\n\n_Video: publishing Notion charts of Salesforce data from Slack_\n\n---\n\nBy the way, I know _Notionizer_ is an awful name. I needed a working title.\n\nI needed a working title because I can't share the real thing, which is running\nmy client's Salesforce data inside their Notion and Val Town accounts.\n\nAs for the demo, it works with Salesforce's developer sandbox data and runs out\nof _my_ Notion and Val Town accounts.\n\n---\n\n`Features`\n\nIt's satisfying to be able to bring rich, accurate detail about a business into\nthe context of a conversation. For many of us, Slack is where most of those\nconversations happen, or could happen. And as for Notion, to me, Notion is _the\nbest good enough workspace_ and it's perfect for artifacts like these reports.\n\n![slack-notion-line-chart.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/b49ce85f-e306-4b4c-d695-324332c7a900/public)\n\n_Screenshot: Slack and Notion, side by side_\n\nSome other features that may not be obvious but are worth a beat:\n\n- **Ready access**: Anyone in the company who can use Slack and who has access\n to Notion can publish and view Salesforce data.\n- **Speed**: Val Town syncs Salesforce data to Notion in the background, so\n publishing charts and tables is fast.\n- **No artifact sprawl**: Reports are saved as pages of a Notion database, not\n strewn around the workspace or marooned in another tool.\n- **Reusability**: Reports are generated from simple Markdown templates, with\n user- and agent-friendly prompts that render in Notion as charts and tables.\n- **Presentability**: Notion's `Present` mode (beta) isn't exactly a PPT or\n Slides killer but it is good enough to run a standup from and it is\n immediate—you can go from Slack to a Notion report to a data-driven\n presentation without any pixel pushing or\n [copypasta](https://www.dictionary.com/culture/slang/copypasta).\n\n![markdown-prompt-line-chart.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/83153119-c7f0-40bc-d49e-9a95988a4d00/public)\n\n_Screenshot: a Notion line chart with a reference line set from Slack_\n\n---\n\n`Goals`\n\n## More transparency, more efficiently achieved\n\nTime and cost savings are measurable but other goals—no less worthy!—drive this\nwork, too.\n\n### A clear picture of pipeline\n\nNotion charts do a good job of telling the highest-value story. They are not a\nreplacement for tools like Looker or Jupyter data science notebooks but if what\nyou need are clear pictures of data that is otherwise out of reach in tools like\nthose, they're great.\n\n![CleanShot 2026-09-12 at 7.39.38 AM.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/d437a2ac-f6ee-45eb-2efa-cb6d15dab000/public)\n\n_Screenshot: a Notion donut chart and table view of open deals_\n\n### Fewer subscriptions / seats\n\nThe time was right —\n[Salesforce had recently gone headless](https://www.linkedin.com/posts/boxaaron_the-big-news-this-week-in-software-was-salesforces-share-7451336945659535362-QNZw/),\nwhich made room for a new way of thinking about subscription expenses and\naccess. With the Salesforce data out of Salesforce and synced to Notion, fewer\npeople need seats for Salesforce, and everyone (and everything) can access the\ndata where they work.\n\n### Faster, all the time\n\nTo click a button in Slack and publish a report filled with live charts and\ntables in Notion is fun. But more imoportantly, it's how my client saves ~3\nhours every Sunday night preparing for a Monday morning meeting with his team.\nHe used to dig through Salesforce and cut and paste data into Trello\nthat would go stale immediately, and then have to do it again the following\nweek.\n\n### Tighter feedback loops\n\nWith the pipeline data at everyone's finger tips, Slack conversations can be\ndata informed, without delay. We don't need a meeting. There's no need to carve\nout time to prep the data. We have it, right here:\n\n![CleanShot 2026-09-12 at 8.07.00 AM.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/20b0514d-30be-4b8a-df69-8bfb77e4a800/public)\n\n_Screenshot: the /notionizer slash command and prompt that publishes pipeline\nreports in Notion_\n\n---\n\n`Technology`\n\n### Claude Max and friends\n\nThere's a lot more that I can and probably should say about each of these bits;\nespecially Val Town, which is a non-negotiable for me the last few years.\n\n- A [Slack slash app](https://docs.slack.dev/app-manifests/)\n- [Notion](https://www.notion.com/),\n [Notion's API](https://developers.notion.com/guides/get-started/overview), and\n [Notion's Javascript SDK](https://github.com/makenotion/notion-sdk-js), out of\n the box\n- The [Salesforce API](https://developer.salesforce.com/free-trials), for\n Opportunities and Accounts data\n- [Val Town](https://www.val.town/) syncs Salesforce data to Notion, hosts and\n secures the API, stores Markdown, and writes everything to Notion\n- [Val Town's MCP plugin](https://docs.val.town/guides/prompting/plugin) pushes\n code live ~instantly (no local code!)\n- [Anthropic's API](https://platform.claude.com/) publishes Markdown prompts as\n charts and tables in Notion (running Haiku — cheap!)\n- I wrote ~all the code with\n [Claude Code (Max)](https://support.claude.com/en/articles/11049741-what-is-the-max-plan)\n\n",[],[158,260],"74c4de13-ab75-461b-897b-e41df00cc37d","leadfeeder.md","199464b2-aebc-11f1-a8b0-1607ee4eb77e",["D",1789409322137],14,"---\ntitle: Mission work - Lightweight Industries\ndescription: Consolidating 3 missions into one.\n---\n\n# Leadfeeder\n\nConsolidating three missions into one.\n\n---\n\nAs for the demo, it works with Salesforce's developer sandbox data and runs out\nof _my_ Notion and Val Town accounts.\n\n---\n\n`Background`\n\n## favicon\n\n![lightweight-logo-linkedin-400.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/b9a80cb1-d37a-432e-0f1a-c89b682f3900/public)\n![favicon-bold.png](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/d373850d-064e-412b-4a6d-359991690c00/public)\n\n## lockup\n\n## svg as code\n\n\n\n\n\n\n## .svg\n\n![lightweight-logo.svg](https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/c3126909-6982-47d1-67e7-85817b382700/public)",[],[158,269],"243e76a8-a1de-43ed-8e2e-09b95e9f0fe7","home.md","495ba220-ac3f-11f1-8027-1607ee4eb77e",311,["D",1789388309435],49,"---\ntitle: Lightweight Industries\ndescription: Messaging and tools for CEOs choosing what travels.\n---\n\n# Messaging and tools that travel.\n\n---\n\n`Recently`\n\n## [“No more pipeline gatekeeping” — Notion charts of Salesforce data, right from Slack](/notionizer)\n\n\n\n---\n\n`About`\n\n## Lightweight is a messaging and tools business.\n\nRun by Brad Noble, Lightweight is for CEOs and founders choosing carefully the\nwords and tools to carry on the journey ahead.\n\n

