[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_169":170,"_171":172},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_128":-5,"_20":129,"_22":130,"_131":132,"_133":134,"_25":135,"_24":-5,"_136":-5,"_137":-5,"_138":54,"_139":140,"_141":45,"_142":-5,"_143":-5,"_144":145},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","joshbeckman","name","micropub","branchName","main","version","path","","project",{"_34":74,"_13":14,"_46":75,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":19,"_82":-5,"_83":84,"_85":-5,"_86":54,"_87":-5,"_88":-5,"_89":90,"_91":92,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":98,"_99":98,"_100":101,"_102":101,"_103":101,"_104":98,"_105":98,"_106":107,"_108":109,"_110":111,"_112":54},"tree",[65,66],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_18":64},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","0323a9b2-0576-4344-a198-7d80b7cf248d","micropub.ts","fileId","1708dc0c-76e8-11f1-be5b-1607ee4eb77e","parentId","branchId","cc78135e-d874-4663-a65c-b2e92440987a","branchVersion",6,"latest",true,"createdAt",["D",1783262312145],3,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport yaml from \"npm:js-yaml@4.1.0\";\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n// Direct-commit Micropub endpoint: translates Micropub create/media requests\n// into commits against the Jekyll repo, reusing the site's own build/optimize\n// workflows rather than a separate publishing pipeline.\n//\n// Auth is a single shared bearer token (MICROPUB_TOKEN) rather than IndieAuth:\n// chosen to prove the loop with the least moving parts. It is swappable for an\n// IndieAuth token check at verifyToken() without touching the rest.\n\nconst REPO = Deno.env.get(\"GITHUB_REPO\") || \"joshbeckman/notes\";\nconst BRANCH = Deno.env.get(\"GIT_BRANCH\") || \"master\";\nconst SITE_URL = (Deno.env.get(\"SITE_URL\") || \"https://www.joshbeckman.org\").replace(/\\/$/, \"\");\nconst SITE_TZ = Deno.env.get(\"SITE_TZ\") || \"America/Chicago\";\nconst GITHUB_TOKEN = Deno.env.get(\"GITHUB_TOKEN\") || \"\";\nconst MICROPUB_TOKEN = Deno.env.get(\"MICROPUB_TOKEN\") || \"\";\nconst GARDEN_PASSWORD = Deno.env.get(\"GARDEN_PASSWORD\") || \"\";\nconst INDIEAUTH_SECRET = Deno.env.get(\"INDIEAUTH_SECRET\") || \"\";\nconst COMMITTER = {\n name: Deno.env.get(\"GIT_COMMITTER_NAME\") || \"micropub-val\",\n email: Deno.env.get(\"GIT_COMMITTER_EMAIL\") || \"josh@joshbeckman.org\",\n};\n\nconst app = new Hono();\n\n// Bearer token can arrive in the Authorization header or, per the Micropub\n// spec, as an access_token form field. Header wins.\nfunction bearerFromHeader(c: any): string | null {\n const auth = c.req.header(\"Authorization\") || \"\";\n const m = auth.match(/^Bearer\\s+(.+)$/i);\n return m ? m[1] : null;\n}\n\n// --- IndieAuth: self-hosted authorization + token endpoints ---\n//\n// Tokens/codes are stateless HMAC-signed blobs (no DB for the happy path).\n// The one place state is required is single-use enforcement of auth codes,\n// which uses std/blob to burn a code's jti on redemption.\n\nfunction b64urlEncode(bytes: Uint8Array): string {\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\nfunction b64urlDecode(s: string): Uint8Array {\n s = s.replace(/-/g, \"+\").replace(/_/g, \"/\");\n while (s.length % 4) s += \"=\";\n const bin = atob(s);\n const out = new Uint8Array(bin.length);\n for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);\n return out;\n}\nconst b64urlStr = (s: string) => b64urlEncode(new TextEncoder().encode(s));\nconst unb64urlStr = (s: string) => new TextDecoder().decode(b64urlDecode(s));\n\nlet _key: CryptoKey | null = null;\nasync function signingKey(): Promise {\n if (!