Click forgot password.

\"\n status: PUBLISHED\n slug: \"reset-password\"\n}) { helpCenterArticle { id title } error { message code fields { field message } } } }\n```\nScopes: `helpCenter:create/edit/read/delete` plus **separate** `helpCenterArticle:*` and\n`helpCenterArticleGroup:*` scopes. `generateHelpCenterArticle` AI-drafts from a thread.\nFor bulk migration: fetch each source page, convert to clean HTML, create groups mirroring their nav,\nthen loop `upsertHelpCenterArticle`.\n\n## 11. Ari knowledge sources ✅ verified\n\n`KnowledgeSource` is a union — use inline fragments.\n\n```graphql\nmutation { createKnowledgeSource(input: {\n url: \"https://acme.com/sitemap.xml\"\n type: SITEMAP # SITEMAP (crawls the sitemap) | URL (single page)\n labelTypeIds: []\n}) {\n knowledgeSource {\n __typename\n ... on KnowledgeSourceSitemap { id url }\n ... on KnowledgeSourceUrl { id url }\n }\n error { message code fields { field message } }\n} }\n```\nA help center you create is auto-indexed — no separate source needed. Scopes:\n`knowledgeSource:create/read/delete`. Also `reindexKnowledgeSource`, `deleteKnowledgeSource`.\n\n## 12. Sidekick ✅ verified (settings + custom skill)\n\n```graphql\nmutation { updateSidekickSettings(input: {\n customPrompt: \"Always mention our 30-day refund policy.\"\n}) { error { message code } } }\n\nmutation { createSidekickCustomSkill(input: {\n displayName: \"Check subscription status\"\n description: \"Looks up a customer's plan and billing status\"\n instructions: \"Use the billing MCP for lookups only.\"\n}) { customSkill { id displayName } error { message code } } } # output is `customSkill`\n```\nScopes: `sidekickSettings:read/update`, `sidekickCustomSkill:create/edit/read/delete`,\n`sidekickMcpServer:read/update` — **note there is no `sidekickMcpServer:create` scope**, so\n`createSidekickMcpServer` may be restricted; verify before promising it.\nPer-integration scopes exist and are individually gated:\n`sidekickPosthogIntegration:update`, `sidekickSentryIntegration:update`,\n`sidekickLinearIntegration:update`, `sidekickJiraIntegration:update`, `sidekickGithubIntegration:update`,\n`sidekickNotionIntegration:update`, `sidekickHubspotIntegration:update`, `sidekickDatadogIntegration:update`,\n`sidekickGrafanaIntegration:update`, `sidekickIncidentioIntegration:update`, `sidekickAttioIntegration:update`,\n`sidekickLaunchdarklyIntegration:update`, plus `workspaceSlackSidekickIntegration:create/update/delete`.\nOAuth-based connectors still need a human to complete consent in the browser.\n\n## 13. Webhook targets ✅ verified\n\n```graphql\nmutation { createWebhookTarget(input: {\n url: \"https://acme.com/plain-webhook\"\n eventSubscriptions: [\n { eventType: \"thread.service_level_agreement_status_transitioned\" }\n { eventType: \"thread.thread_created\" }\n ]\n isEnabled: true\n description: \"Ops alerts\"\n}) { webhookTarget { id } error { message code fields { field message } } } }\n```\n**`thread.sla_status_transitioned` does not exist.** Valid webhook event types (distinct from workflow\nevents): `thread.thread_created`, `thread.thread_status_transitioned`,\n`thread.thread_assignment_transitioned`, `thread.email_received`, `thread.email_sent`,\n`thread.slack_message_received`, `thread.slack_message_sent`, `thread.slack_message_updated`,\n`thread.discord_message_received`, `thread.discord_message_sent`, `thread.discord_message_updated`,\n`thread.ms_teams_message_sent`, `thread.ms_teams_message_received`, `thread.chat_sent`,\n`thread.chat_received`, `thread.note_created`, `thread.note_mention_created`,\n`discussion.discussion_created`, `discussion.message_created`, `thread.thread_labels_changed`,\n`thread.thread_priority_changed`, `thread.thread_field_created`, `thread.thread_field_updated`,\n`thread.thread_field_deleted`, `thread.service_level_agreement_status_transitioned`,\n`thread.thread_tenant_updated`, `thread.thread_locked`, `customer.customer_created`,\n`customer.customer_updated`, `customer.customer_deleted`, `customer.customer_changed`,\n`customer.customer_group_changed`, `customer.customer_group_memberships_changed`,\n`timeline.timeline_entry_changed`. Scopes: `webhookTarget:create/edit/read/delete`.\n\n## 14. Team members and roles ⚠️ invites are UI-only\n\n```graphql\n# ❌ FAILS with a machine-user key:\n# inviteUserToWorkspace(input: { email: \"...