\n “Brad was masterful in helping us get at the heart of our distinction and shaping that into our core messaging. I wish we had that core message and his leadership long before we did.”\n
\n - Ed Boyajian, EDB CEO\n
\n

\n “Brad has a rare ability to cut through complexity and help teams align around simple, powerful decisions.”\n
\n - Kevin McIntyre, Leadfeeder CEO\n
\n

\n “Brad single-handedly translated our tech solution into a business problem solution for line of business owners. Pivotal moment.”\n
\n - Mike Miller, Cloudant co-founder, partner at Liquid 2 Ventures\n
\n

\n\n---\n\n`Availability`\n\n## 2 days/week are open through November\n\nGrab time on Brad's calendar to talk about going lightweight.\n\n{{gate:calendar}}",[],[158,277],"da0c33bf-dd01-47e0-82f6-ecd15732bd8f","calendar.md","495b98ac-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-b4ca08beac5b",["D",1789038102875],"---\nbutton: Submit\nfallback: Don't use Google for email? Use your email address instead\n---\n\n\n\n

\n\n

\n\nIf my calendar isn't embedded in the page,\n[visit it directly](https://calendar.google.com/calendar/appointments/schedules/AcZssZ18hnwEHvVR_DDPrq_2FsDuoFKGdNOGze_NizHosyg1yKpBqNOE6YEuIO1tGg0_jq6DStuTf5Mj).",[],[158,293,286],"gates","4fc79300-b39f-4abb-9c6f-c904a2d63c58",["D",1788952323787],[202],[158,293],"d8374e7b-e471-44f7-ae1e-f02d63902f84",["D",1788952323787],[201,203,204,205,206],[158],"95be9f8d-27d2-4f82-9750-6ea57a23364d","preview-parking.http.ts","65a38254-ac3f-11f1-8290-1607ee4eb77e","01a085de-26c9-705c-866d-984268dc880b",3,["D",1788952371320],"http","// Holds the {valname}-preview subdomain while no branch is being previewed.\n// Pointed here by the merge-branch skill when a preview branch is merged & deleted;\n// start-branch moves the subdomain back onto a live branch's HTTP entry.\nexport default () =>\n new Response(\n [\n \"No branch is currently in preview.\",\n \"\",\n \"This URL follows the branch under active development. It's idle because the\",\n \"last preview branch was merged and deleted. Start a new branch (the start-branch\",\n \"rail) to point this URL at it again.\",\n ].join(\"\\n\"),\n { status: 200, headers: { \"content-type\": \"text/plain; charset=utf-8\" } },\n );\n","lightweightindustries-preview",[],[162,303],"45498dfe-f270-4748-98bf-2dd0f692d11b","index.http.ts",["D",1788953809222],"import { Hono } from \"npm:hono@4.11.9\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport pages from \"./routes/pages.ts\";\nimport api from \"./routes/api.ts\";\nimport auth from \"./routes/auth.ts\";\nimport mcp from \"./routes/mcp.ts\";\n\nconst app = new Hono();\n\n// All registered BEFORE the page routes: `pages` owns \"/:slug\", which would\n// otherwise swallow these paths and 404 them as missing content files.\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.route(\"/api\", api);\napp.route(\"/auth\", auth);\napp.route(\"/mcp\", mcp);\n\napp.route(\"/\", pages);\n\n// Let uncaught exceptions reach the Val Town log instead of being swallowed.\napp.onError((err) => Promise.reject(err));\n\n// Hono exports `app.fetch`, never `app`.\nexport default app.fetch;\n",[],[162,314],"4d7ef298-fca6-4305-bd87-6526041ad7b4","slug.ts","beddc05c-ac42-11f1-aac6-1607ee4eb77e","01a085de-26c9-705c-866d-ae7e6a176e09",["D",1788953809222],"/**\n * Content slugs. Backend-only pure helper: no I/O, no business decisions.\n *\n * Extracted out of `page.controller.ts` on its SECOND consumer (the MCP tools),\n * per the house rule — not in anticipation of one.\n */\n\n/**\n * Reduce anything to a flat, safe content slug.\n *\n * This is also what closes path traversal: the result can only ever name a\n * file sitting directly inside a content directory, never a path that climbs\n * out of one. Every caller that builds a content path from caller-supplied\n * text must go through here first.\n */\nexport function toSafeSlug(slug: string): string {\n return slug.trim().toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n}\n",[],[162,327,320],"utils","75266379-5f2e-4856-afc8-ad7688172a7a","markdown.ts","495b9276-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { marked } from \"npm:marked@18.0.12\";\n\n/**\n * Markdown → HTML. Backend-only pure helper: no I/O, no business decisions.\n *\n * `npm:` is correct here because this only ever runs in Deno. If this render\n * ever has to happen in the browser too, it moves to `shared/` and the\n * specifier becomes `https://esm.sh/marked@18.0.12`.\n */\nexport function renderMarkdown(markdown: string): string {\n return marked.parse(markdown, { async: false }) as string;\n}\n",[],[162,327,329],"e81d2b8b-4db7-41af-94b8-67997bef2cb1","layout.ts","495b848e-ac3f-11f1-8027-1607ee4eb77e",["D",1789409322137],"import { escapeHtml } from \"./html.ts\";\n\n/**\n * The HTML shell. Server-rendered so title/description are in the source a\n * crawler reads — the reason the public site is not a React SPA.\n */\n\nconst PICO_CSS =\n \"https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css\";\n\n/**\n * The logo, inline so CSS can colour and animate it (an can't be).\n * Two SVGs, each its own CSS target; their viewBoxes are windows onto the\n * original 780x93 export (mark = left 105 units, wordmark = the rest), so\n * butted together at one height they keep the designer's spacing. Path data\n * is the export rounded to 2 decimals, cubics intact; the mark's three bars\n * are merged into one path (they overlap, so nonzero fill is their union).\n *\n * ⚠️ No backticks or dollar-brace in these strings — they're interpolated\n * into the template literal below.\n */\nconst MARK_PATH = \"M66 70h10V40H66ZM0 40h10V10H0ZM0 45h105V35H0Z\";\n\nconst MARK_SVG =\n ``;\n\n/**\n * Favicon: the mark redrawn with bars twice as thick — at 16px the header\n * weight fades to hairlines — as an inline data URI (no request, crisp at any\n * size). The viewBox pads it to a square. Safari can't use an SVG favicon, so\n * the PNG is the fallback there and the iOS home-screen icon.\n */\nconst FAVICON_SVG =\n `data:image/svg+xml,%3Csvg xmlns='http://www.w3.org/2000/svg' viewBox='-15 -27.5 135 135'%3E%3Cpath fill='%23027aff' d='M0 30h105v20H0ZM0 5h20v45H0ZM61 30h20v45H61Z'/%3E%3C/svg%3E`;\n\nconst FAVICON_PNG =\n \"https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/d373850d-064e-412b-4a6d-359991690c00/public\";\n\nconst WORDMARK_SVG =\n ``;\n\nexport interface LayoutInput {\n title: string;\n description: string;\n /** Trusted, already-rendered HTML. Injected unescaped. */\n html: string;\n /** External scripts this page asked for. Usually empty. */\n scripts?: string[];\n}\n\nexport function renderLayout(\n { title, description, html, scripts = [] }: LayoutInput,\n): string {\n // After the markup so Google's script finds its targets in the DOM.\n const tags = scripts\n .map((src) => ` `)\n .join(\"\\n\");\n\n return `\n\n \n \n \n ${escapeHtml(title)}\n \n \n \n \n \n \n \n \n \n \n \n \n \n