_key) {\n _key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(INDIEAUTH_SECRET),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n }\n return _key;\n}\nasync function hmac(data: string): Promise {\n const sig = await crypto.subtle.sign(\"HMAC\", await signingKey(), new TextEncoder().encode(data));\n return b64urlEncode(new Uint8Array(sig));\n}\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let out = 0;\n for (let i = 0; i < a.length; i++) out |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return out === 0;\n}\nasync function signPayload(payload: Record): Promise {\n const p = b64urlStr(JSON.stringify(payload));\n return `${p}.${await hmac(p)}`;\n}\nasync function verifyPayload(token: string): Promise | null> {\n const [p, sig] = token.split(\".\");\n if (!p || !sig) return null;\n if (!timingSafeEqual(sig, await hmac(p))) return null;\n let payload: Record;\n try {\n payload = JSON.parse(unb64urlStr(p));\n } catch {\n return null;\n }\n if (payload.exp && Math.floor(Date.now() / 1000) > payload.exp) return null;\n return payload;\n}\nasync function sha256b64url(s: string): Promise {\n const d = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(s));\n return b64urlEncode(new Uint8Array(d));\n}\n\n// Single-use enforcement: an auth code's jti is burned in blob storage on\n// first redemption so a replay within the 5-minute window is rejected.\nasync function codeAlreadyUsed(jti: string): Promise {\n try {\n return !!(await blob.getJSON(`mp_used_code_${jti}`));\n } catch {\n return false;\n }\n}\nasync function burnCode(jti: string): Promise {\n try {\n await blob.setJSON(`mp_used_code_${jti}`, { at: Date.now() });\n } catch {\n // If blob write fails we fail closed at the caller rather than issue a token.\n }\n}\n\nasync function verifyToken(token: string | null): Promise {\n if (!token) return false;\n // Shared secret kept as a fallback for curl/scripts.\n if (MICROPUB_TOKEN && token === MICROPUB_TOKEN) return true;\n const payload = await verifyPayload(token);\n return !!payload && payload.t === \"token\";\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let binary = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n binary += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(binary);\n}\n\nfunction textToBase64(text: string): string {\n return toBase64(new TextEncoder().encode(text));\n}\n\nasync function getSha(path: string): Promise {\n const res = await fetch(\n `https://api.github.com/repos/${REPO}/contents/${encodeURI(path)}?ref=${BRANCH}`,\n { headers: ghHeaders() },\n );\n if (res.status === 200) return (await res.json()).sha;\n return undefined;\n}\n\nfunction ghHeaders() {\n return {\n Authorization: `Bearer ${GITHUB_TOKEN}`,\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"micropub-val\",\n \"Content-Type\": \"application/json\",\n };\n}\n\nasync function commitFile(path: string, contentBase64: string, message: string) {\n const sha = await getSha(path);\n const res = await fetch(`https://api.github.com/repos/${REPO}/contents/${encodeURI(path)}`, {\n method: \"PUT\",\n headers: ghHeaders(),\n body: JSON.stringify({\n message,\n content: contentBase64,\n branch: BRANCH,\n committer: COMMITTER,\n ...(sha ? { sha } : {}),\n }),\n });\n if (!res.ok) {\n throw new Error(`GitHub commit failed for ${path}: ${res.status} ${await res.text()}`);\n }\n return res.json();\n}\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n\nfunction slugify(title: string): string {\n return title.replace(/[^a-zA-Z0-9\\s]/g, \"\").replace(/\\s+/g, \"-\").toLowerCase();\n}\n\n// Match Post#front_matter date format: \"YYYY-MM-DD HH:MM:SS +ZZZZ\" in the\n// site's timezone, so posts land on the right calendar day near midnight.