[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_151":152,"_153":154},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","dwsmarketing","name","queue-mirror-live","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":47,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","3ce96d6e-a2a6-4302-805f-2b6cc92c364b","main.ts","fileId","9ddce866-8815-11f1-8278-1607ee4eb77e","parentId","branchId","17ecb916-7582-4472-baa5-5089120dd5d7","branchVersion",1,"latest",true,"createdAt",["D",1784976184851],0,"fileType","http","content","// operator-queue-mirror/val-town/queue-mirror-live.val.ts\n//\n// Val Town HTTP val -- the LIVE phone hub for operator-queue-mirror.\n// Context: docs/ops/2026-07-22-queue-mirror-deploy.md · operator-queue-mirror/README.md\n// Lane: R2/a2 (overnight sprint, 2026-07-22).\n//\n// WHAT THIS IS: a single self-contained Deno HTTP val. On each request it:\n// 1. reads a bearer token from the `k` query param,\n// 2. server-side POSTs it to the Supabase RPC public.operator_mirror_snapshot\n// (migration 099 -- quick-capture/supabase/migrations/099_operator_mirror_read.sql)\n// using the PUBLISHABLE/anon key (safe to embed in val source BY DESIGN --\n// never the service_role key, which is FORBIDDEN here),\n// 3. on a bad/missing token, or any non-2xx from the RPC, returns a generic\n// 403 that never discloses which case applied,\n// 4. on success, server-renders the same dark, minimal-chrome mobile page\n// operator-queue-mirror/index.html already establishes (pending decisions\n// first, then tasks) with a manual refresh control + a passive\n// auto-refresh meta-tag.\n//\n// DEPLOY (MANUAL -- see docs/ops/2026-07-22-queue-mirror-deploy.md \"Val Town\n// deploy blocked\" section for why this is manual, not MCP-automated):\n// 1. New Val Town HTTP val, e.g. `dwsmarketing/operator-queue-mirror-live`.\n// 2. Paste this file's contents as the val's only source file.\n// 3. Set the val to Private/unlisted if the account plan allows it.\n// 4. The live URL + `?k=` (token from the vault: OPERATOR_MIRROR_TOKEN)\n// is the phone bookmark. Do NOT put the token anywhere else (no README,\n// no PR, no chat) -- it is a bearer credential.\n//\n// SECURITY NOTES:\n// - SUPABASE_ANON_KEY below is the PUBLISHABLE key (get_publishable_keys),\n// not service_role -- by design, this key alone grants nothing; the\n// token-gated RPC is the actual access control.\n// - This val never stores, logs, or echoes the token beyond the single\n// upstream RPC call for the current request.\n// - X-Robots-Tag: noindex + Cache-Control: no-store on every response\n// (200 and 403 alike) so the token-bearing URL is never cached or\n// crawled.\n// - No write path. This val is SELECT-only, same posture as\n// operator-queue-mirror/index.html.\n\nconst SUPABASE_URL = Deno.env.get(\"SUPABASE_URL\") || \"https://mgjqmyssszbfinxsjdsc.supabase.co\";\n// Publishable key (sb_publishable_...), not a secret -- safe to embed. See\n// migration 099's header comment for why service_role must never appear here.\nconst SUPABASE_ANON_KEY = Deno.env.get(\"SUPABASE_ANON_KEY\") || \"sb_publishable_u8s-fvr4H8QyTGytms_s1A_r8yvLiYf\";\n\nconst NO_CACHE_HEADERS: Record = {\n \"X-Robots-Tag\": \"noindex\",\n \"Cache-Control\": \"no-store\",\n};\n\n// ---- lib/core.mjs, inlined by hand (see ../lib/core.mjs -- Val Town vals\n// must stay a single self-contained file with no cross-repo imports, since\n// this private repo's raw.githubusercontent.com content isn't fetchable\n// without credentials Val Town doesn't have. The canonical, tested copy of\n// this logic lives in lib/core.mjs / test/core.test.mjs -- keep them in\n// sync if you touch either.) ----\n\nconst ATTENTION_ORDER = [\"auto\", \"approve\", \"interactive\"];\n\nfunction