\n ${MARK_SVG}${WORDMARK_SVG}\n

\n${html}\n

\n \n${tags}\n \n\n`;\n}\n",[],[162,327,336],"932bb45b-8c24-4c59-9ca8-ac4df0ede94d","html.ts","495b7ef8-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"/** Escape a string for interpolation into HTML. Backend-only pure helper. */\nexport function escapeHtml(value: string): string {\n return value\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n",[],[162,327,343],"c69a2a62-5647-4a8c-8829-4b270b345e01","gate.ts","495b591e-ac3f-11f1-8027-1607ee4eb77e",39,["D",1789042213864],"import { escapeHtml } from \"./html.ts\";\n\n/**\n * Gates: trade an identity for something.\n *\n * A gate is a CONTENT file (`content/gates/.md`) plus a `{{gate:}}`\n * token in a page. Adding another gate is a file and a token — never code.\n */\n\n/** Google Identity Services — the script that draws the button and the popup. */\nexport const GSI_SCRIPT = \"https://accounts.google.com/gsi/client\";\n\n/** Records that a visitor has already paid the toll. */\nexport const UNLOCK_COOKIE = \"lw_unlocked\";\n\n/**\n * ⚠️ This cookie is NOT a security boundary and is deliberately unsigned.\n * Forging it reveals a calendar link that is handed to anyone who signs in,\n * so signing it would buy nothing. If a gate ever fronts something of real\n * value, this decision has to be revisited — sign it then.\n */\n\n/**\n * ⚠️ THE TYPED-EMAIL FALLBACK IS TEMPORARILY OFF.\n *\n * It is the one door that verifies nothing, which makes it the way around\n * Google sign-in. Nothing has been deleted: the disclosure, the form, the\n * controller path and the Notion write are all still here and still wired.\n * This flag is the switch that shows them again.\n *\n * Flip it to true once the remediations land — at minimum a honeypot and a\n * rate limit on /api/unlock, and ideally the flow where a typed submission\n * becomes a REQUEST (thank-you, manual vetting) rather than an unlock.\n *\n * Read in TWO places on purpose, so the form and the endpoint cannot drift\n * apart: renderGatePrompt omits the whole disclosure, and unlockGate refuses.\n * Hiding only the form would leave /api/unlock accepting posts from anything\n * that knows the URL — and that URL is in the page source of every visit made\n * before today, so it is not a secret.\n */\nexport const EMAIL_FALLBACK_ENABLED = false;\n\n/**\n * A gate token — with or without the paragraph `marked` may have wrapped it in.\n *\n * ⚠️ BOTH have to work, because the difference is invisible to whoever is\n * writing the page. `marked` treats a run of lines starting with a raw HTML\n * tag as ONE html block that ends at the first blank line, so this:\n *\n *

\n *\n * {{gate:calendar}}\n *\n *

\n *\n * renders the token as its own paragraph, while this:\n *\n *

\n * {{gate:calendar}}\n *

\n *\n * emits it as bare text inside the html block. Requiring the paragraph made\n * the second form fail silently — the literal token was printed on the page.\n * Matching the wrapper OPTIONALLY means an author never has to know that rule.\n * When the paragraph is present it is consumed along with the token, so no\n * empty paragraph is left behind.\n */\nconst GATE_TOKEN = /(?:

\\s*)?\\{\\{gate:([a-z0-9-]+)\\}\\}(?:\\s*<\\/p>)?/g;\n\nexport function findGateNames(html: string): string[] {\n return [...html.matchAll(GATE_TOKEN)].map((match) => match[1]);\n}\n\nexport function replaceGate(\n html: string,\n name: string,\n replacement: string,\n): string {\n // The replacement is passed as a FUNCTION, not a string, so a dollar sign in\n // the reward content (say, a price) is never read as a replacement pattern.\n //\n // `name` is safe to interpolate into the pattern: it only ever arrives from\n // `findGateNames`, which matched it against [a-z0-9-]+, so it can carry no\n // regex metacharacters.\n return html.replace(\n new RegExp(\n `(?:

\\\\s*)?\\\\{\\\\{gate:${name}\\\\}\\\\}(?:\\\\s*

)?`,\n \"g\",\n ),\n () => replacement,\n );\n}\n\n/**\n * The DOM id a gate renders under.\n *\n * Ours, not `marked`'s: heading ids would depend on the renderer's slugging of\n * whatever the heading happens to say, and would break the moment the copy\n * changes. This is keyed to the gate name instead.\n *\n * The name is used BARE — `#calendar`, not `#gate-calendar` — because the\n * anchor is a public URL someone might type or share, and the prefix was\n * machinery leaking into it. Nothing else on these pages emits ids (marked is\n * not configured to slug headings), so there is nothing to collide with. If\n * that ever changes, this function is the single place to re-prefix.\n *\n * Every caller goes through here — the page wrapper, the unlock redirect, and\n * the Google callback redirect — so the shape of the anchor is decided once.\n */\nexport function gateAnchorId(name: string): string {\n return name;\n}\n\n/**\n * Wraps a gate so an unlock can land the visitor back on it.\n *\n * An `article`, not a plain div: a gate is a bounded, self-contained thing —\n * a prompt in one state, an embedded calendar in the other — and Pico styles\n * `article` as a card, which is exactly that reading.\n *\n * Doing it HERE rather than around the token in markdown also removes a trap.\n * Raw HTML written around the token in a content file can swallow it into one\n * html block, and then the token never becomes a paragraph (see GATE_TOKEN\n * above). Owning the wrapper in code means an author writes only the token.\n */\nexport function wrapGate(name: string, html: string): string {\n const id = escapeHtml(gateAnchorId(name));\n // TWO hooks, doing two different jobs:\n // id — unique, per gate, so an unlock redirect can land on this one.\n // class — shared by every gate, so one CSS rule styles all of them.\n // Styling the id instead would mean the next gate inherits nothing.\n return `

\\n${html}\\n

`;\n}\n\nexport type GateError = \"email\" | \"google\" | null;\n\n/**\n * ⚠️ EVERY visitor-facing word in a locked gate arrives here from the gate's\n * own content file. None of it is written into this module.\n *\n * That is the same rule the token follows — adding a gate is a file, never\n * code — and it has to hold for the copy too, or the second gate inherits\n * calendar-flavoured wording it cannot change without a code edit.\n */\nexport interface GatePromptInput {\n name: string;\n /**\n * Optional lead-in above the button. Usually absent: the page around the\n * token is a better place for prose, because it can be edited, moved and\n * read in context. A gate that sets none renders only its controls.\n */\n prompt?: string;\n button: string;\n /** Summary on the disclosure hiding the email form. */\n fallback: string;\n /**\n * Optional line under the form. Omitted ENTIRELY when the gate file doesn't\n * set one — the absence is the point, so a gate says only what it needs to.\n */\n assurance?: string;\n /** Null when GOOGLE_CLIENT_ID isn't set. */\n googleClientId: string | null;\n /** Absolute. Must EXACTLY match an authorized redirect URI on the client. */\n loginUri: string;\n /** Only ONE #g_id_onload may exist per page — the first gate emits it. */\n includeOnload: boolean;\n error?: GateError;\n}\n\nexport function renderGatePrompt(\n {\n name,\n prompt,\n button,\n fallback,\n assurance,\n googleClientId,\n loginUri,\n includeOnload,\n error,\n }: GatePromptInput,\n): string {\n const gate = escapeHtml(name);\n const fieldId = `gate-${name}-email`;\n\n const notice = error === \"google\"\n ? `

Google sign-in didn't finish. Try again, or use your email below.

\\n`\n : error === \"email\"\n ? `

That doesn't look like an email address — try again?

\\n`\n : \"\";\n\n // The ARTICLE is what the disclosure reveals — the form arrives as a card\n // rather than as loose fields under a summary.\n //\n // fieldset role=\"group\" is Pico's own grouped-input markup: it strips the\n // inner border radii so field and button read as one control. Its rules\n // select DIRECT children, so ONLY those two may live inside it — the hidden\n // gate field sits outside, or it would take the first-child slot and the\n // rounding would land on the wrong element.\n //\n // The label sits ABOVE the fieldset, not in it — inside, it would be a\n // direct child of the group and take the first-child slot, flattening the\n // corners of the wrong element. And a real label means no aria-label: with\n // both present the aria-label wins and the visible text is what gets\n // ignored, which is backwards.\n const form = `

\n \n

`;\n\n // Google is the DEFAULT: one click, an account picked in Google's own popup,\n // and an address that comes back verified. Typing is the fallback.\n //\n // `data-auto_prompt=\"false\"` suppresses One Tap — a button was asked for, not\n // an uninvited flyover on page load. `data-state` carries which gate was\n // clicked; Google echoes it back in the POST.\n //\n // `data-text=\"continue_with\"` renders \"Continue with Google\" rather than\n // \"Sign in with Google\": this is a marketing page, and \"sign in\" implies an\n // account they don't have and never wanted.\n const onload = includeOnload\n ? `

\n`\n : \"\";\n\n const google = googleClientId\n ? `${onload}

`\n // Visible on purpose rather than hidden: a missing button reads as a bug,\n // and this says what to fix. It disappears once the client id is set.\n : `

\n Set GOOGLE_CLIENT_ID to enable this.

`;\n\n // Rendered only when the gate file asks for it, so silence is the default.\n const note = assurance ? `\\n${escapeHtml(assurance)}` : \"\";\n\n // Both the lead-in and the assurance are opt-in, so a gate that sets neither\n // renders exactly its controls: the button, and the form behind a summary.\n const lead = prompt ? `

${escapeHtml(prompt)}

\\n` : \"\";\n\n // The WHOLE disclosure goes when the fallback is off, not just the form\n // inside it: there should be nothing to notice, let alone open.\n const disclosure = EMAIL_FALLBACK_ENABLED\n ? `\n

${escapeHtml(fallback)}

\n${form}\n

`\n : \"\";\n\n return `${lead}${notice}${google}${disclosure}${note}`;\n}\n\n/**\n * Shown ABOVE an unlocked reward. The escape hatch out of a year-long,\n * httpOnly cookie — without it the gate becomes invisible forever to anyone\n * who has opened it once.\n *\n * A paragraph rather than `small`: it sits as a block-level child of the gate,\n * so it needs an element that carries its own spacing, and shrinking the one\n * control that undoes a year-long cookie was the wrong emphasis anyway.\n */\nexport function renderUnlockedNote(email: string): string {\n // \"Continuing as\", not \"Signed in as\" — this is a marketing page, and\n // sign-in language implies an account nobody here has or wants.\n return `

Continuing as ${\n escapeHtml(email)\n } · (Not you?)