\nfunction formatInTz(date: Date, tz: string): { day: string; full: string } {\n const parts = Object.fromEntries(\n new Intl.DateTimeFormat(\"en-CA\", {\n timeZone: tz,\n year: \"numeric\",\n month: \"2-digit\",\n day: \"2-digit\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n second: \"2-digit\",\n hour12: false,\n timeZoneName: \"longOffset\",\n })\n .formatToParts(date)\n .map((p) => [p.type, p.value]),\n );\n const day = `${parts.year}-${parts.month}-${parts.day}`;\n const hour = parts.hour === \"24\" ? \"00\" : parts.hour;\n const offset = (parts.timeZoneName || \"GMT+00:00\").replace(\"GMT\", \"\").replace(\":\", \"\") || \"+0000\";\n return { day, full: `${day} ${hour}:${parts.minute}:${parts.second} ${offset}` };\n}\n\nfunction firstValue(v: any): string | undefined {\n if (v == null) return undefined;\n if (Array.isArray(v)) v = v[0];\n if (v == null) return undefined;\n if (typeof v === \"object\") return v.html ?? v.value ?? undefined;\n return String(v);\n}\n\nfunction photoUrl(p: any): string | undefined {\n if (typeof p === \"string\") return p;\n if (p && typeof p === \"object\") return p.value ?? p.url ?? undefined;\n return undefined;\n}\n\n// A site-absolute media URL (from our own media endpoint) is rewritten to a\n// repo-relative path so the committed post references the in-repo asset rather\n// than round-tripping through the live CDN.\nfunction toRepoPath(url: string): string {\n if (url.startsWith(SITE_URL + \"/\")) return url.slice(SITE_URL.length);\n return url;\n}\n\ntype Parsed = {\n h: string;\n name?: string;\n content?: string;\n categories: string[];\n photos: string[];\n files: File[];\n published?: string;\n slug?: string;\n inReplyTo?: string;\n summary?: string;\n syndicateTo: string[];\n token: string | null;\n};\n\nasync function parseRequest(c: any): Promise {\n const ct = c.req.header(\"Content-Type\") || \"\";\n let token = bearerFromHeader(c);\n\n if (ct.includes(\"application/json\")) {\n const body = await c.req.json();\n const props = body.properties || {};\n const type = Array.isArray(body.type) ? body.type[0] : body.type;\n return {\n h: (type || \"h-entry\").replace(/^h-/, \"\"),\n name: firstValue(props.name),\n content: firstValue(props.content),\n categories: (props.category || []).map((x: any) => String(x)),\n photos: (props.photo || []).map(photoUrl).filter(Boolean) as string[],\n files: [],\n published: firstValue(props.published),\n slug: firstValue(props[\"mp-slug\"]),\n inReplyTo: firstValue(props[\"in-reply-to\"]),\n summary: firstValue(props.summary),\n syndicateTo: (props[\"mp-syndicate-to\"] || []).map((x: any) => String(x)),\n token,\n };\n }\n\n const fd = await c.req.formData();\n if (!token) token = (fd.get(\"access_token\") as string) || null;\n const cats = [...fd.getAll(\"category[]\"), ...fd.getAll(\"category\")].filter(\n (v) => typeof v === \"string\",\n ) as string[];\n const rawPhotos = [...fd.getAll(\"photo[]\"), ...fd.getAll(\"photo\")];\n return {\n h: ((fd.get(\"h\") as string) || \"entry\").replace(/^h-/, \"\"),\n name: (fd.get(\"name\") as string) || undefined,\n content: (fd.get(\"content\") as string) || undefined,\n categories: cats,\n photos: rawPhotos.filter((v) => typeof v === \"string\") as string[],\n files: rawPhotos.filter((v) => v instanceof File) as File[],\n published: (fd.get(\"published\") as string) || undefined,\n slug: (fd.get(\"mp-slug\") as string) || undefined,\n inReplyTo: (fd.get(\"in-reply-to\") as string) || undefined,\n summary: (fd.get(\"summary\") as string) || undefined,\n syndicateTo: [...fd.getAll(\"mp-syndicate-to[]\"), ...fd.getAll(\"mp-syndicate-to\")].filter(\n (v) => typeof v === \"string\",\n ) as string[],\n token,\n };\n}\n\n// Syndication targets map Micropub uids to the frontmatter flags the existing\n// POSSE cron looks for; setting the field to `false` marks a post for pickup.