\", roleKey: SUPPORT })\n# → ForbiddenError: Machine user not allowed to perform this operation\n```\n**Inviting teammates cannot be automated with a setup API key** — it requires a human actor context.\nPut invites in the handoff report as a UI task (Settings → Members), don't try to script them.\n\n`assignRolesToUser` *does* work with a machine key for users who already exist:\n```graphql\nmutation { assignRolesToUser(input: { userId: \"u_...\", roleKey: SUPPORT }) { error { message code } } }\n```\n`RoleKey`: `OWNER | ADMIN | SUPPORT | VIEWER | NONE`, or `customRoleId`. Scopes: `roles:read/assign/create/edit`.\n\n## 15. Tenants and field values ✅ verified\n\n```graphql\nmutation { upsertTenant(input: {\n identifier: { externalId: \"acme-inc\" }\n name: \"Acme Inc\", externalId: \"acme-inc\"\n # primaryDomain / alternateDomains / isDomainAutoJoinEnabled are beta — may not be enabled\n}) { tenant { id name } error { message code fields { field message } } } }\n\nmutation { upsertTenantField(input: {\n tenantFieldIdentifier: {\n tenantIdentifier: { externalId: \"acme-inc\" } # or tenantId\n externalFieldId: \"arr\"\n }\n type: NUMBER_TYPE\n numberValue: 48000 # set exactly the one value field matching `type`\n}) { tenantField { id } error { message code fields { field message } } } }\n```\nScopes: `tenant:create/read/delete`, `tenantField:create/update/read/delete`. Tier a tenant with\n`updateTenantTier`.\n\n---\n\n## Permission scopes — corrected against a live key\n\nAn Admin-preset key reported **390 scopes**. Corrections to earlier guesses:\n\n| Area | Real scopes |\n|---|---|\n| Tiers | `tier:create`, `tier:read`, `tier:edit`, `tier:delete`, `tierMembership:create/delete/read` |\n| SLAs | `serviceLevelAgreement:create/edit/delete` |\n| Business hours | `businessHours:edit`, `businessHours:read` |\n| Labels | `labelType:create/edit/read`, `label:create`, `suggestedLabelType:read` |\n| Tenant fields | `tenantFieldSchema:create/update/read/delete`, `tenantField:create/update/read/delete` |\n| Tenants | `tenant:create/read/delete` |\n| Thread fields | `threadFieldSchema:create/edit/read/delete`, `threadField:create/update/read/delete` |\n| Escalation paths | `escalationPath:create/edit/read/delete/execute` |\n| Workflows | **no `workflow:*` scope exists** — only `workflowRule:create/edit/read/trigger` |\n| Saved views | `savedThreadsView:create/edit/read/delete` |\n| Help centre | `helpCenter:*` **plus separate** `helpCenterArticle:*`, `helpCenterArticleGroup:*` |\n| Knowledge sources | `knowledgeSource:create/read/delete`, `knowledgeGap:*`, `knowledgeGapSignal:*` |\n| Sidekick | `sidekickSettings:read/update`, `sidekickCustomSkill:create/edit/read/delete`, `sidekickMcpServer:read/update` (no `:create`), per-integration `sidekickIntegration:read/update` |\n| Webhooks | `webhookTarget:create/edit/read/delete` |\n| Roles | `roles:read/assign/create/edit` |\n| Sanity check | `permission:read` → call `myPermissions` first to see exactly what you hold |\n\nEasiest path for a one-time setup key remains the **Admin preset**. Delete the machine user\n(`deleteMachineUser`) or narrow the key afterwards.\n\n## Confirmed UI-only (cannot be done with a setup key)\n\n- **Inviting teammates** — `inviteUserToWorkspace` rejects machine users outright. Settings → Members.\n- **Personal notification preferences** — no mutation exists (`updateInternalNotifications` only marks\n notifications read/archived). Avatar → Preferences, per user.\n- **OAuth completion for channels and OAuth MCP servers** — Slack / MS Teams / Discord / email\n forwarding have `create*Integration` mutations that provision the shell, but consent and DNS\n verification need a human browser session. Support is **not live until a channel is connected.**\n- **Chat widget snippet placement** — happens on the customer's own site.