`;\n}",[],[162,327,350],"811c4125-d8ec-4bd5-9b8b-6dd7b6c76cf4","frontmatter.ts","495b4b86-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"/**\n * Split a leading `---` frontmatter block off a markdown document.\n *\n * Backend-only pure helper: no I/O, no business decisions.\n *\n * ⚠️ The trap this exists to avoid: our content uses `---` as a horizontal\n * rule BETWEEN sections, so a parser that splits the document on every `---`\n * eats half the page. Only a fence on line 1 opens frontmatter, and only the\n * FIRST fence after it closes the block. Everything past that is body,\n * horizontal rules included.\n */\n\nexport interface ParsedDocument {\n data: Record;\n body: string;\n}\n\nconst FENCE = \"---\";\n\nexport function parseFrontmatter(raw: string): ParsedDocument {\n const lines = raw.split(/\\r?\\n/);\n\n // No opening fence on line 1 → the whole document is body.\n if (lines[0]?.trim() !== FENCE) return { data: {}, body: raw };\n\n let closingLine = -1;\n for (let i = 1; i < lines.length; i++) {\n if (lines[i].trim() === FENCE) {\n closingLine = i;\n break;\n }\n }\n\n // Unterminated block → treat the document as body rather than swallowing it.\n if (closingLine === -1) return { data: {}, body: raw };\n\n const data: Record = {};\n for (const line of lines.slice(1, closingLine)) {\n if (!line.trim() || line.trimStart().startsWith(\"#\")) continue;\n\n const separator = line.indexOf(\":\");\n if (separator === -1) continue;\n\n const key = line.slice(0, separator).trim();\n if (!key) continue;\n\n let value = line.slice(separator + 1).trim();\n const quoted = (value.startsWith('\"') && value.endsWith('\"')) ||\n (value.startsWith(\"'\") && value.endsWith(\"'\"));\n if (quoted && value.length >= 2) value = value.slice(1, -1);\n\n data[key] = value;\n }\n\n return { data, body: lines.slice(closingLine + 1).join(\"\\n\") };\n}\n",[],[162,327,358],"032dd2d7-a6c0-43c7-9cb8-178a12880f6b",["D",1788952323787],[192,193,194,195,196,197],[162,327],"060d1a09-6240-4071-b6f9-58a9661b4466","registration.types.ts","61ee55d0-ac58-11f1-9896-1607ee4eb77e","01a085de-26c9-705c-866d-a96c4be70635",["D",1788963102513],"/**\n * A captured registration, shaped for the Notion row it becomes.\n *\n * Shared by the gate controller (which builds it) and the Notion service\n * (which writes it), so it lives here rather than in either one.\n *\n * ⚠️ \"Registration\", NOT \"lead\". A row is written every time someone\n * identifies themselves at a gate, so this is an EVENT — while \"lead\" is a\n * person-noun, and that mismatch is what made repeat sign-ins look like a bug\n * in the write path. A person-noun belongs to the DERIVED table that dedupes\n * these, not to this one.\n *\n * \"Registration\" is also the only nearby word that doesn't claim the address\n * was verified: registering is by definition putting your own name down.\n * \"Login\" and \"sign-in\" would be true of the Google path and false of the\n * typed one. `source` is what records the difference.\n */\nexport interface RegistrationCapture {\n /**\n * The Notion title. Google's display name when we have it, otherwise the\n * address — the typed path has no name, and a row reading \"Untitled\" is\n * worse than a row titled by email.\n */\n name: string;\n givenName: string | null;\n familyName: string | null;\n email: string;\n /**\n * Google Workspace host domain (the `hd` claim) — `acme.com`.\n *\n * Deliberately NOT called \"company\": it is a domain, not a company name.\n * Null for personal Google accounts and for every typed submission.\n */\n domain: string | null;\n gate: string;\n /**\n * How the address arrived. `google` means Google returned it; `typed` means\n * a human typed it and it could be anything.\n */\n source: \"google\" | \"typed\";\n}\n",[],[162,239,369],"ac7be3d3-6e73-43fc-ae2a-48bcec3159fc",["D",1788952323787],[190],[162,239],"e72d6542-e47d-49e2-b077-08d5f1281dfe","notion.service.ts","495b2bc4-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-a7fe58e12594",["D",1788963102513],"import { Client } from \"npm:@notionhq/client@5.26.0\";\nimport type { RegistrationCapture } from \"../types/registration.types.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Records a registration in Notion. One external API, no business decisions,\n * never throws.\n *\n * The database is an append-only EVENT log — one row per time someone\n * identified themselves at a gate. It is deliberately never read or updated\n * here: deduping into people is a separate, derived concern, and keeping this\n * write-only is what stops an unverified typed submission from ever mutating\n * a row that Google verified.\n */\n\n/**\n * ⚠️ SDK v5 splits `database_id` from `data_source_id`, and `pages.create`\n * needs the DATA SOURCE. The id copied out of a Notion URL is the database, so\n * we resolve it here and the operator never has to know the difference.\n * It lives at `data_sources[0].id` — not `.data_source_id`.\n */\nlet cachedDataSourceId: string | null = null;\n\nasync function resolveDataSourceId(\n notion: Client,\n databaseId: string,\n): Promise {\n if (cachedDataSourceId) return cachedDataSourceId;\n\n const database = await notion.databases.retrieve({ database_id: databaseId });\n const id = (database as { data_sources?: { id: string }[] })\n .data_sources?.[0]?.id;\n\n if (!id) throw new Error(`Database ${databaseId} exposes no data source`);\n\n cachedDataSourceId = id;\n return id;\n}\n\n/** Notion rich_text wants an array; an empty one renders as a blank cell. */\nfunction text(value: string | null) {\n return value\n ? { rich_text: [{ type: \"text\" as const, text: { content: value } }] }\n : { rich_text: [] };\n}\n\nexport async function recordRegistration(\n registration: RegistrationCapture,\n): Promise> {\n const auth = Deno.env.get(\"NOTION_API_KEY\");\n const databaseId = Deno.env.get(\"REGISTRATIONS_DATABASE_ID\");\n\n if (!auth || !databaseId) {\n // Not wired up yet. Log the address so it is recoverable from the val log\n // rather than silently lost.\n console.warn(\n `[registrations] Notion not configured — UNRECORDED: ${registration.email} (gate: ${registration.gate})`,\n );\n return createErrorResponse(\n \"Notion is not configured (needs NOTION_API_KEY and REGISTRATIONS_DATABASE_ID)\",\n 503,\n );\n }\n\n try {\n const notion = new Client({ auth });\n const dataSourceId = await resolveDataSourceId(notion, databaseId);\n\n await notion.pages.create({\n parent: { type: \"data_source_id\", data_source_id: dataSourceId },\n properties: {\n Name: {\n title: [{ type: \"text\", text: { content: registration.name } }],\n },\n Email: { email: registration.email },\n \"Given name\": text(registration.givenName),\n \"Family name\": text(registration.familyName),\n Domain: text(registration.domain),\n Gate: { select: { name: registration.gate } },\n Source: { select: { name: registration.source } },\n },\n } as Parameters[0]);\n\n return createSuccessResponse({ recorded: true });\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n console.error(\n `[registrations] Notion write FAILED — ${registration.email} (gate: ${registration.gate}): ${detail}`,\n );\n return createErrorResponse(`Notion write failed: ${detail}`, 502);\n }\n}\n",[],[162,388,381],"services","c74f541b-d740-4df0-b009-5557bdb6c339","google.oauth.service.ts","495b0e8c-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Google Identity Services — the popup account chooser.