attentionRank(attention: string | null | undefined): number {\n const i = ATTENTION_ORDER.indexOf(attention ?? \"\");\n return i === -1 ? ATTENTION_ORDER.length : i;\n}\n\ntype Decision = {\n id: string;\n batch?: string | null;\n header?: string;\n question?: string;\n options?: string[];\n status: string;\n leverage?: number | null;\n effort_freed_minutes?: number | null;\n kind?: string | null;\n source?: string | null;\n created_at?: string | null;\n answered_at?: string | null;\n};\n\ntype Task = {\n id: string;\n title: string;\n scope_tag?: string | null;\n env_tags?: string[] | null;\n status: string;\n attention?: string | null;\n effort?: number | null;\n live?: boolean | null;\n updated_at?: string | null;\n is_struck?: boolean | null;\n};\n\nfunction pendingDecisions(decisions: Decision[]): Decision[] {\n if (!Array.isArray(decisions)) return [];\n return decisions\n .filter((d) => d && d.status === \"pending\")\n .slice()\n .sort((a, b) => {\n const lv = (b.leverage ?? 0) - (a.leverage ?? 0);\n if (lv !== 0) return lv;\n return new Date(a.created_at || 0).getTime() - new Date(b.created_at || 0).getTime();\n });\n}\n\nfunction topTasks(tasks: Task[], limit = 12): Task[] {\n if (!Array.isArray(tasks)) return [];\n return tasks\n .filter((t) => t && t.status && ![\"done\", \"archived\"].includes(t.status) && !t.is_struck)\n .slice()\n .sort((a, b) => {\n const ar = attentionRank(a.attention) - attentionRank(b.attention);\n if (ar !== 0) return ar;\n return (a.effort ?? 9999) - (b.effort ?? 9999);\n })\n .slice(0, limit);\n}\n\nfunction formatEffort(minutes: number | null | undefined): string {\n if (minutes == null) return \"?\";\n if (minutes < 60) return `${minutes}m`;\n const h = Math.floor(minutes / 60);\n const m = minutes % 60;\n return m === 0 ? `${h}h` : `${h}h${m}m`;\n}\n\nfunction relativeTime(iso: string | null | undefined, nowMs = Date.now()): string {\n if (!iso) return \"unknown\";\n const then = new Date(iso).getTime();\n if (Number.isNaN(then)) return \"unknown\";\n const diffMs = nowMs - then;\n const mins = Math.round(diffMs / 60000);\n if (mins < 1) return \"just now\";\n if (mins < 60) return `${mins}m ago`;\n const hours = Math.round(mins / 60);\n if (hours < 24) return `${hours}h ago`;\n const days = Math.round(hours / 24);\n return `${days}d ago`;\n}\n\n// Flattens one raw operator_mirror_snapshot RPC decision row (question as a\n// nested jsonb object) into {header, question, options, ...} -- identical to\n// lib/core.mjs's shapeDecisionFromRpcRow (and to generate-snapshot.mjs's\n// inline .map() for the static-snapshot path).\nfunction shapeDecisionFromRpcRow(d: any): Decision {\n const q = (d && d.question) || {};\n return {\n id: d.id,\n batch: d.batch,\n header: q.header ?? \"Decision\",\n question: q.question ?? \"\",\n options: Array.isArray(q.options) ? q.options.map((o: any) => (o && o.label) ?? String(o)) : [],\n status: d.status,\n leverage: d.leverage,\n effort_freed_minutes: d.effort_freed_minutes,\n kind: d.kind,\n source: d.source,\n created_at: d.created_at,\n answered_at: d.answered_at,\n };\n}\n\n// ---- rendering ----\n\nfunction esc(s: unknown): string {\n return String(s ?? \"\").replace(/[&<>\"']/g, (c) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n } as Record)[c]);\n}\n\nfunction renderDecisionsSection(decisions: Decision[]): string {\n const pending = pendingDecisions(decisions);\n if (pending.length === 0) {\n const recent = decisions\n .slice()\n .sort((a, b) => new Date(b.created_at || 0).getTime() - new Date(a.created_at || 0).getTime())\n .slice(0, 3);\n const note = recent.length\n ? \" Most recently answered: \" + recent.map((d) => esc(d.header)).join(\", \") + \".\"\n : \"\";\n return `

