","path","version","project",{"_102":103,"_95":96,"_104":105,"_106":-5,"_107":22,"_108":109,"_110":-5,"_111":-5,"_14":112,"_113":-5,"_114":22,"_115":-5,"_116":32,"_16":117,"_118":119,"_120":119,"_121":122,"_123":122,"_124":122,"_125":119,"_126":119,"_23":127,"_130":131,"_133":134,"_145":22},"id","a6919e76-ad18-11f0-8387-0224a6c84d84","createdAt",["D",1760898183380],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","b8db9d60-1994-11f0-a97f-49be2029e0a3","pinnedFileId","pinPreview","screenshotVersion","likeCount","5affebf8-2371-44b9-a6da-146d4a0e1f13","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_93":94,"_128":129},"profileImageUrl","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18ydmtBUlRqVEEwb1lKTWo3UHNHN25IZlo0UFYifQ","org",{"_93":94,"_132":129,"_14":112},"avatar","branch",{"_99":135,"_95":43,"_102":136,"_137":103,"_138":-5,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":96,"_144":94},374,"a6921cac-ad18-11f0-8387-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","tree",[148,235,291,302,310,319,329,339,349,358,369,379,388],{"_102":149,"_95":150,"_151":152,"_153":-5,"_154":136,"_155":156,"_157":158,"_104":159,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_165":166,"_98":234},"dcd5bc0a-ae90-11f0-acf5-0224a6c84d84","mcp","fileId","dcd5bcbe-ae90-11f0-acf5-0224a6c84d84","parentId","branchId","branchVersion",173,"latest",true,["D",1761059765190],"fileType","directory","content","deleted","label","children",[167,224],{"_102":168,"_95":169,"_151":170,"_153":152,"_154":136,"_155":171,"_157":158,"_104":172,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_165":173,"_98":223},"5fafbc96-ae93-11f0-98ad-0224a6c84d84","tools","5fafbd72-ae93-11f0-98ad-0224a6c84d84",221,["D",1761060843716],[174,185,195,203,213],{"_102":175,"_95":176,"_151":177,"_153":170,"_154":136,"_155":178,"_157":158,"_104":179,"_99":180,"_160":181,"_162":182,"_163":22,"_164":-5,"_165":183,"_98":184},"d52800aa-ae98-11f0-945d-0224a6c84d84","addRecord.ts","6f832734-ae93-11f0-a679-0224a6c84d84",273,["D",1761063188267],4,"script","import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { z } from \"npm:zod@^3.23.8\";\nimport type { Client } from \"../../apiClient.ts\";\n\nexport function registerAddRecord(\n server: McpServer,\n client: Client,\n) {\n server.registerTool(\"add_record\", {\n title: \"Add Record to Inbox\",\n description:\n \"Create a new inbox record. Matches the core InboxRecord schema.\",\n inputSchema: {\n raw: z.string().describe(\"The raw content of the record\"),\n summary: z.string().optional().describe(\n \"A brief summary of the content of the record\",\n ),\n from: z.string().optional().describe(\n \"The original sender or source of the record\",\n ),\n subject: z.string().optional().describe(\"Subject line or title\"),\n date: z.coerce.date().optional().describe(\n \"Date the record was received\",\n ),\n attachmentBlobIds: z.array(z.string()).default([]).describe(\n \"Array of blob IDs for attachments (defaults to empty array)\",\n ),\n },\n outputSchema: {\n id: z.string().describe(\"The UUID of the created record\"),\n },\n }, async (params) => {\n const res = await client.api.record.$post({\n json: params,\n });\n\n if (!res.ok) {\n throw new Error(\n `Failed to create record: ${res.status} ${res.statusText}`,\n );\n }\n\n const response = await res.json();\n const output = { id: response.key };\n return {\n content: [{ type: \"text\", text: JSON.stringify(output, null, 2) }],\n structuredContent: output,\n };\n });\n}\n",[],[150,169,176],{"_102":186,"_95":187,"_151":188,"_153":170,"_154":136,"_155":189,"_157":158,"_104":190,"_99":191,"_160":181,"_162":192,"_163":22,"_164":-5,"_165":193,"_98":194},"d557a6ac-ae98-11f0-9d87-0224a6c84d84","downloadRecordAttachment.ts","883241fc-ae93-11f0-9afd-0224a6c84d84",276,["D",1761063188270],3,"import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { z } from \"npm:zod@^3.23.8\";\nimport type { Client } from \"../../apiClient.ts\";\n\nexport function registerDownloadRecordAttachment(\n server: McpServer,\n client: Client,\n) {\n server.registerTool(\"download_record_attachment\", {\n title: \"Download Record Attachment\",\n description:\n \"Download attachment data by blob ID and record ID. Returns base64-encoded binary data.\",\n inputSchema: {\n recordId: z.string().describe(\"The record ID\"),\n blobId: z.string().describe(\n \"The blob ID of the attachment to download\",\n ),\n },\n outputSchema: {\n filename: z.string(),\n contentType: z.string(),\n size: z.number(),\n data: z.string().describe(\"Base64-encoded attachment data\"),\n },\n }, async (params) => {\n try {\n const res = await client.api.record[\":recordId\"].attachments[\":blobId\"]\n .$get({\n param: { recordId: params.recordId, blobId: params.blobId },\n });\n\n if (!res.ok) {\n throw new Error(\n `Failed to download attachment: ${res.status} ${res.statusText}`,\n );\n }\n\n const filename = res.headers.get(\"Content-Disposition\")\n ?.match(/filename=\"(.+)\"/)?.[1] || \"unknown\";\n const contentType = res.headers.get(\"Content-Type\") ||\n \"application/octet-stream\";\n const data = await res.arrayBuffer();\n\n // Convert ArrayBuffer to base64\n const bytes = new Uint8Array(data);\n const binary = Array.from(bytes, (byte) => String.fromCharCode(byte))\n .join(\n \"\",\n );\n const base64 = btoa(binary);\n\n const output = {\n filename,\n contentType,\n size: data.byteLength,\n data: base64,\n };\n\n return {\n content: [{ type: \"text\", text: JSON.stringify(output, null, 2) }],\n structuredContent: output,\n };\n } catch (error) {\n const output = {\n filename: \"\",\n contentType: \"\",\n size: 0,\n data: \"\",\n };\n return {\n content: [{\n type: \"text\",\n text: `Error: ${\n error instanceof Error ? error.message : String(error)\n }\\n${JSON.stringify(output, null, 2)}`,\n }],\n structuredContent: output,\n isError: true,\n };\n }\n });\n}\n",[],[150,169,187],{"_102":196,"_95":197,"_151":198,"_153":170,"_154":136,"_155":135,"_157":158,"_104":199,"_99":180,"_160":181,"_162":200,"_163":22,"_164":-5,"_165":201,"_98":202},"22b30bf0-aebf-11f0-8879-0224a6c84d84","index.ts","8f15a87e-ae93-11f0-a526-0224a6c84d84",["D",1761079639242],"import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { Client } from \"../../apiClient.ts\";\nimport { registerReadInbox } from \"./readInbox.ts\";\nimport { registerAddRecord } from \"./addRecord.ts\";\nimport { registerMarkRecordProcessed } from \"./markRecordProcessed.ts\";\nimport { registerDownloadRecordAttachment } from \"./downloadRecordAttachment.ts\";\n\nexport function registerAllTools(\n server: McpServer,\n client: Client,\n) {\n registerReadInbox(server, client);\n registerAddRecord(server, client);\n registerMarkRecordProcessed(server, client);\n registerDownloadRecordAttachment(server, client);\n}\n",[],[150,169,197],{"_102":204,"_95":205,"_151":206,"_153":170,"_154":136,"_155":207,"_157":158,"_104":208,"_99":209,"_160":181,"_162":210,"_163":22,"_164":-5,"_165":211,"_98":212},"d58936e0-ae98-11f0-b8c2-0224a6c84d84","markRecordProcessed.ts","75952b04-ae93-11f0-b41e-0224a6c84d84",277,["D",1761063188272],5,"import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { z } from \"npm:zod@^3.23.8\";\nimport type { Client } from \"../../apiClient.ts\";\n\nexport function registerMarkRecordProcessed(\n server: McpServer,\n client: Client,\n) {\n server.registerTool(\"mark_record_processed\", {\n title: \"Mark Processed\",\n description: \"Mark an inbox record as processed by ID\",\n inputSchema: {\n id: z.string().describe(\"The record ID to mark as processed\"),\n },\n outputSchema: {\n success: z.boolean(),\n },\n }, async (params) => {\n const res = await client.api.record[\":id\"].processed.