\nconst SYNDICATION_TARGETS = [\n { uid: \"mastodon\", name: \"Mastodon\", field: \"mastodon_social_status_url\" },\n { uid: \"bluesky\", name: \"Bluesky\", field: \"bluesky_status_url\" },\n];\n\n// Reuse the site's own tagger val (same one issue_post's suggested_tags hits)\n// so phone posts get auto-tagged when the author supplies none.\nasync function suggestTags(content: string): Promise {\n try {\n const res = await fetch(\"https://joshbeckman-tagger.web.val.run/\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({ content }),\n });\n const json = await res.json();\n return Array.isArray(json.suggestedTags) ? json.suggestedTags : [];\n } catch {\n return [];\n }\n}\n\n// Micropub config query: advertises the media endpoint + syndication targets,\n// and serves the site's tag vocabulary for client-side autocomplete.\napp.get(\"/\", async (c) => {\n const q = c.req.query(\"q\");\n if (q === \"config\" || q === \"syndicate-to\") {\n const cfg = {\n \"media-endpoint\": `${new URL(c.req.url).origin}/media`,\n \"syndicate-to\": SYNDICATION_TARGETS.map(({ uid, name }) => ({ uid, name })),\n };\n return c.json(q === \"syndicate-to\" ? { \"syndicate-to\": cfg[\"syndicate-to\"] } : cfg);\n }\n if (q === \"category\") {\n const tags = await fetch(`${SITE_URL}/assets/js/tags.json`)\n .then((r) => r.json())\n .catch(() => []);\n return c.json({ categories: tags.map((t: any) => t.name).filter(Boolean) });\n }\n return c.text(\"Micropub endpoint\", 200);\n});\n\n// Media endpoint: commit an uploaded image and hand back its site-absolute URL.\napp.post(\"/media\", async (c) => {\n if (!(await verifyToken(bearerFromHeader(c)))) return c.text(\"Unauthorized\", 401);\n const fd = await c.req.formData();\n const file = (fd.get(\"file\") || fd.get(\"photo\")) as File | null;\n if (!file) return c.text(\"Missing file\", 400);\n\n const safe = file.name.replace(/[^a-zA-Z0-9._-]/g, \"-\");\n const name = `${Date.now()}-${safe}`;\n const path = `assets/images/${name}`;\n const bytes = new Uint8Array(await file.arrayBuffer());\n await commitFile(path, toBase64(bytes), `new(usr): Upload ${name} via micropub`);\n\n const url = `${SITE_URL}/${path}`;\n c.header(\"Location\", url);\n return c.json({ url }, 201);\n});\n\napp.post(\"/\", async (c) => {\n const parsed = await parseRequest(c);\n if (!(await verifyToken(parsed.token))) return c.text(\"Unauthorized\", 401);\n if (parsed.h !== \"entry\") return c.text(\"Only h-entry is supported\", 400);\n\n // Commit any inline photo files uploaded in the create request itself\n // (clients that skip the media endpoint), collecting their repo paths.\n const inlinePaths: string[] = [];\n for (const file of parsed.files) {\n const safe = file.name.replace(/[^a-zA-Z0-9._-]/g, \"-\");\n const name = `${Date.now()}-${safe}`;\n const path = `assets/images/${name}`;\n const bytes = new Uint8Array(await file.arrayBuffer());\n await commitFile(path, toBase64(bytes), `new(usr): Upload ${name} via micropub`);\n inlinePaths.push(`/${path}`);\n }\n\n let body = parsed.content || \"\";\n\n // Optional YAML frontmatter inside the content overrides Micropub props and\n // defaults, mirroring the site's issue_post frontmatter path so the phone\n // flow behaves \"just like normal Jekyll\".