\n *\n * The browser gets the branded button from Google's own script; Google then\n * POSTs a signed ID token to our endpoint. NOT Val Town's `std/oauth`, which\n * gates on a VAL TOWN account a visitor does not have.\n */\n\nconst TOKENINFO = \"https://oauth2.googleapis.com/tokeninfo\";\nconst VALID_ISSUERS = [\"accounts.google.com\", \"https://accounts.google.com\"];\n\nexport interface GoogleProfile {\n email: string;\n emailVerified: boolean;\n name: string | null;\n givenName: string | null;\n familyName: string | null;\n /**\n * The `hd` claim — a Google Workspace account's host domain, e.g. `acme.com`.\n * Absent for personal accounts, and its absence is itself signal.\n */\n domain: string | null;\n /** Google's stable user id. The only safe identity key — an address can move. */\n subject: string;\n}\n\nexport function getGoogleClientId(): string | null {\n return Deno.env.get(\"GOOGLE_CLIENT_ID\") ?? null;\n}\n\nexport function isGoogleConfigured(): boolean {\n return Boolean(getGoogleClientId());\n}\n\n/**\n * Verify an ID token that arrived FROM THE BROWSER.\n *\n * ⚠️ Signature verification is mandatory here, unlike a server-to-server code\n * exchange: the token passed through the client, so anything in it is\n * attacker-controlled until Google says otherwise.\n *\n * Uses Google's tokeninfo endpoint rather than local RS256 + JWKS caching:\n * one network hop per sign-in, no crypto code and no key rotation to get\n * wrong. That is the right trade at this site's volume. If sign-ins ever get\n * frequent enough for the hop to matter, verify locally instead.\n */\nexport async function verifyIdToken(\n credential: string,\n): Promise> {\n const clientId = getGoogleClientId();\n if (!clientId) {\n return createErrorResponse(\"GOOGLE_CLIENT_ID is not set\", 503);\n }\n\n try {\n const response = await fetch(\n `${TOKENINFO}?id_token=${encodeURIComponent(credential)}`,\n );\n\n // tokeninfo returns 400 for a bad signature, a malformed token, or one\n // that has expired — so this single check covers all three.\n if (!response.ok) {\n return createErrorResponse(\n `Google rejected the ID token (${response.status})`,\n 401,\n );\n }\n\n const claims = await response.json() as Record;\n\n // tokeninfo proves the token is genuine; it does NOT prove it was minted\n // for US. Without this check, a valid token issued to any other Google\n // app would be accepted here.\n if (claims.aud !== clientId) {\n return createErrorResponse(\"ID token was issued for another app\", 401);\n }\n if (!VALID_ISSUERS.includes(String(claims.iss))) {\n return createErrorResponse(`Unexpected issuer: ${claims.iss}`, 401);\n }\n\n const email = typeof claims.email === \"string\" ? claims.email : null;\n const subject = typeof claims.sub === \"string\" ? claims.sub : null;\n if (!email || !subject) {\n return createErrorResponse(\"ID token carried no email\", 401);\n }\n\n const str = (key: string): string | null =>\n typeof claims[key] === \"string\" && claims[key] ? claims[key] as string : null;\n\n return createSuccessResponse({\n email,\n subject,\n name: str(\"name\"),\n givenName: str(\"given_name\"),\n familyName: str(\"family_name\"),\n domain: str(\"hd\"),\n // tokeninfo stringifies booleans.\n emailVerified: String(claims.email_verified) === \"true\",\n });\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not reach Google: ${detail}`, 502);\n }\n}\n",[],[162,388,390],"7c8e686e-8aff-497a-9343-7749bd0638f8","content.service.ts","495b019e-ac3f-11f1-8027-1607ee4eb77e",["D",1788953809222],"import {\n listFilesByPath,\n readFile,\n} from \"https://esm.town/v/std/utils/index.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Where content comes from.\n *\n * This is a SERVICE, not a util, even though v1's content is \"just files\":\n * Val Town has no filesystem, so `readFile` is a Val Town API call — real I/O.\n *\n * It is also the seam. When content moves to Notion or a CMS, this file is the\n * only one that changes; the controller, the renderer, and the routes never\n * learn the difference.\n *\n * `import.meta.url` is passed explicitly so a branch reads ITS OWN content\n * files rather than whatever `main` happens to be serving.\n */\nexport async function getContentFile(\n path: string,\n): Promise> {\n try {\n const raw = await readFile(path, import.meta.url);\n return createSuccessResponse(raw);\n } catch (error) {\n // Services never throw — `readFile` does, on a missing file.\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not read \"${path}\": ${detail}`, 404);\n }\n}\n\n/**\n * The slugs of the markdown files directly inside one content directory.\n *\n * ONE API call by design: this deliberately does not open each file to read a\n * title out of its frontmatter. An MCP tool callback is killed a few seconds\n * after its response flushes, so a listing that read N files would start dying\n * partway through as the site grows — and it would fail silently, mid-loop.\n * Callers that want a title read the one file they care about.\n *\n * Listing is filtered to the directory's OWN files, because the underlying\n * call may descend into subdirectories — without this, `content` would report\n * the gates in `content/gates` as if they were pages.\n */\nexport async function listContentFiles(\n dir: string,\n): Promise> {\n const prefix = dir.replace(/^\\/+|\\/+$/g, \"\");\n\n try {\n const files = await listFilesByPath(dir, import.meta.url);\n const slugs = files\n .map((file) => file.path.replace(/^\\/+/, \"\"))\n .filter((path) => path.endsWith(\".md\"))\n .filter((path) => path.startsWith(`${prefix}/`))\n .map((path) => path.slice(prefix.length + 1))\n .filter((name) => !name.includes(\"/\"))\n .map((name) => name.replace(/\\.md$/, \"\"))\n .sort();\n return createSuccessResponse(slugs);\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not list \"${dir}\": ${detail}`, 404);\n }\n}\n",[],[162,388,397],"2541e365-1496-4118-b1df-0f30f4b1fbab",["D",1788952323787],[186,187,188],[162,388],"e4fac905-57c4-438b-810e-92efff3d1ca9","pages.ts","495af712-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-a22a2b29fc5e",["D",1788952323787],"import { type Context, Hono } from \"npm:hono@4.11.9\";\nimport { getCookie } from \"npm:hono@4.11.9/cookie\";\nimport { getPage, type Viewer } from \"../controllers/page.controller.ts\";\nimport { renderLayout } from \"../utils/layout.ts\";\nimport { UNLOCK_COOKIE } from \"../utils/gate.ts\";\nimport type { ContentfulStatusCode } from \"npm:hono@4.11.9/utils/http-status\";\n\n/**\n * Public HTML routes. Thin wrappers: extract, call the controller, map\n * `success === false` to a status, return a Response. No business logic — the\n * route reads the cookie but never decides what it means.\n */\nconst pages = new Hono();\n\n/** Cookies, query params and origin are HTTP concerns — the ROUTE extracts them. */\nfunction viewerFrom(c: Context): Viewer {\n const error = c.req.query(\"error\");\n return {\n email: getCookie(c, UNLOCK_COOKIE) ?? null,\n error: error === \"email\" || error === \"google\" ? error : null,\n // Derived, never hardcoded — the same code serves preview, production and\n // the custom domain.\n origin: new URL(c.req.url).origin,\n };\n}\n\nasync function servePage(c: Context, slug: string) {\n const result = await getPage(slug, viewerFrom(c));\n\n if (!result.success) {\n return c.html(\n renderLayout({\n title: \"Not found\",\n description: \"\",\n html:\n `