$patch({\n param: { id: params.id },\n });\n\n const success = res.ok;\n const output = { success };\n return {\n content: [{ type: \"text\", text: JSON.stringify(output, null, 2) }],\n structuredContent: output,\n };\n });\n}\n",[],[150,169,205],{"_102":214,"_95":215,"_151":216,"_153":170,"_154":136,"_155":217,"_157":158,"_104":218,"_99":219,"_160":181,"_162":220,"_163":22,"_164":-5,"_165":221,"_98":222},"3410f8be-ae9a-11f0-a1bb-0224a6c84d84","readInbox.ts","67c78b48-ae93-11f0-bf3b-0224a6c84d84",281,["D",1761063777005],6,"import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport type { Client } from \"../../apiClient.ts\";\n\nexport function registerReadInbox(\n server: McpServer,\n client: Client,\n) {\n server.registerTool(\"read_inbox\", {\n title: \"Read Inbox\",\n description: \"Return all unprocessed records currently in the inbox\",\n inputSchema: {},\n }, async () => {\n const res = await client.api.inbox.$get();\n if (!res.ok) {\n throw new Error(\n `Failed to fetch inbox: ${res.status} ${res.statusText} ${\n JSON.stringify(await res.json())\n }`,\n );\n }\n const records = await res.json();\n const output = { records };\n return {\n content: [{ type: \"text\", text: JSON.stringify(output, null, 2) }],\n };\n });\n}\n",[],[150,169,215],[150,169],{"_102":225,"_95":226,"_151":227,"_153":152,"_154":136,"_155":228,"_157":158,"_104":229,"_99":230,"_160":181,"_162":231,"_163":22,"_164":-5,"_165":232,"_98":233},"ab47778c-ae95-11f0-89ae-0224a6c84d84","server.ts","08da214e-adbd-11f0-9481-0224a6c84d84",261,["D",1761061829525],89,"import { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\nimport { getClient } from \"../apiClient.ts\";\nimport { registerAllTools } from \"./tools/index.ts\";\n\nconst client = getClient();\nconst server = new McpServer({\n name: \"inbox\",\n version: \"0.1.0\",\n});\n\nregisterAllTools(server, client);\n\nexport { server };\n",[],[150,226],[150],{"_102":236,"_95":237,"_151":238,"_153":-5,"_154":136,"_155":239,"_157":158,"_104":240,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_165":241,"_98":290},"dcc66570-ae90-11f0-811e-0224a6c84d84","server","dcc66656-ae90-11f0-811e-0224a6c84d84",172,["D",1761059765089],[242,252,262,271,280],{"_102":243,"_95":244,"_151":245,"_153":238,"_154":136,"_155":246,"_157":158,"_104":247,"_99":248,"_160":181,"_162":249,"_163":22,"_164":-5,"_165":250,"_98":251},"91a78bea-aeb9-11f0-ac6d-0224a6c84d84","AttachmentService.ts","e1a2f73a-ad18-11f0-aeab-0224a6c84d84",357,["D",1761077248418],22,"import { blob } from \"https://esm.town/v/std/blob\";\n\nexport interface FileMetadata {\n filename: string;\n contentType: string;\n size: number;\n}\n\nexport interface FileMetadataWithId extends FileMetadata {\n id: string;\n}\n\nexport interface StoredAttachment extends FileMetadataWithId {\n data: ArrayBuffer;\n}\n\nconst getFileMetadata = (file: File): FileMetadata => {\n return {\n filename: file.name,\n contentType: file.type,\n size: file.size,\n };\n};\n\nconst AttachmentService = {\n async save(file: File): Promise {\n const key = crypto.randomUUID();\n const metadata = getFileMetadata(file);\n await Promise.all([\n blob.set(key, await file.arrayBuffer()),\n blob.setJSON(`${key}:meta`, metadata),\n ]);\n return key;\n },\n\n async getMetadata(key: string): Promise {\n const metadata = await blob.getJSON(`${key}:meta`) as FileMetadata;\n\n if (!metadata) return null;\n return { id: key, ...metadata };\n },\n\n async getMetadatas(keys: string[]): Promise {\n const metadatas = await Promise.all(\n keys.map((key) => AttachmentService.getMetadata(key)),\n );\n\n return metadatas.filter(Boolean);\n },\n\n async get(key: string): Promise {\n const [data, metadata] = await Promise.all([\n blob.get(key),\n AttachmentService.getMetadata(key),\n ]);\n\n if (!data || !metadata) {\n return null;\n }\n\n return {\n ...metadata,\n data: await data.arrayBuffer(),\n };\n },\n\n async delete(key: string): Promise {\n await Promise.all([\n blob.delete(key),\n blob.delete(`${key}:meta`),\n ]);\n },\n} as const;\n\nexport default AttachmentService;\n",[],[237,244],{"_102":253,"_95":254,"_151":255,"_153":238,"_154":136,"_155":256,"_157":158,"_104":257,"_99":258,"_160":181,"_162":259,"_163":22,"_164":-5,"_165":260,"_98":261},"59ed35be-aeba-11f0-b7a4-0224a6c84d84","InboxService.ts","e160826a-ad18-11f0-b2ed-0224a6c84d84",371,["D",1761077584416],45,"import { validator } from \"npm:hono/validator\";\nimport { eq, isNull, sql } from \"npm:drizzle-orm\";\nimport { db, type InboxRecordRow, inboxRecords } from \"./db.ts\";\nimport AttachmentService, {\n type FileMetadataWithId,\n} from \"./AttachmentService.ts\";\nimport { z } from \"npm:zod@^3.23.8\";\n\n// Core inbox record schema shared between API and MCP\nexport const inboxRecordSchema = z.object({\n raw: z.string(),\n summary: z.string().optional(),\n from: z.string().optional(),\n subject: z.string().optional(),\n date: z.coerce.date().optional(),\n attachmentBlobIds: z.array(z.string()),\n});\n\nexport type InboxRecord = z.infer;\nexport type EnhancedInboxRecord = InboxRecord & {\n id: string;\n attachments: FileMetadataWithId[];\n};\n\nexport const validateInboxRecord = validator(\"json\", (value, c) => {\n const parsed = inboxRecordSchema.safeParse(value);\n if (!parsed.success) {\n return c.json({ error: \"Invalid request\", details: parsed.error }, 400);\n }\n return parsed.data;\n});\n\nconst InboxService = {\n async save(data: InboxRecord): Promise {\n const id = crypto.randomUUID();\n const textData = JSON.stringify(data);\n\n await db.insert(inboxRecords).values({\n id,\n record: textData,\n });\n\n return id;\n },\n\n async markProcessed(id: string): Promise {\n const result = await db\n .update(inboxRecords)\n .set({\n processed_at: new Date().toISOString(),\n })\n .where(eq(inboxRecords.id, id))\n .returning({ id: inboxRecords.id });\n\n return result.length > 0;\n },\n\n async enhanceInboxRecordRow(\n row: InboxRecordRow,\n ): Promise {\n const parsed = inboxRecordSchema.parse(JSON.parse(row.record));\n return {\n ...parsed,\n id: row.id,\n attachments: await AttachmentService.getMetadatas(\n parsed.attachmentBlobIds,\n ),\n };\n },\n\n async retrieveUnprocessed(): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(isNull(inboxRecords.processed_at));\n\n return Promise.all(rows.map(InboxService.enhanceInboxRecordRow));\n },\n\n async getById(id: string): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(eq(inboxRecords.id, id));\n\n if (rows.length === 0) {\n return null;\n }\n\n const parsed = JSON.parse(rows[0].record);\n return