\n",[],[180],"926f34a3-7197-4916-a750-6b39ed4b5331","index.tsx",36,["D",1788364280307],3,"http","import { Hono } from \"npm:hono@4\";\nimport { parseVal, readFile } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const html = await readFile(\"/public/index.html\", import.meta.url);\n return c.html(html);\n});\n\napp.get(\"/skill.md\", async (c) => {\n const md = await readFile(\"/skill.md\", import.meta.url);\n return c.text(md, 200, {\n \"content-type\": \"text/markdown; charset=utf-8\",\n \"content-disposition\": 'inline; filename=\"skill.md\"',\n });\n});\n\napp.get(\"/reference.md\", async (c) => {\n const md = await readFile(\"/reference.md\", import.meta.url);\n return c.text(md, 200, {\n \"content-type\": \"text/markdown; charset=utf-8\",\n \"content-disposition\": 'inline; filename=\"reference.md\"',\n });\n});\n\napp.get(\"/configure.md\", async (c) => {\n const md = await readFile(\"/configure.md\", import.meta.url);\n return c.text(md, 200, {\n \"content-type\": \"text/markdown; charset=utf-8\",\n \"content-disposition\": 'inline; filename=\"configure.md\"',\n });\n});\n\n// View source on Val Town\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// Unwrap and rethrow Hono errors as the original error\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n",[],[189],["D",1788364268625],[],[18],"67a4f1c1-3637-4404-9e16-6d13683b3dae","README.md","01a061e4-3acb-7070-a926-8c4f90b26c5e",["D",1788348742264],"# hono-jsx-starter\n\nA minimal [Hono](https://hono.dev) + Hono JSX starter for Val Town.\nServer-rendered HTML, no build step, no React.\n\n## Picking a starter\n\n| Starter | When to pick it |\n| --- | --- |\n| [`basic-html-starter`](https://www.val.town/x/templates/basic-html-starter) | Static HTML pages. Sprinkle of vanilla JS. No server-side rendering. |\n| **[`hono-jsx-starter`](https://www.val.town/x/templates/hono-jsx-starter)** *(you're here)* | Dynamic server-rendered HTML with JSX. API routes. No React, no SPA. |\n| [`react-hono-starter`](https://www.val.town/x/templates/react-hono-starter) | Client-side React SPA with a Hono API backend. |\n\n## What's here\n\n```\nindex.tsx Hono app, Layout, routes\npublic/\n favicon.svg Static asset\n counter.ts Tiny client-side script\n```\n\nThe whole app fits in one file. As you grow it, the natural next moves are:\n\n- Pull `Layout` into its own `.tsx` file once you have 3+ pages.\n- Split routes with `app.route(\"/api\", api)` if `/api/*` grows.\n- Add more files under `public/` — they're served by a single\n `app.get(\"/public/*\", ...)` route.\n\n## Patterns worth knowing\n\n**JSX pragma.** Every `.tsx` file that uses JSX needs this at the top:\n\n```tsx\n/** @jsxImportSource npm:hono@4/jsx */\n```\n\n**Server state.** The counter on `/` is `let count = 0` at module scope. It\nlives in memory on the Val Town server and survives across requests — but resets\nwhenever the val restarts (deploys, idle timeouts, etc.). For persistent state,\nswap it for [`std/sqlite`](https://www.val.town/x/std/sqlite) or\n[`std/blob`](https://www.val.town/x/std/blob).\n\n**API routes.** The `Increment` button POSTs to `/api/increment`, which returns\nJSON. Mix server-rendered pages and JSON endpoints in the same Hono app:\n\n```ts\napp.post(\"/api/increment\", (c) => c.json({ count: ++count }));\n```\n\n**Static files.** `serveFile` reads the file by path and serves it with the\nright content-type. `.ts` files are transpiled to JS on request by Val Town — so\nyou can write `public/counter.ts` and reference it as\n`\n\n\n\n",[],[76,208],"dfa17abd-085c-45c1-81d7-cd10c11b9b60","favicon.svg","01a061e4-3acb-7070-a926-842f4e54d674",["D",1788348742264],"\n",[],[76,218],"70c7bc19-dc6c-4ab8-b78f-c08042ad49f0","counter.ts","01a061e4-3acb-7070-a926-8362bdc08d67",["D",1788348742264],"script","const count = document.getElementById(\"count\")!;\nconst button = document.getElementById(\"increment\")!;\n\nbutton.addEventListener(\"click\", async () => {\n const res = await fetch(\"/api/increment\", { method: \"POST\" });\n const data = await res.json();\n count.textContent = String(data.count);\n});\n",[],[76,225],"3a3e2c48-1639-4f15-8dbd-d059b930e785",["D",1788348742264],"directory",[162,163,164],[76],["D",1788348742264],{"_11":12,"_120":69},{"_11":12,"_116":-5,"_68":69,"_30":67,"_117":118,"_119":24},{"_38":107,"_13":16,"_32":35,"_108":71,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":-5,"_114":14,"_115":12},"ctx",{"_53":-5,"_139":274,"_275":276,"_277":278,"_279":24,"_280":24,"_281":24,"_282":84,"_283":-5,"_284":-7,"_285":-7,"_286":26,"_287":24,"_288":24,"_289":-5,"_290":24,"_291":24,"_292":24,"_293":-5},"ENV",{"_245":246,"_247":248,"_249":16,"_250":251,"_252":253,"_254":255,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · configure.md