\n let fm: Record = {};\n const fmMatch = body.match(/^---\\n([\\s\\S]*?)\\n---\\n?/);\n if (fmMatch) {\n fm = (yaml.load(fmMatch[1]) as Record) || {};\n body = body.slice(fmMatch[0].length);\n }\n\n const photoPaths = [\n ...parsed.photos.map(toRepoPath),\n ...inlinePaths,\n ];\n\n const title = fm.title || parsed.name;\n if (!title) return c.text(\"A title is required (name or frontmatter title)\", 400);\n\n const category = fm.category || \"blog\";\n const when = fm.date ? new Date(fm.date) : parsed.published ? new Date(parsed.published) : new Date();\n const { day, full } = formatInTz(isNaN(when.getTime()) ? new Date() : when, SITE_TZ);\n const slug = fm.slug || parsed.slug || slugify(title);\n let tags: string[] = fm.tags\n ? (Array.isArray(fm.tags) ? fm.tags : String(fm.tags).split(\",\").map((t) => t.trim()))\n : parsed.categories;\n if (!tags || tags.length === 0) tags = await suggestTags(`${title}\\n${body}`);\n const image = fm.image || (photoPaths.length ? photoPaths[0] : undefined);\n const description = fm.description ?? parsed.summary;\n const inReplyTo = fm.in_reply_to ?? parsed.inReplyTo;\n\n // Generalized passthrough: any frontmatter key the author writes is emitted\n // verbatim, except the routing keys (category/slug → file path) and the keys\n // handled explicitly below. This covers issue_post's long tail (hide_title,\n // photo_feature, canonical, rating, song_link, …) without per-field code.\n const CONTROL_KEYS = new Set([\n \"category\", \"slug\", \"title\", \"date\", \"tags\", \"image\", \"description\",\n \"published\", \"layout\", \"in_reply_to\",\n ]);\n const passthrough: Record = {};\n for (const [k, v] of Object.entries(fm)) {\n if (!CONTROL_KEYS.has(k)) passthrough[k] = v;\n }\n\n // Inline the photos above the body, matching set_album_art's prepend style.\n const imageMd = photoPaths.map((p) => `![](${p})`).join(\"\\n\");\n const finalBody = [imageMd, body.trim()].filter(Boolean).join(\"\\n\\n\");\n\n const front: Record = {\n layout: fm.layout || \"Post\",\n date: full,\n title,\n toc: true,\n };\n if (image) front.image = image;\n if (description) front.description = description;\n if (inReplyTo) front.in_reply_to = inReplyTo;\n Object.assign(front, passthrough);\n // Explicit frontmatter flags win; otherwise selected syndication targets set\n // the POSSE pickup flag.\n for (const t of SYNDICATION_TARGETS) {\n if (parsed.syndicateTo.includes(t.uid) && front[t.field] === undefined) {\n front[t.field] = false;\n }\n }\n if (tags && tags.length) front.tags = tags.map((t: string) => String(t).toLowerCase());\n if (fm.published !== undefined) front.published = fm.published;\n\n const fileContent = `---\\n${yaml.dump(front)}---\\n\\n${finalBody}\\n`;\n const path = `${category}/_posts/${day}-${slug}.md`;\n await commitFile(path, textToBase64(fileContent), `new(usr): Post \"${title}\" via micropub`);\n\n const location = `${SITE_URL}/${category}/${slug}`;\n c.header(\"Location\", location);\n return c.body(null, 201);\n});\n\n// IndieAuth authorization endpoint: approval form. The password gate is the\n// identity check — this val is its own identity provider, so there is no\n// third-party login to delegate to.\napp.get(\"/auth\", (c) => {\n const q = c.req.query();\n const hidden = [\n \"client_id\",\n \"redirect_uri\",\n \"state\",\n \"scope\",\n \"code_challenge\",\n \"code_challenge_method\",\n \"me\",\n \"response_type\",\n ]\n .map((k) => ``)\n .join(\"\\n\");\n return c.html(`\nAuthorize\n\n

Authorize app

${escapeHtml(q.client_id || \"unknown app\")} is requesting\nscope ${escapeHtml(q.scope || \"create\")}.