inboxRecordSchema.parse(parsed);\n },\n\n /** Delete records processed more than 30 days ago */\n async hardDeleteProcessedRecords(): Promise {\n const rows = await db\n .select()\n .from(inboxRecords)\n .where(\n sql`${inboxRecords.processed_at} IS NOT NULL AND ${inboxRecords.processed_at} <= date('now', '-30 days')`,\n );\n\n const records = rows.map((row) => {\n const parsed = JSON.parse(row.record);\n return { ...inboxRecordSchema.parse(parsed), id: row.id };\n });\n\n const recordIds = records.map((record) => record.id);\n const attachmentKeys = records.flatMap((record) =>\n record.attachmentBlobIds || []\n );\n\n await Promise.all([\n ...recordIds.map((id) =>\n db.delete(inboxRecords).where(eq(inboxRecords.id, id))\n ),\n ...attachmentKeys.map((key) => AttachmentService.delete(key)),\n ]);\n },\n} as const;\n\nexport default InboxService;\n",[],[237,254],{"_102":263,"_95":264,"_151":265,"_153":238,"_154":136,"_155":266,"_157":158,"_104":267,"_99":180,"_160":181,"_162":268,"_163":22,"_164":-5,"_165":269,"_98":270},"7ba11da4-aea8-11f0-a31a-0224a6c84d84","app.ts","474f7670-ae91-11f0-8819-0224a6c84d84",297,["D",1761069910018],"import { type Context, Hono } from \"npm:hono\";\nimport InboxService, { validateInboxRecord } from \"./InboxService.ts\";\nimport AttachmentService from \"./AttachmentService.ts\";\nimport { bearerAuthMiddleware } from \"./auth.ts\";\n\nexport const app = new Hono()\n .get(\"/\", (c) => c.json({ status: \"ok\" }))\n .use(bearerAuthMiddleware)\n .get(\n \"/api/inbox\",\n async (c: Context) => {\n const unprocessed = await InboxService.retrieveUnprocessed();\n return c.json(unprocessed, 200);\n },\n ).post(\n \"/api/record\",\n validateInboxRecord,\n async (c) => {\n const key = await InboxService.save(c.req.valid(\"json\"));\n return c.json({ key }, 201);\n },\n ).patch(\n \"/api/record/:id/processed\",\n async (c) => {\n const key = c.req.param(\"id\");\n const wasUpdated = await InboxService.markProcessed(key);\n\n if (!wasUpdated) {\n return c.json({ error: \"Record not found\" }, 404);\n }\n\n return c.json({ key, processed: true }, 200);\n },\n ).get(\"/api/record/:recordId/attachments\", async (c) => {\n const recordId = c.req.param(\"recordId\");\n const record = await InboxService.getById(recordId);\n\n if (!record) {\n return c.json({ error: \"Record not found\" }, 404);\n }\n\n // Return attachment metadata with download links\n const attachments = await Promise.all(\n record.attachmentBlobIds.map(async (blobId) => {\n const attachment = await AttachmentService.get(blobId);\n return attachment\n ? {\n blobId,\n filename: attachment.filename,\n contentType: attachment.contentType,\n size: attachment.size,\n }\n : null;\n }),\n );\n\n return c.json({\n recordId,\n attachments: attachments.filter((a) => a !== null),\n }, 200);\n }).get(\"/api/record/:recordId/attachments/:blobId\", async (c) => {\n const blobId = c.req.param(\"blobId\");\n const attachment = await AttachmentService.get(blobId);\n\n if (!attachment) {\n return c.json({ error: \"Attachment not found\" }, 404);\n }\n\n return new Response(attachment.data, {\n headers: {\n \"Content-Type\": attachment.contentType,\n \"Content-Disposition\": `attachment; filename=\"${attachment.filename}\"`,\n \"Content-Length\": attachment.size.toString(),\n },\n });\n });\n\nexport type AppType = typeof app;\n",[],[237,264],{"_102":272,"_95":273,"_151":274,"_153":238,"_154":136,"_155":275,"_157":158,"_104":276,"_99":209,"_160":181,"_162":277,"_163":22,"_164":-5,"_165":278,"_98":279},"ffa171a0-ae92-11f0-8330-0224a6c84d84","auth.ts","e187d1c6-ad18-11f0-b841-0224a6c84d84",217,["D",1761060682551],"import type { Context } from \"npm:hono\";\n\nconst API_KEY_ENV_VAR = \"INBOX_API_TOKEN\";\nconst ALLOWLIST_ENV_VAR = \"INCOMING_EMAIL_ALLOWLIST\";\n\nexport async function bearerAuthMiddleware(\n c: Context,\n next: () => Promise,\n) {\n const expectedToken = getServerConfig().token;\n\n if (!expectedToken) {\n return c.json({ error: \"Server configuration error\" }, 500);\n }\n\n const authHeader = c.req.header(\"Authorization\");\n if (!authHeader || !authHeader.startsWith(\"Bearer \")) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n const token = authHeader.substring(7);\n if (token !== expectedToken) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n await next();\n}\n\nexport function isAllowedSender({ from }: Email): boolean {\n // Extract email address from 'Full Name ' or just 'email@domain'\n const match = from.match(/<([^>]+)>/);\n const emailAddress = match ? match[1] : from;\n\n const isAllowed = getServerConfig().allowlist.includes(emailAddress);\n\n if (!isAllowed) {\n console.error(\n `Email from ${from} (parsed: ${emailAddress}) not in allow list`,\n { from },\n );\n }\n\n return isAllowed;\n}\n\nfunction getServerConfig(): {\n token: string;\n allowlist: string[];\n} {\n const config = {\n token: Deno.env.get(API_KEY_ENV_VAR),\n allowlist: Deno.env.get(ALLOWLIST_ENV_VAR)?.split(\",\")\n ?.map((addr) => addr.trim()),\n };\n if (!config.token || !config.allowlist?.length) {\n throw new Error(\"Server configuration error\");\n }\n return config;\n}\n",[],[237,273],{"_102":281,"_95":282,"_151":283,"_153":238,"_154":136,"_155":284,"_157":158,"_104":285,"_99":286,"_160":181,"_162":287,"_163":22,"_164":-5,"_165":288,"_98":289},"b46ccd44-aea9-11f0-8ad0-0224a6c84d84","db.ts","33e17d6c-ad1b-11f0-87af-0224a6c84d84",307,["D",1761070434806],13,"import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { sql } from \"npm:drizzle-orm\";\nimport { drizzle } from \"npm:drizzle-orm/libsql\";\nimport { sqliteTable, text } from \"npm:drizzle-orm/sqlite-core\";\n\nexport const inboxRecords = sqliteTable(\"inbox_records\", {\n id: text(\"id\").primaryKey(),\n record: text(\"record\").notNull(),\n created_at: text(\"created_at\").default(sql`current_timestamp`),\n processed_at: text(\"processed_at\"),\n});\n\nexport const db = drizzle(sqlite as any);\n\nexport type InboxRecordRow = typeof inboxRecords.$inferSelect;\nexport type InboxRecordInsert = typeof inboxRecords.$inferInsert;\n\nexport async function createTable() {\n console.log(\"Creating sqlite table `inbox_records`...\");\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS inbox_records (\n id TEXT PRIMARY KEY,\n record TEXT NOT NULL,\n created_at TEXT DEFAULT CURRENT_TIMESTAMP,\n processed_at TEXT\n );\n `);\n}\n",[],[237,282],[237],{"_102":292,"_95":293,"_151":294,"_153":-5,"_154":136,"_155":295,"_157":158,"_104":296,"_99":297,"_160":298,"_162":299,"_163":22,"_164":-5,"_165":300,"_98":301},"33f59da6-ad1b-11f0-b734-0224a6c84d84",".vtignore","e17e0452-ad18-11f0-a853-0224a6c84d84",26,["D",1760899279407],2,"file",".env\n.git\n.vscode\n.cursor\n.DS_Store\n.zed\nnode_modules\nvendor\n",[],[293],{"_102":303,"_95":304,"_151":305,"_153":-5,"_154":136,"_155":286,"_157":158,"_104":306,"_99":32,"_160":298,"_162":307,"_163":22,"_164":-5,"_165":308,"_98":309},"e18fd70e-ad18-11f0-9137-0224a6c84d84","CLAUDE.md","e18fd7c2-ad18-11f0-9137-0224a6c84d84",["D",1760898282257],"# Claude Code Instructions for Obsidian Inbox\n\n## Project Overview\nSee PROJECT.md for full architecture. This is a Val.town service providing a temporary inbox for content before Obsidian vault processing.