Not found

\\n

${result.error}

\\n

Home

`,\n }),\n result.status as ContentfulStatusCode,\n );\n }\n\n return c.html(\n renderLayout({\n title: result.data.title,\n description: result.data.description,\n html: result.data.html,\n scripts: result.data.scripts,\n }),\n );\n}\n\npages.get(\"/\", (c) => servePage(c, \"home\"));\npages.get(\"/:slug\", (c) => servePage(c, c.req.param(\"slug\")));\n\nexport default pages;\n",[],[162,415,408],"routes","2160fddc-da6b-4a4d-9ddc-baa7088e94f3","mcp.ts","bedd91ea-ac42-11f1-aac6-1607ee4eb77e",["D",1788953809222],"import { Hono } from \"npm:hono@4.11.9\";\nimport {\n createMcpHandler,\n McpServer,\n} from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\nimport {\n type ContentKind,\n listContent,\n readContent,\n} from \"../controllers/content.controller.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\n\n/**\n * The MCP door.\n *\n * A ROUTE in the 3-layer sense: it extracts arguments, calls a controller, and\n * shapes the answer. No business logic lives here — which is why the tools can\n * stay this thin, and why the same controllers could serve an HTTP route later\n * without either door learning about the other.\n *\n * Built on `@modelcontextprotocol/server@2` (the v2 TypeScript SDK, MCP 2.0 /\n * the 2026-07-28 spec, still serving legacy clients), which is what Val Town's\n * own `templates/mcp-server` now uses. The older `@hono/mcp` +\n * `@modelcontextprotocol/sdk@1.x` wiring is superseded: `createMcpHandler`\n * owns the transport, its factory callback is the per-request build, and\n * `inputSchema` takes a real `z.object(...)` rather than a raw Zod shape.\n */\n\n/**\n * ⚠️ AUTH IS OURS, and it has to be.\n *\n * The house pattern gates `/mcp` at the Val Town edge with\n * `httpPrivacy: restricted` plus a bypass token — and that is unavailable to\n * us, twice over. This val is going PUBLIC because it serves the marketing\n * site, which removes the edge gate entirely; and the edge strips its own\n * token before any handler runs, so we could not check it even while\n * restricted. So the guard below is the only thing between the internet and\n * these tools once the privacy flip lands.\n */\nconst TOKEN_VAR = \"MCP_TOKEN\";\n\n/** Pull the token out of `Authorization: Bearer `, or \"\" if absent. */\nfunction presentedToken(header: string | undefined): string {\n if (!header) return \"\";\n const [scheme, ...rest] = header.split(\" \");\n return scheme.toLowerCase() === \"bearer\" ? rest.join(\" \").trim() : \"\";\n}\n\n/**\n * Compare every byte even after a mismatch, so response time doesn't leak how\n * much of the token was guessed correctly. Length is still observable; that is\n * the standard trade and it reveals nothing useful about a random secret.\n */\nfunction tokenMatches(presented: string, expected: string): boolean {\n if (presented.length !== expected.length) return false;\n let difference = 0;\n for (let index = 0; index < presented.length; index++) {\n difference |= presented.charCodeAt(index) ^ expected.charCodeAt(index);\n }\n return difference === 0;\n}\n\n/** Every tool answers in one shape, so a failure never looks like a result. */\nfunction toolResult(result: ServiceResponse) {\n if (!result.success) {\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: result.error }],\n };\n }\n return {\n content: [\n { type: \"text\" as const, text: JSON.stringify(result.data, null, 2) },\n ],\n };\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer({\n name: \"lightweightindustries\",\n version: \"1.0.0\",\n });\n\n server.registerTool(\n \"list_content\",\n {\n title: \"List content\",\n description:\n \"Lists what the site is made of: page slugs and gate names, read from this val's own `content/` directory. A gate is the block on a page that trades a visitor's email address for something hidden behind it. Returns names only — read one file with `read_content` to see its text.\",\n inputSchema: z.object({}),\n annotations: { title: \"List content\", readOnlyHint: true },\n },\n async () => toolResult(await listContent()),\n );\n\n server.registerTool(\n \"read_content\",\n {\n title: \"Read content\",\n description:\n \"Returns one page or gate exactly as written, frontmatter and gate tokens intact. Use for reading before an edit: this is the markdown source, not the rendered HTML a visitor sees, and it resolves no gates. Needs a `slug` from `list_content`.