\n`);\n});\n\napp.post(\"/auth\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (!GARDEN_PASSWORD || get(\"password\") !== GARDEN_PASSWORD) {\n return c.text(\"Forbidden\", 403);\n }\n const redirectUri = get(\"redirect_uri\");\n if (!redirectUri) return c.text(\"Missing redirect_uri\", 400);\n\n const code = await signPayload({\n t: \"code\",\n jti: crypto.randomUUID(),\n client_id: get(\"client_id\"),\n redirect_uri: redirectUri,\n scope: get(\"scope\") || \"create\",\n me: get(\"me\") || SITE_URL,\n cc: get(\"code_challenge\"),\n ccm: get(\"code_challenge_method\"),\n exp: Math.floor(Date.now() / 1000) + 300,\n });\n\n const sep = redirectUri.includes(\"?\") ? \"&\" : \"?\";\n const state = get(\"state\");\n const location = `${redirectUri}${sep}code=${encodeURIComponent(code)}${\n state ? `&state=${encodeURIComponent(state)}` : \"\"\n }`;\n return c.body(null, 302, { Location: location });\n});\n\n// IndieAuth token endpoint: exchange a single-use auth code for an access token.\napp.post(\"/token\", async (c) => {\n const fd = await c.req.formData();\n const get = (k: string) => (fd.get(k) as string) || \"\";\n if (get(\"grant_type\") !== \"authorization_code\") {\n return c.json({ error: \"unsupported_grant_type\" }, 400);\n }\n const payload = await verifyPayload(get(\"code\"));\n if (!payload || payload.t !== \"code\") return c.json({ error: \"invalid_grant\" }, 400);\n if (payload.client_id !== get(\"client_id\") || payload.redirect_uri !== get(\"redirect_uri\")) {\n return c.json({ error: \"invalid_grant\" }, 400);\n }\n // PKCE: verify code_verifier against the challenge bound to the code.\n if (payload.cc) {\n const verifier = get(\"code_verifier\");\n if (!verifier) return c.json({ error: \"invalid_grant\" }, 400);\n const challenge = payload.ccm === \"plain\" ? verifier : await sha256b64url(verifier);\n if (!timingSafeEqual(challenge, payload.cc)) return c.json({ error: \"invalid_grant\" }, 400);\n }\n if (await codeAlreadyUsed(payload.jti)) return c.json({ error: \"invalid_grant\" }, 400);\n await burnCode(payload.jti);\n\n const accessToken = await signPayload({\n t: \"token\",\n me: payload.me,\n scope: payload.scope,\n iat: Math.floor(Date.now() / 1000),\n exp: Math.floor(Date.now() / 1000) + 10 * 365 * 24 * 3600,\n });\n return c.json({\n access_token: accessToken,\n token_type: \"Bearer\",\n scope: payload.scope,\n me: payload.me,\n });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","deleted",false,"label",[36],"9abcdc73-3cc7-47a1-84b1-deac18486565","micropub.README.md","170e3d00-76e8-11f1-972e-1607ee4eb77e",4,["D",1783134560317],1,"# micropub\n\nA [Micropub](https://micropub.spec.indieweb.org/) endpoint that turns posts\nwritten in a phone Micropub client into commits on this repo. The site's\nexisting `optimize.yml` and `jekyll.yml` workflows then optimize images and\ndeploy — no separate publishing pipeline.\n\n## How it works\n\n```\nPhone client ──┬── GET /auth → approval page (password) → auth code\n ├── POST /token → exchange code (+PKCE) → access token\n ├── POST /media → commit to assets/images/, return URL\n └── POST / → build blog/_posts/-.md, commit\n ▲\n Bearer access token (or MICROPUB_TOKEN fallback)\n```\n\n- **Direct commit** (not the issue `/post` flow): the media endpoint commits the\n image first, so the created post references an in-repo path and never races\n the GitHub Pages deploy.\n- **Auth is self-hosted IndieAuth.** This val is its own identity provider: the\n authorization endpoint gates on a password (`GARDEN_PASSWORD`), then issues an\n HMAC-signed, single-use auth code; the token endpoint verifies it (with PKCE)\n and returns a long-lived HMAC-signed access token. No third-party service, no\n DB except a `std/blob` entry per code to enforce single use.\n- **`MICROPUB_TOKEN`** remains a shared-secret fallback for curl/scripts.\n- **Frontmatter override**: if the post content starts with a `---` YAML block,\n it overrides Micropub properties and defaults (`category`, `published`,\n `slug`, `tags`, `title`, `date`, `image`, `description`) — the same mental\n model as the site's issue-based posting.