\n\n## Quick Context\n- **Platform**: Val.town (Deno serverless)\n- **Stack**: TypeScript, Hono, SQLite, Blob storage\n- **Purpose**: Buffer layer between input sources (email/HTTP) and Obsidian clients\n- **Current State**: Core internals focused, client integration TBD\n\n## AI Assistant Guidelines\n\n### When Working on This Project\n\n1. **Consult PROJECT.md first** for architecture and data flow\n2. **Consult .cursor/rules/townie.mdc** for Val.town platform specifics\n3. **Keep it simple** - this is a buffer service, not a full application\n4. **Manual testing only** - use Val.town web interface\n\n### Common Tasks\n\n**Schema Changes**:\n- Update `inboxRecordSchema` in InboxService.ts\n- Change SQLite table name (append `_2`, `_3`, etc.) - don't use ALTER TABLE\n- Update handlers if record structure changes\n\n**Adding Endpoints**:\n- Modify httpHandler.ts (Hono app)\n- Add bearer auth middleware to protected routes\n- Return proper status codes (200/201/400/401/404/500)\n\n**Modifying Processing Logic**:\n- Email processing → emailHandler.ts\n- HTTP processing → httpHandler.ts\n- Keep services (InboxService, AttachmentService) as pure data operations\n\n### Key Constraints\n\n- **No external services** - use Val.town stdlib (sqlite, blob, email)\n- **No binary files in project** - only text files allowed\n- **Environment variables** - never hardcode secrets, use `Deno.env.get()`\n- **Val.town quirks** - redirects need manual Response, not Response.redirect()\n- **Imports** - always use `https://esm.sh` for npm packages\n\n### Code Style\n\n- TypeScript with explicit types on public interfaces\n- Functional style preferred over classes\n- Keep functions small and focused\n- Export const objects for services (e.g., `InboxService`, `AttachmentService`)\n- Avoid try-catch unless you have a clear local resolution\n\n### Error Handling Philosophy\n\n- Let errors bubble up with full context\n- Don't catch just to log and re-throw\n- Use Zod validation for input schemas\n- Return descriptive error messages in HTTP responses\n\n### Testing Approach\n\nTest manually via Val.town web interface:\n- Email trigger: send test emails from allowlisted addresses\n- HTTP API: use curl/Postman with bearer token\n- Focus on edge cases: malformed input, auth failures, missing data\n\n### TODO Items to Consider\n\nWhen suggesting improvements, be aware of known TODOs:\n- Error handling and retry logic currently not implemented\n- Client architecture still being finalized\n- Consider push notifications vs polling for clients\n\n### File Navigation\n\nCore files you'll modify most:\n- `InboxService.ts` - data persistence layer\n- `emailHandler.ts` - email input processing\n- `httpHandler.ts` - HTTP API endpoints\n- `auth.ts` - authentication logic\n- `AttachmentService.ts` - blob storage operations\n\nSee PROJECT.md for full file reference and component descriptions.\n\n## Platform-Specific Reminders\n\nThis codebase runs on Val.town, which means:\n- Deno runtime (not Node.js)\n- Serverless execution model\n- Built-in SQLite and blob storage\n- Email sending/receiving capabilities\n- No filesystem access (use blob storage or SQLite)\n- All dependencies via HTTPS imports\n\nRefer to `.cursor/rules/townie.mdc` for comprehensive Val.town development guidelines including standard library usage, common gotchas, and best practices.\n",[],[304],{"_102":311,"_95":312,"_151":313,"_153":-5,"_154":136,"_155":314,"_157":158,"_104":315,"_99":297,"_160":298,"_162":316,"_163":22,"_164":-5,"_165":317,"_98":318},"5f968da2-aea7-11f0-a425-0224a6c84d84","PROJECT.md","e159175a-ad18-11f0-867e-0224a6c84d84",296,["D",1761069433481],"# Obsidian Inbox - LLM Context Guide\n\n## Project Summary\n\nA Val.town serverless service providing a temporary inbox for content before Obsidian vault processing. This is a **buffer layer** between input sources (email/HTTP) and processing clients (MCP/scripts).\n\n**Key Principle:** Simple, stateless inbox. Complex processing happens in clients, not here.\n\n## Platform: Val.town (Deno Serverless)\n\n**Critical Context:**\n- Runtime: Deno (not Node.js)\n- No filesystem access - use SQLite/blob storage only\n- Import npm packages via `https://esm.sh/package`\n- Use Val.town stdlib via `https://esm.town/v/std/library`\n- Serverless execution model - no long-running processes\n\n**Standard Library Available:**\n- `sqlite` - SQLite database\n- `blob` - Binary blob storage\n- `email` - Send/receive emails\n- Vals are exposed as HTTP endpoints, email handlers, or cron jobs\n\n## Architecture Overview\n\n### Data Flow\n\n```\nInput Sources → Handlers → Services → Storage → Clients\n ↓ ↓ ↓ ↓ ↓\n Email emailHandler InboxService SQLite MCP Server\n HTTP API → httpHandler AttachService Blob Custom Scripts\n```\n\n### Component Responsibilities\n\n**Handlers** (entry points for Val.town):\n- `emailHandler.ts` - Email trigger val, processes incoming emails\n- `httpHandler.ts` - HTTP val, exports `app.fetch` for API endpoints\n- `cleanupCron.ts` - Cron val, runs daily to delete old processed records\n\n**Services** (data layer):\n- `server/InboxService.ts` - CRUD operations on inbox records in SQLite\n- `server/AttachmentService.ts` - Store/retrieve binary files in blob storage\n- `server/auth.ts` - Bearer token auth & email sender allowlist\n\n**Core App**:\n- `server/app.ts` - Hono HTTP application with all routes\n- `server/db.ts` - Drizzle ORM schema definition\n\n**Client Integration**:\n- `mcp/server.ts` - MCP server setup (runs locally, not on Val.town)\n- `mcp/tools/` - MCP tool implementations\n- `apiClient.ts` - HTTP client using Hono's RPC client\n- `localMcpServer.ts` - Entry point for local MCP server\n\n## File Structure & Responsibilities\n\n### Val.town Vals (Remote Serverless)\n\n| File | Val Type | Purpose | Key Functions |\n|------|----------|---------|---------------|\n| `emailHandler.ts` | Email Trigger | Receives emails, saves to inbox | `emailHandler(email)` |\n| `httpHandler.ts` | HTTP | API endpoint, exports app | `export default app.fetch` |\n| `cleanupCron.ts` | Cron | Daily cleanup of old records | `cleanup()` |\n\n### Server Core (Deployed with vals)\n\n| File | Purpose | Exports |\n|------|---------|---------|\n| `server/app.ts` | Hono HTTP app definition | `app: Hono`, `AppType` |\n| `server/InboxService.ts` | Inbox record persistence | `InboxService.{save, markProcessed, retrieveUnprocessed, getById, hardDeleteProcessedRecords}` |\n| `server/AttachmentService.ts` | Blob storage operations | `AttachmentService.{save, get, delete}` |\n| `server/auth.ts` | Authentication logic | `bearerAuthMiddleware`, `isAllowedSender` |\n| `server/db.ts` | Database schema | `db`, `inboxRecords` table, types |\n\n### MCP Implementation (Local)\n\n| File | Purpose |\n|------|---------|\n| `mcp/server.ts` | MCP server setup, registers tools |\n| `mcp/tools/readInbox.ts` | Tool: List unprocessed records |\n| `mcp/tools/addRecord.ts` | Tool: Create new record |\n| `mcp/tools/markRecordProcessed.ts` | Tool: Mark as processed |\n| `mcp/tools/getRecordAttachments.ts` | Tool: List record attachments |\n| `mcp/tools/downloadRecordAttachment.ts` | Tool: Download attachment file |\n| `mcp/tools/index.ts` | Tool registration orchestration |\n| `localMcpServer.ts` | Entry point for MCP stdio transport |\n| `apiClient.ts` | HTTP client for remote API |\n\n## Data Models\n\n### InboxRecord (Zod Schema)\n\n**Location:** `server/InboxService.ts`\n\n```typescript\n{\n raw: string, // Full text content (email body, etc.)