Pending decisions 0

No pending decisions right now.${note}

`;\n }\n\n const cards = pending\n .map((d) => {\n const options = Array.isArray(d.options) ? d.options : [];\n return `\n

\n PENDING\n ${d.leverage != null ? `leverage ${esc(d.leverage)}` : \"\"}\n ${d.effort_freed_minutes != null ? `frees ${formatEffort(d.effort_freed_minutes)}` : \"\"}\n ${esc(relativeTime(d.created_at))}\n

${esc(d.header || \"Decision\")}

${esc(d.question)}

\n ${options.length ? `

${options.map((opt) => `

${esc(opt)}

`).join(\"\")}

` : \"\"}\n

batch: ${esc(d.batch || \"—\")}id: ${esc(d.id).slice(0, 8)}

`;\n })\n .join(\"\");\n\n return `

Pending decisions ${pending.length}

${cards}

`;\n}\n\nfunction renderTasksSection(tasks: Task[]): string {\n const top = topTasks(tasks, 20);\n if (top.length === 0) {\n return `

Tasks 0

No active tasks in this snapshot.

`;\n }\n\n const cards = top\n .map(\n (t) => `\n

\n ${esc(t.attention || \"unknown\")}\n ${esc(t.scope_tag || \"—\")}\n ${(t.env_tags || []).map((e) => `${esc(e)}`).join(\"\")}\n ${t.live ? `LIVE` : \"\"}\n

${esc(t.title)}

effort ${formatEffort(t.effort)} · updated ${esc(relativeTime(t.updated_at))}

`\n )\n .join(\"\");\n\n return `

Tasks ${top.length}

${cards}

`;\n}\n\nfunction renderPage(snapshot: { generated_at?: string; decisions: Decision[]; tasks: Task[] }, token: string): string {\n const refreshHref = `?k=${encodeURIComponent(token)}`;\n return `\n\n\n\n\n\n\nQueue Mirror — live\n\n\n\n

Queue Mirror

\n live\n generated ${esc(relativeTime(snapshot.generated_at))} Refresh\n

\n \n ${renderDecisionsSection(snapshot.decisions)}\n ${renderTasksSection(snapshot.tasks)}\n

\n Data source: token-gated operator_mirror_snapshot RPC · generated ${esc(snapshot.generated_at || \"unknown\")}.\n Auto-refreshes every 90s; tap Refresh above for now. No service-role token is ever used from this val.\n

\n\n`;\n}\n\nfunction forbidden(): Response {\n return new Response(\"Forbidden\", {\n status: 403,\n headers: { ...NO_CACHE_HEADERS, \"Content-Type\": \"text/plain; charset=utf-8\" },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"k\");\n\n if (!token) {\n return forbidden();\n }\n\n let rpcJson: any;\n try {\n const rpcRes = await fetch(`${SUPABASE_URL}/rest/v1/rpc/operator_mirror_snapshot`, {\n method: \"POST\",\n headers: {\n apikey: SUPABASE_ANON_KEY,\n Authorization: `Bearer ${SUPABASE_ANON_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ p_token: token }),\n });\n if (!rpcRes.ok) {\n // Bad/missing token (or any upstream failure) -- generic 403, no detail\n // leaked about which case applied.\n return forbidden();\n }\n rpcJson = await rpcRes.json();\n } catch {\n return forbidden();\n }\n\n const decisions: Decision[] = Array.isArray(rpcJson?.decisions)\n ? rpcJson.decisions.map(shapeDecisionFromRpcRow)\n : [];\n const tasks: Task[] = Array.isArray(rpcJson?.tasks) ? rpcJson.tasks : [];\n\n const html = renderPage({ generated_at: rpcJson?.generated_at, decisions, tasks }, token);\n return new Response(html, {\n status: 200,\n headers: { ...NO_CACHE_HEADERS, \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}\n","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1784976184851],"children",[],[35],"282cfa98-1534-4f40-8052-5c9923f2ae41",["D",1784975875395],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Operator surface phone hub — token-gated Queue + Tasks mirror","imageUrl","userId","ff33de80-e4ce-11ef-8a8f-3387f12638e3","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","fadc4c85-c366-4d40-9574-ffeb95c95ba4","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_71":72,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yc2dUZFNPOU5wNDVBcFBGbHZGNzVYb2ZDc3oifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":147,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":69,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":47,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":148,"_95":149,"_97":150,"_99":53},[144],"files",[144],"counts",{"_135":47,"_136":42,"_137":47,"_31":138,"_139":140},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":134},[35],"pulls","branches","forks",{"_141":47,"_143":47},"connections",{"_141":47,"_142":47},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":145,"_18":146},[],[35],["D",1784975875395],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_71":72,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":184,"_185":186,"_187":188,"_189":53,"_190":53,"_191":53,"_192":44,"_193":-5,"_194":-7,"_195":-7,"_196":47,"_197":53,"_198":53,"_199":-5,"_200":53,"_201":53,"_202":53,"_203":-5},"ENV",{"_155":156,"_157":158,"_159":16,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code