\n\n## Property mapping\n\n| Micropub | Post |\n|---|---|\n| `name` | `title` (required unless set in frontmatter) |\n| `content` | body (leading `---` frontmatter block is parsed as overrides) |\n| `category[]` | `tags` |\n| `photo[]` (URL or uploaded file) | inlined `![](…)` + frontmatter `image` |\n| `published` (datetime) | `date` |\n| `mp-slug` | `slug` |\n| — (defaults to `blog`) | Jekyll category, override via frontmatter `category:` |\n\n## Deploy\n\nFrom this directory:\n\n```sh\nvt create micropub # or: vt push, if already linked\n```\n\nSet env vars on the val:\n\n| Var | Required | Default |\n|---|---|---|\n| `GITHUB_TOKEN` | yes | — (fine-grained PAT with Contents: read/write on this repo) |\n| `INDIEAUTH_SECRET` | yes | — (random string; signs auth codes + access tokens) |\n| `GARDEN_PASSWORD` | yes | — (the password you enter on the approval page) |\n| `MICROPUB_TOKEN` | no | — (optional shared-secret fallback for curl/scripts) |\n| `GITHUB_REPO` | no | `joshbeckman/notes` |\n| `GIT_BRANCH` | no | `master` |\n| `SITE_URL` | no | `https://www.joshbeckman.org` |\n| `SITE_TZ` | no | `America/Chicago` |\n| `GIT_COMMITTER_NAME` | no | `micropub-val` |\n| `GIT_COMMITTER_EMAIL` | no | `josh@joshbeckman.org` |\n\nThe `` in `_includes/head.html` points clients here:\n`https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run`.\n\n## Client setup\n\n1. Sign in with your site URL `https://www.joshbeckman.org` (the client\n discovers the micropub/authorization/token endpoints from the page head).\n2. You're redirected to the approval page — enter `GARDEN_PASSWORD` and approve.\n3. The client stores its own token; write, attach photos, publish.\n\nWorks with [Quill](https://quill.p3k.io/) (web), iA Writer, and Indigenous — all\nspeak IndieAuth, so none need a raw token pasted in.\n\n## Test without a client\n\nUses the optional `MICROPUB_TOKEN` shared-secret fallback (IndieAuth is for GUI\nclients; curl skips it).\n\n```sh\nTOKEN=your-micropub-token\nURL=https://joshbeckman--1708dc0c76e811f1be5b1607ee4eb77e.web.val.run\n\n# config\ncurl \"$URL/?q=config\" -H \"Authorization: Bearer $TOKEN\"\n\n# create a post\ncurl -i \"$URL/\" -H \"Authorization: Bearer $TOKEN\" \\\n -d h=entry -d name=\"Hello from the phone\" \\\n -d content=\"A first micropub post.\" \\\n --data-urlencode \"category[]=publishing\"\n```\n",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_68":72,"_18":73},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":69,"_18":70},["D",1783262312145],"children",[],[36],["D",1783134560317],[],[58],"aee488a9-e6df-4a32-84a4-811c1705df2c",["D",1783087461183],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f8d90ec1-81be-4efc-b861-a032f3f5b85f","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","b1ec36cc-9d04-4938-872f-34bf39599d6a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_127":123},"org",{"_11":12,"_121":-5,"_122":123,"_83":84,"_124":125,"_126":54},"branch",{"_17":43,"_13":16,"_34":41,"_113":74,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":-5,"_119":14,"_120":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJTZm1HaHJGdDFmQ2s5ME05RW9lT1JGbHZPYyIsImluaXRpYWxzIjoiSkIifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":74,"_13":14,"_46":165,"_76":-5,"_77":54,"_78":79,"_80":79,"_81":19,"_82":-5,"_83":84,"_85":-5,"_86":54,"_87":-5,"_88":-5,"_89":90,"_91":92,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":98,"_99":98,"_100":101,"_102":101,"_103":101,"_104":98,"_105":98,"_106":166,"_108":167,"_110":168,"_112":54},[159,160],"files",[159,160],"counts",{"_150":90,"_151":62,"_152":90,"_31":153,"_154":155},[146,147],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_18":149},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":148},[36],[58],"pulls","branches","forks",{"_156":60,"_158":90},"connections",{"_156":90,"_157":90},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":71,"_17":62,"_49":24,"_51":63,"_53":54,"_55":-5,"_68":163,"_18":164},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":67,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_68":161,"_18":162},[],[36],[],[58],["D",1783087461183],{"_11":12,"_127":123},{"_11":12,"_121":-5,"_122":123,"_83":84,"_124":125,"_126":54},{"_17":43,"_13":16,"_34":41,"_113":74,"_114":-5,"_115":-5,"_116":-5,"_117":-5,"_118":-5,"_119":14,"_120":12},"ctx",{"_106":-5,"_143":202,"_203":204,"_205":206,"_207":54,"_208":54,"_209":54,"_210":45,"_211":-5,"_212":-7,"_213":-7,"_214":90,"_215":54,"_216":54,"_217":-5,"_218":54,"_219":54,"_220":54,"_221":-5},"ENV",{"_173":174,"_175":176,"_177":16,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]