\n summary?: string, // Optional summary\n from?: string, // Source identifier (email, \"manual\", etc.)\n subject?: string, // Subject line or title\n date?: Date, // When received (coerced to Date)\n attachmentBlobIds: string[] // Array of blob storage keys\n}\n```\n\n**Validation:** Use `inboxRecordSchema` (Zod) for validation\n**Middleware:** `validateInboxRecord` for Hono routes\n\n### Database Schema (SQLite)\n\n**Table:** `inbox_records` (defined in `server/db.ts`)\n\n```sql\nCREATE TABLE inbox_records (\n id TEXT PRIMARY KEY, -- UUID\n record TEXT NOT NULL, -- JSON-serialized InboxRecord\n created_at TEXT DEFAULT current_timestamp,\n processed_at TEXT -- NULL until marked processed\n);\n```\n\n**ORM:** Drizzle ORM with LibSQL driver\n**Access:** Via `db` export from `server/db.ts`\n\n### Attachment Storage (Blob)\n\n**Keys:**\n- `{uuid}` - Binary file data (ArrayBuffer)\n- `{uuid}:meta` - JSON metadata: `{filename, contentType, size}`\n\n**Interface:** `StoredAttachment` in `server/AttachmentService.ts`\n\n## API Routes (server/app.ts)\n\nAll routes except `GET /` require Bearer token authentication via `bearerAuthMiddleware`.\n\n| Method | Path | Middleware | Handler | Returns |\n|--------|------|------------|---------|---------|\n| `GET` | `/` | None | Health check | `\"Hi mom\"` |\n| `GET` | `/api/inbox` | Bearer auth | List unprocessed | `InboxRecordWithId[]` |\n| `POST` | `/api/record` | Bearer auth + validation | Create record | `{key: string}` (201) |\n| `PATCH` | `/api/record/:id/processed` | Bearer auth | Mark processed | `{key, processed: true}` or 404 |\n| `GET` | `/api/record/:recordId/attachments` | Bearer auth | List attachments | `{recordId, attachments: [...]}` |\n| `GET` | `/api/record/:recordId/attachments/:blobId` | Bearer auth | Download file | Binary Response with headers |\n\n## Processing Lifecycle\n\n1. **Ingestion**: Item arrives via email or HTTP POST\n - Email: `emailHandler.ts` → validates sender → saves\n - HTTP: `POST /api/record` → validates schema → saves\n\n2. **Storage**: \n - `InboxService.save()` creates UUID, saves JSON to SQLite\n - `AttachmentService.save()` stores binary + metadata to blob\n - `processed_at` is `NULL`\n\n3. **Retrieval**:\n - Client calls `GET /api/inbox` → returns items where `processed_at IS NULL`\n - Client gets attachment metadata → `GET /api/record/:id/attachments`\n - Client downloads files → `GET /api/record/:id/attachments/:blobId`\n\n4. **Processing**:\n - Client transforms item (e.g., creates Obsidian notes)\n - **Outside this service** - client is responsible\n\n5. **Completion**:\n - Client calls `PATCH /api/record/:id/processed`\n - Sets `processed_at = current_timestamp`\n\n6. **Cleanup**:\n - Cron runs daily via `cleanupCron.ts`\n - Deletes records where `processed_at <= date('now', '-30 days')`\n - Deletes associated blobs via `AttachmentService.delete()`\n\n## Environment Variables\n\n**Required in Val.town secrets:**\n- `INBOX_API_TOKEN` - Bearer token for HTTP API authentication\n- `INCOMING_EMAIL_ALLOWLIST` - Comma-separated email addresses\n\n**Required for MCP client (local):**\n- `INBOX_API_URL` - URL to deployed httpHandler val\n- `INBOX_API_TOKEN` - Same token as above\n\n## Authentication\n\n### HTTP API (Bearer Token)\n\n**Location:** `server/auth.ts`\n\n**Middleware:** `bearerAuthMiddleware`\n- Checks `Authorization: Bearer {token}` header\n- Compares with `INBOX_API_TOKEN` env var\n- Returns 401 if missing/invalid\n\n### Email (Allowlist)\n\n**Location:** `server/auth.ts`\n\n**Function:** `isAllowedSender(email: Email)`\n- Extracts email address from `From:` header\n- Checks against `INCOMING_EMAIL_ALLOWLIST` env var\n- Logs rejection if not allowed\n- Returns boolean\n\n## Common Modification Patterns\n\n### Schema Changes\n\n**Steps:**\n1. Update `inboxRecordSchema` in `server/InboxService.ts`\n2. Change table name in `server/db.ts`:\n ```typescript\n // DON'T use ALTER TABLE - Val.town limitations\n export const inboxRecords = sqliteTable(\"inbox_records_2\", { ... });\n ```\n3. Update handlers if field usage changes\n4. Redeploy vals\n\n**Rationale:** Changing table name avoids migration complexity in serverless env.\n\n### Adding HTTP Endpoints\n\n**Steps:**\n1. Add route in `server/app.ts`:\n ```typescript\n .get(\"/api/new-endpoint\", bearerAuthMiddleware, async (c) => {\n // handler logic\n })\n ```\n2. Add auth middleware if needed (usually yes)\n3. Return proper status codes (200/201/400/401/404/500)\n4. Update `README.md` API reference\n\n### Adding MCP Tools\n\n**Steps:**\n1. Create `mcp/tools/newTool.ts`:\n ```typescript\n import type { McpServer } from \"npm:@modelcontextprotocol/sdk/server/mcp.js\";\n import type { Client } from \"../../apiClient.ts\";\n \n export function registerNewTool(server: McpServer, client: Client) {\n server.tool(\"tool-name\", \"description\", { /* schema */ }, async (params) => {\n // Call client API\n const response = await client.api.endpoint.$get();\n // Return result\n });\n }\n ```\n2. Register in `mcp/tools/index.ts`:\n ```typescript\n import { registerNewTool } from \"./newTool.ts\";\n \n export function registerAllTools(server: McpServer, client: Client) {\n // ... existing\n registerNewTool(server, client);\n }\n ```\n3. Test with Claude Desktop\n\n### Adding Input Sources\n\n**Steps:**\n1. Create new handler file (e.g., `webhookHandler.ts`)\n2. Create new val in Val.town with appropriate trigger type\n3. Transform input to `InboxRecord` format\n4. Call `InboxService.save(record)`\n5. Handle attachments via `AttachmentService.save(file)`\n\n## Error Handling Philosophy\n\n**Principle:** Fail-fast with context\n\n- **Don't catch unless you can handle locally** - let errors bubble\n- **Use Zod validation** for input schemas → automatic error messages\n- **Return descriptive errors** in HTTP responses\n- **Log before rejecting** (e.g., email sender not allowlisted)\n\n**Example:**\n```typescript\n// DON'T\ntry {\n const record = await InboxService.save(data);\n} catch (err) {\n console.error(err);\n throw err; // Useless catch\n}\n\n// DO\nconst record = await InboxService.save(data); // Let it throw\n```\n\n## Code Style Guidelines\n\n- **TypeScript** with explicit types on public interfaces\n- **Functional style** preferred over classes\n - Services are `const` objects with methods\n - Pure functions where possible\n- **Small, focused functions** - single responsibility\n- **No try-catch unless local resolution exists**\n- **Zod schemas** for all external input\n\n## Testing Approach\n\n**No automated tests** - manual testing via Val.town web interface\n\n**Email Testing:**\n1. Send test email from allowlisted address\n2. Check Val.town logs for processing\n3. Verify via `GET /api/inbox`\n\n**HTTP Testing:**\n```bash\n# Create record\ncurl -X POST https://your-val.web.val.run/api/record \\\n -H \"Authorization: Bearer TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\"raw\": \"test\", \"attachmentBlobIds\": []}'\n\n# List unprocessed\ncurl https://your-val.web.val.run/api/inbox \\\n -H \"Authorization: Bearer TOKEN\"\n\n# Mark processed\ncurl -X PATCH https://your-val.web.val.run/api/record/{id}/processed \\\n -H \"Authorization: Bearer TOKEN\"\n```\n\n**MCP Testing:**\n1. Configure Claude Desktop with local MCP server\n2. Ask Claude to interact with inbox\n3. Check Claude Desktop logs: `~/Library/Logs/Claude/mcp*.log`\n\n**Focus Areas:**\n- Malformed input (invalid JSON, missing fields)\n- Auth failures (wrong token, unlisted sender)\n- Missing data (nonexistent record IDs, blob keys)\n- Edge cases (empty attachments, special characters)\n\n## Known Limitations & TODOs\n\n**Current Limitations:**\n- No retry logic for failed processing\n- No notification when new items arrive (clients must poll)\n- 30-day retention is hardcoded\n- No bulk operations (must process one-by-one)\n\n**Potential Improvements:**\n- [ ] Push notifications / webhooks when new items arrive\n- [ ] Configurable retention period\n- [ ] Bulk mark as processed endpoint\n- [ ] Attachment size limits\n- [ ] Rate limiting on HTTP endpoints\n\n## Deployment Checklist\n\n**Initial Setup:**\n1. Create Val.town account\n2. Set secrets: `INBOX_API_TOKEN`, `INCOMING_EMAIL_ALLOWLIST`\n3. Deploy `emailHandler.ts` as email trigger val\n4. Deploy `httpHandler.ts` as HTTP val\n5. Deploy `cleanupCron.ts` as cron val (daily schedule)\n6. Note HTTP val URL for client configuration\n\n**Local MCP Setup:**\n1. Install Deno\n2. Create `.env` with `INBOX_API_URL` and `INBOX_API_TOKEN`\n3. Configure Claude Desktop (see README.md)\n4. Restart Claude Desktop\n5. Test: Ask Claude \"What's in my inbox?\"\n\n**Verification:**\n1. Send test email → check inbox appears\n2. Call HTTP API → verify auth works\n3. Use MCP tools → verify connection\n4. Wait 24h → verify cron runs\n\n## Val.town Specific Gotchas\n\n**Redirects:**\n- Don't use `Response.redirect()` - doesn't work\n- Use: `new Response(null, {status: 302, headers: {Location: url}})`\n\n**Imports:**\n- Always use `https://esm.sh/` for npm packages\n- Val.town stdlib: `https://esm.town/v/std/library`\n- Can reference other vals: `https://esm.town/v/username/valname`\n\n**State:**\n- No persistent filesystem - use SQLite or blob storage\n- No global state across invocations - serverless\n- Use Val.town's `sqlite` and `blob` from stdlib\n\n**Debugging:**\n- Check Val.town logs in web interface\n- `console.log()` appears in val logs\n- Errors are captured and displayed\n\n## Integration Points\n\n### For Claude Desktop (MCP)\n\n**MCP Server runs locally**, calls remote API:\n- Uses `apiClient.ts` with Hono RPC client\n- Type-safe calls via `hc(url)`\n- Tools map 1:1 to API endpoints\n\n**Available Tools:**\n- `inbox_read` → `GET /api/inbox`\n- `inbox_add_record` → `POST /api/record`\n- `inbox_mark_processed` → `PATCH /api/record/:id/processed`\n- `inbox_get_attachments` → `GET /api/record/:id/attachments`\n- `inbox_download_attachment` → `GET /api/record/:id/attachments/:blobId`\n\n### For Custom Clients\n\n**Direct HTTP API:**\n- All endpoints require Bearer token\n- Use any HTTP client\n- Parse JSON responses\n- Handle 401/404/500 errors\n\n**Workflow:**\n1. Poll `/api/inbox` for new items\n2. Process items (your logic)\n3. Mark each as processed\n4. Handle idempotency (items may reappear if processing fails)\n\n## Design Decisions Explained\n\n**Why separate MCP server from Val.town?**\n- Val.town vals are HTTP/email/cron only\n- MCP requires stdio transport (local process)\n- Separation keeps concerns clear: remote storage, local processing\n\n**Why not store processed items separately?**\n- Simple lifecycle: unprocessed → processed → deleted\n- SQLite index on `processed_at` is efficient\n- No need for complex archival\n\n**Why 30-day retention?**\n- Balance between \"oops, need to reprocess\" and storage costs\n- Processed items should be in Obsidian by then\n- Can be changed if needed (see `InboxService.hardDeleteProcessedRecords`)\n\n**Why JSON-serialized records in SQLite?**\n- Schema flexibility without migrations\n- Val.town SQLite is lightweight - not for complex queries\n- Simple key-value pattern matches use case\n\n**Why Hono instead of native Deno HTTP?**\n- Type-safe RPC client via `hc`\n- Middleware support (auth)\n- Familiar Express-like API\n- Small bundle size for serverless\n\n## Quick Reference\n\n### Add a new field to InboxRecord\n\n1. `server/InboxService.ts`:\n ```typescript\n export const inboxRecordSchema = z.object({\n // ... existing fields\n newField: z.string().optional(),\n });\n ```\n\n2. Update handlers if needed (`emailHandler.ts`, etc.)\n\n3. Redeploy vals\n\n### Change retention period\n\n`server/InboxService.ts` in `hardDeleteProcessedRecords`:\n```typescript\nsql`${inboxRecords.processed_at} <= date('now', '-60 days')` // Change 30 to 60\n```\n\n### Add a new MCP tool\n\nSee \"Adding MCP Tools\" section above.\n\n### Debug MCP connection\n\n```bash\n# Check Claude Desktop logs\ntail -f ~/Library/Logs/Claude/mcp*.log\n\n# Test MCP server directly\ndeno run --allow-net --allow-env localMcpServer.ts\n# Then send MCP protocol messages via stdin\n```\n\n### Force delete all processed records\n\nCall from Val.town REPL or add endpoint:\n```typescript\nawait InboxService.hardDeleteProcessedRecords();\n```\n\n## Summary for LLMs\n\nWhen working on this codebase:\n\n1. **Consult this file first** for architecture\n2. **Consult CLAUDE.md** for AI assistant specific guidelines \n3. **Consult README.md** for user-facing documentation\n4. **Remember:** This is a simple buffer, not a full application\n5. **Val.town constraints:** Deno runtime, no filesystem, serverless\n6. **Keep services pure** - handlers contain business logic\n7. **Let errors bubble** - don't catch unless you can handle\n8. **Test manually** - no test suite, use Val.town interface\n\n**Most common tasks:**\n- Schema changes → update Zod schema, change table name\n- New endpoints → add to `server/app.ts` with auth\n- New MCP tools → create in `mcp/tools/`, register in `index.ts`\n- Debug → check Val.town logs, Claude Desktop logs\n",[],[312],{"_102":320,"_95":321,"_151":322,"_153":-5,"_154":136,"_155":323,"_157":158,"_104":324,"_99":325,"_160":298,"_162":326,"_163":22,"_164":-5,"_165":327,"_98":328},"683cd974-aeb7-11f0-b21f-0224a6c84d84","README.md","21138b5c-aea7-11f0-bcda-0224a6c84d84",332,["D",1761076319940],24,"# POP Inbox\n\nAn [POP](https://en.wikipedia.org/wiki/Post_Office_Protocol)-like inbox for my note taking system. Rather than pushing things directly into my notes, I hold them here until I'm ready to thoughtfully engage with them. This separation allows me to capture freely in the moment, then process intentionally when I'm ready.\n\n### Ok, but why?\n\nWhen I yeet raw information into my vault, I don't get any benefit from it. This POP-like approach forces me to engage with things before storing them more permanently.\n\nAlso, more technically, Obsidian doesn't have a push-friendly API - you can't just send data to your vault from anywhere. Instead, you have to pull data into the vault from a client. Doing so requires a unified receptacle, that's this val!\n\n## Lifecycle\n\nThe inbox follows a simple three-stage lifecycle:\n\n1. **Ingest** - Content arrives via email or HTTP API and is stored as an unprocessed record\n2. **Process** - You review and integrate the content into your knowledge system (e.g., via Claude or your custom scripts)\n3. **Archive** - Once integrated, the record is marked as processed to keep your inbox clean\n\nA cleanup cron job periodically removes old processed records.\n\n## Quick Start\n\nSee [CLAUDE.md](./CLAUDE.md) for AI assistant guidelines and [PROJECT.md](./PROJECT.md) for detailed architecture.\n\n### Setup\n\n1. **Remix on Val.town**\n\n2. **Run one-time database setup**\n\n Run the [one-time setup script](onetimeSetup.ts) to create the database table in your val.town sqlite database.\n\n2. **Configure Environment Variables**\n\n In val.town, set these secrets:\n - `INBOX_API_TOKEN` - Create a secure random token for API auth (via e.g. `openssl rand -hex 32`)\n - `INCOMING_EMAIL_ALLOWLIST` - Comma-separated email addresses allowed to send records to the inbox (e.g. `name@gmail.com,name@work.org`)\n\n3. **Set up MCP Server**\n\n ```json\n {\n \"mcpServers\": {\n \"inbox\": {\n \"command\": \"deno\",\n \"args\": [\n \"run\",\n \"--allow-net\",\n \"--allow-env\",\n \"/path/to/inbox/localMcpServer.ts\"\n ],\n \"env\": {\n \"INBOX_API_URL\": \"https://your-username-httphandler.web.val.run\",\n \"INBOX_API_TOKEN\": \"your-api-token\"\n }\n }\n }\n }\n ```\n\n Alternatively, use the published val URL without downloading:\n ```json\n \"command\": \"deno\",\n \"args\": [\n \"run\",\n \"--allow-net\",\n \"--allow-env\",\n \"https://esm.town/v/your-username/inbox/localMcpServer.ts\"\n ]\n ```\n\n Consider adding `-r` to `deno run` to capture frequent updates.\n\n4. **Capture and Process your Inbox!**\n\n You can now forward emails to your inbox, create records from an MCP, or set up your own automations to create records directly.\n\n You can then chat with Claude about your inbox, or write a program that dumps them into your obsidian vault for you, or whatever you want! You have MCP, an HTTP API, and a typescript client. Go nuts!\n\n## File Organization\n\n```\nobsidian-inbox/\n├── server/ # Core http server logic\n├── mcp/ # Model Context Protocol server\n├── emailHandler.ts # Val.town email trigger\n├── httpHandler.ts # Val.town HTTP endpoint\n├── cleanupCron.ts # Val.town cron job\n├── localMcpServer.ts # Entry point for local MCP\n├── onetimeSetup.ts # One-time setup script\n└── apiClient.ts # HTTP client (used by MCP)\n```\n\n## Usage\n\n### Sending Content to Inbox\n\n**Via Email:**\nSend email to your Val.town email address from an allowlisted sender. The email body and attachments are automatically saved.\n\n**Via HTTP API:**\n```bash\ncurl -X POST https://your-val.web.val.run/api/record \\\n -H \"Authorization: Bearer YOUR_TOKEN\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n \"raw\": \"Content to process later\",\n \"subject\": \"Meeting notes\",\n \"from\": \"manual-entry\",\n \"date\": \"2025-10-21T10:00:00Z\",\n \"attachmentBlobIds\": []\n }'\n```\n\n**Via typescript client:**\n```typescript\nimport { getClient } from 'https://esm.town/v/${VALPATH}/apiClient.ts';\nconst client = getClient();\n\n// see the MCP tools for more\nconst res = await client.api.record.$post({\n json: params,\n});\n```\n\n### Processing Inbox Items\n\n**With Claude Desktop (MCP):**\nIn Claude Desktop, ask:\n- \"What's in my inbox?\"\n- \"Download the attachments from inbox item XYZ\"\n- \"Mark inbox item ABC as processed\"\n\n**With Custom Scripts:**\n```bash\n# Get unprocessed items\ncurl https://your-val.web.val.run/api/inbox \\\n -H \"Authorization: Bearer YOUR_TOKEN\"\n\n# Mark item as processed\ncurl -X PATCH https://your-val.web.val.run/api/record/{id}/processed \\\n -H \"Authorization: Bearer YOUR_TOKEN\"\n```\n\n## API Reference\n\nAll endpoints require `Authorization: Bearer YOUR_TOKEN` header.\n\n### Endpoints\n\n| Method | Path | Description |\n|--------|------|-------------|\n| `GET` | `/` | Health check (no auth required) |\n| `GET` | `/api/inbox` | Retrieve all unprocessed records |\n| `POST` | `/api/record` | Create new inbox record |\n| `PATCH` | `/api/record/:id/processed` | Mark record as processed |\n| `GET` | `/api/record/:recordId/attachments` | Get attachment metadata |\n| `GET` | `/api/record/:recordId/attachments/:blobId` | Download attachment file |\n\n## License\n\nGo nuts, but know this was largely vibe-coded\n",[],[321],{"_102":330,"_95":331,"_151":332,"_153":-5,"_154":136,"_155":333,"_157":158,"_104":334,"_99":335,"_160":181,"_162":336,"_163":22,"_164":-5,"_165":337,"_98":338},"ceed66b4-aea5-11f0-9687-0224a6c84d84","apiClient.ts","dd1dd882-ae90-11f0-b817-0224a6c84d84",294,["D",1761068761281],21,"import { hc } from \"npm:hono/client\";\nimport type { AppType } from \"./server/app.ts\";\n\nconst API_KEY_ENV_VAR = \"INBOX_API_TOKEN\";\nconst HTTP_ENDPOINT_ENV_VAR = \"INBOX_API_URL\";\n\nexport type Client = ReturnType>;\n\nlet _client: Client = undefined;\n\nexport function getClient() {\n if (_client) return _client;\n\n const config = {\n token: Deno.env.get(API_KEY_ENV_VAR),\n endpoint: Deno.env.get(HTTP_ENDPOINT_ENV_VAR),\n };\n\n if (!config.token || !config.endpoint) {\n throw new Error(\n `Client configuration error, expected environment variables ${API_KEY_ENV_VAR} and ${HTTP_ENDPOINT_ENV_VAR}`,\n );\n }\n\n const client = hc(config.endpoint, {\n headers: {\n \"Authorization\": `Bearer ${config.token}`,\n },\n });\n\n _client = client;\n return client;\n}\n",[],[331],{"_102":340,"_95":341,"_151":342,"_153":-5,"_154":136,"_155":343,"_157":158,"_104":344,"_99":180,"_160":345,"_162":346,"_163":22,"_164":-5,"_165":347,"_98":348},"abee7860-aea5-11f0-9c00-0224a6c84d84","cleanupCron.ts","af540034-aea4-11f0-a700-0224a6c84d84",293,["D",1761068702566],"interval","import InboxService from \"./server/InboxService.ts\";\n\nexport default async function cleanup() {\n try {\n await InboxService.hardDeleteProcessedRecords();\n console.log(\n `[Cleanup] Successfully deleted processed records older than 30 days`,\n );\n } catch (error) {\n console.error(`[Cleanup] Failed to delete processed records:`, error);\n throw error; // Re-throw to surface in Val.town logs\n }\n}\n",[],[341],{"_102":350,"_95":351,"_151":352,"_153":-5,"_154":136,"_155":353,"_157":158,"_104":354,"_99":297,"_160":298,"_162":355,"_163":22,"_164":-5,"_165":356,"_98":357},"bff8dd7a-aea3-11f0-ac4a-0224a6c84d84","deno.json","e1671a4e-ad18-11f0-9137-0224a6c84d84",285,["D",1761067877199],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"files\": {\n \"include\": [\"deno:/https/esm.town/**/*\"]\n },\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\",\n \"no-unversioned-import\",\n \"no-import-prefix\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}\n",[],[351],{"_102":359,"_95":360,"_151":361,"_153":-5,"_154":136,"_155":362,"_157":158,"_104":363,"_99":297,"_160":364,"_162":365,"_163":22,"_164":366,"_165":367,"_98":368},"d0186e8c-aebc-11f0-885b-0224a6c84d84","emailHandler.ts","e1959162-ad18-11f0-a8a2-0224a6c84d84",372,["D",1761078641664],"email","import { email as sendEmail } from \"https://esm.town/v/std/email?v=13\";\n\nimport { dedent } from \"npm:ts-dedent\";\nimport { isAllowedSender } from \"./server/auth.ts\";\nimport InboxService from \"./server/InboxService.ts\";\nimport AttachmentService from \"./server/AttachmentService.ts\";\n\nconst emailToText = (email: Email): string => {\n return dedent`\n From: ${email.from}\n Subject: ${email.subject}\n\n ${email.text}\n `;\n};\n\nexport default async function emailHandler(email: Email) {\n // Log email metadata\n console.log(\"Email received\", {\n from: email.from,\n subject: email.subject,\n attachmentCount: email.attachments?.length || 0,\n hasText: !!email.text,\n hasHtml: !!email.html,\n });\n\n if (!isAllowedSender(email)) {\n console.log(\"Email rejected - sender not allowed\", { from: email.from });\n return;\n }\n\n // Process attachments\n const attachmentBlobIds: string[] = [];\n for (const attachment of email.attachments) {\n try {\n const blobId = await AttachmentService.save(attachment);\n attachmentBlobIds.push(blobId);\n console.log(\"Attachment saved\", {\n filename: attachment.name,\n blobId,\n });\n } catch (err) {\n console.error(\"Failed to save attachment\", {\n filename: attachment.name,\n error: err instanceof Error ? err.message : String(err),\n });\n // Continue processing - omit failed attachments\n }\n }\n\n try {\n await InboxService.save({\n raw: emailToText(email),\n from: email.from,\n subject: email.subject,\n date: new Date(),\n attachmentBlobIds,\n });\n console.log(\"Email saved to inbox\", {\n from: email.from,\n subject: email.subject,\n attachmentCount: attachmentBlobIds.length,\n });\n } catch (err) {\n const error = err instanceof Error ? err.message : String(err);\n console.error(\"Error processing email\", {\n from: email.from,\n subject: email.subject,\n error,\n });\n await sendEmail({\n to: email.from,\n subject: \"Email handler error\",\n text: error,\n });\n }\n}\n","dmcd-inbox",[],[360],{"_102":370,"_95":371,"_151":372,"_153":-5,"_154":136,"_155":373,"_157":158,"_104":374,"_99":295,"_160":375,"_162":376,"_163":22,"_164":366,"_165":377,"_98":378},"d97e1816-ae92-11f0-96ff-0224a6c84d84","httpHandler.ts","e16e438c-ad18-11f0-b4c5-0224a6c84d84",214,["D",1761060618569],"http","import { app } from \"./server/app.ts\";\n\nexport default app.fetch;\n",[],[371],{"_102":380,"_95":381,"_151":382,"_153":-5,"_154":136,"_155":383,"_157":158,"_104":384,"_99":209,"_160":181,"_162":385,"_163":22,"_164":-5,"_165":386,"_98":387},"0518e0f0-ae98-11f0-9f4d-0224a6c84d84","localMcpServer.ts","5f036d08-ae96-11f0-b4e8-0224a6c84d84",269,["D",1761062839212],"import { server } from \"./mcp/server.ts\";\nimport { StdioServerTransport } from \"npm:@modelcontextprotocol/sdk/server/stdio.js\";\n\nconst transport = new StdioServerTransport();\nawait server.connect(transport);\n",[],[381],{"_102":389,"_95":390,"_151":391,"_153":-5,"_154":136,"_155":392,"_157":158,"_104":393,"_99":297,"_160":181,"_162":394,"_163":22,"_164":-5,"_165":395,"_98":396},"b6f37ac2-aea9-11f0-8f7a-0224a6c84d84","onetimeSetup.ts","6bbf7880-aea9-11f0-b4e6-0224a6c84d84",308,["D",1761070439046],"import { createTable } from \"./server/db.ts\";\n\nconsole.log(\"Beginning one-time setup...\");\nawait createTable();\nconsole.log(\"One-time setup complete.\");\n",[],[390],"files",[148,167,174,185,195,203,213,224,235,242,252,262,271,280,291,302,310,319,329,339,349,358,369,379,388],"counts",{"_401":32,"_402":403,"_404":32,"_405":406},"pulls","branches",1,"forks","envVars",{"_407":297,"_408":32},"count","emptyCount","contents",[411,414,417,420,423,426,429,432,435,438,441,444,447],{"_102":149,"_95":150,"_151":152,"_153":-5,"_154":136,"_155":156,"_157":158,"_104":412,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_98":413},["D",1761059765190],[150],{"_102":236,"_95":237,"_151":238,"_153":-5,"_154":136,"_155":239,"_157":158,"_104":415,"_99":32,"_160":161,"_162":-5,"_163":22,"_164":-5,"_98":416},["D",1761059765089],[237],{"_102":292,"_95":293,"_151":294,"_153":-5,"_154":136,"_155":295,"_157":158,"_104":418,"_99":297,"_160":298,"_162":299,"_163":22,"_164":-5,"_98":419},["D",1760899279407],[293],{"_102":303,"_95":304,"_151":305,"_153":-5,"_154":136,"_155":286,"_157":158,"_104":421,"_99":32,"_160":298,"_162":307,"_163":22,"_164":-5,"_98":422},["D",1760898282257],[304],{"_102":311,"_95":312,"_151":313,"_153":-5,"_154":136,"_155":314,"_157":158,"_104":424,"_99":297,"_160":298,"_162":316,"_163":22,"_164":-5,"_98":425},["D",1761069433481],[312],{"_102":320,"_95":321,"_151":322,"_153":-5,"_154":136,"_155":323,"_157":158,"_104":427,"_99":325,"_160":298,"_162":326,"_163":22,"_164":-5,"_98":428},["D",1761076319940],[321],{"_102":330,"_95":331,"_151":332,"_153":-5,"_154":136,"_155":333,"_157":158,"_104":430,"_99":335,"_160":181,"_162":336,"_163":22,"_164":-5,"_98":431},["D",1761068761281],[331],{"_102":340,"_95":341,"_151":342,"_153":-5,"_154":136,"_155":343,"_157":158,"_104":433,"_99":180,"_160":345,"_162":346,"_163":22,"_164":-5,"_98":434},["D",1761068702566],[341],{"_102":350,"_95":351,"_151":352,"_153":-5,"_154":136,"_155":353,"_157":158,"_104":436,"_99":297,"_160":298,"_162":355,"_163":22,"_164":-5,"_98":437},["D",1761067877199],[351],{"_102":359,"_95":360,"_151":361,"_153":-5,"_154":136,"_155":362,"_157":158,"_104":439,"_99":297,"_160":364,"_162":365,"_163":22,"_164":366,"_98":440},["D",1761078641664],[360],{"_102":370,"_95":371,"_151":372,"_153":-5,"_154":136,"_155":373,"_157":158,"_104":442,"_99":295,"_160":375,"_162":376,"_163":22,"_164":366,"_98":443},["D",1761060618569],[371],{"_102":380,"_95":381,"_151":382,"_153":-5,"_154":136,"_155":383,"_157":158,"_104":445,"_99":209,"_160":181,"_162":385,"_163":22,"_164":-5,"_98":446},["D",1761062839212],[381],{"_102":389,"_95":390,"_151":391,"_153":-5,"_154":136,"_155":392,"_157":158,"_104":448,"_99":297,"_160":181,"_162":394,"_163":22,"_164":-5,"_98":449},["D",1761070439046],[390],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_93":94,"_95":96,"_100":458,"_405":463},{"_102":103,"_95":96,"_104":459,"_106":-5,"_107":22,"_108":109,"_110":-5,"_111":-5,"_14":112,"_113":-5,"_114":22,"_115":-5,"_116":32,"_16":117,"_118":119,"_120":119,"_121":122,"_123":122,"_124":122,"_125":119,"_126":119,"_23":460,"_130":461,"_133":462,"_145":22},["D",1760898183380],{"_93":94,"_128":129},{"_93":94,"_132":129,"_14":112},{"_99":135,"_95":43,"_102":136,"_137":103,"_138":-5,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":96,"_144":94},[464,471],{"_465":466,"_104":467,"_468":469,"_110":72,"_470":22},"key","INCOMING_EMAIL_ALLOWLIST",["D",1760898477700],"updatedAt",["D",1760898560079],"isEmpty",{"_465":472,"_104":473,"_468":474,"_110":72,"_470":22},"INBOX_API_TOKEN",["D",1760898437955],["D",1761058571108],"actionData","errors"]

Key	Description
INCOMING_EMAIL_ALLOWLIST
INBOX_API_TOKEN