\",\n inputSchema: z.object({\n slug: z\n .string()\n .describe(\n \"File name without `.md`, e.g. `home` or `calendar`. Get one from `list_content`.\",\n ),\n kind: z\n .enum([\"page\", \"gate\"])\n .optional()\n .describe(\n \"Which directory to read from: `page` for `content/`, `gate` for `content/gates/`. Omit to read a page.\",\n ),\n }),\n annotations: { title: \"Read content\", readOnlyHint: true },\n },\n async ({ slug, kind }) =>\n toolResult(await readContent(slug, (kind ?? \"page\") as ContentKind)),\n );\n\n return server;\n});\n\nconst mcp = new Hono();\n\nmcp.all(\"/\", async (c) => {\n const expected = Deno.env.get(TOKEN_VAR);\n\n // Fail CLOSED. With no secret configured there is no way to tell the\n // operator from the internet, and this sits on the same public origin as\n // the marketing page.\n if (!expected) {\n console.error(`[mcp] ${TOKEN_VAR} is not set — refusing every request`);\n return c.json({ error: \"MCP surface is not configured\" }, 503);\n }\n\n if (!tokenMatches(presentedToken(c.req.header(\"authorization\")), expected)) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n // The handler is shaped to be a val's default export, so it normally sits at\n // the origin root. Handing it the raw request unchanged is the simple case;\n // if it turns out to route on pathname and rejects `/mcp`, the fix is to\n // rewrite the URL to \"/\" before passing it through.\n return await handler.fetch(c.req.raw);\n});\n\nexport default mcp;\n",[],[162,415,417],"ce7dcf6c-b34e-4548-8011-45d5f7b04282","auth.ts","495ae2ea-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { Hono } from \"npm:hono@4.11.9\";\nimport { deleteCookie, getCookie, setCookie } from \"npm:hono@4.11.9/cookie\";\nimport { unlockGateWithGoogle } from \"../controllers/gate.controller.ts\";\nimport { gateAnchorId, UNLOCK_COOKIE } from \"../utils/gate.ts\";\n\nconst auth = new Hono();\n\n/**\n * Google Identity Services posts the signed ID token here after the visitor\n * picks an account in the popup.\n *\n * ⚠️ This path must EXACTLY match an authorized redirect URI on the OAuth\n * client, and match `data-login_uri` on the page, or Google refuses to post.\n */\nauth.post(\"/google/callback\", async (c) => {\n const form = await c.req.parseBody();\n\n const credential = String(form.credential ?? \"\");\n const postedCsrf = String(form.g_csrf_token ?? \"\");\n const cookieCsrf = getCookie(c, \"g_csrf_token\");\n\n // Which gate they clicked, carried in the button's data-state attribute.\n const gate = String(form.state ?? \"\").toLowerCase().replace(/[^a-z0-9-]/g, \"\") ||\n \"calendar\";\n const anchor = `#${gateAnchorId(gate)}`;\n\n // Google's double-submit CSRF check: it sets the same random value as both\n // a cookie and a body field. A mismatch means this POST didn't come from\n // the sign-in we rendered.\n if (!credential || !postedCsrf || postedCsrf !== cookieCsrf) {\n console.warn(\"[auth] Google callback rejected: CSRF token mismatch\");\n return c.redirect(`/?error=google${anchor}`, 303);\n }\n\n const result = await unlockGateWithGoogle(credential, gate);\n\n if (!result.success) {\n console.error(`[auth] Google sign-in failed: ${result.error}`);\n return c.redirect(`/?error=google${anchor}`, 303);\n }\n\n setCookie(c, UNLOCK_COOKIE, result.data.email, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 365,\n });\n\n // Land them back on the gate, looking at what they just unlocked.\n return c.redirect(`/${anchor}`, 303);\n});\n\n/**\n * Forget this visitor and put the gates back.\n *\n * Not a nicety: without it the unlock cookie is httpOnly and lasts a year, so\n * whoever unlocks a gate — the site's own author included — can never see that\n * gate again. It is also the honest thing to offer anyone on a shared machine.\n *\n * GET rather than POST so it can be a plain link. The worst a stray prefetch\n * can do is sign someone out, which costs them one click.\n */\nauth.get(\"/reset\", (c) => {\n deleteCookie(c, UNLOCK_COOKIE, { path: \"/\" });\n return c.redirect(\"/\", 303);\n});\n\nexport default auth;\n",[],[162,415,424],"f9a5a427-4915-49b2-b5b8-8776a2ef2cf3","api.ts","495ad516-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { Hono } from \"npm:hono@4.11.9\";\nimport { setCookie } from \"npm:hono@4.11.9/cookie\";\nimport { unlockGate } from \"../controllers/gate.controller.ts\";\nimport { gateAnchorId, UNLOCK_COOKIE } from \"../utils/gate.ts\";\n\nconst api = new Hono();\n\n/**\n * A plain form POST — no JavaScript involved. Post, redirect, re-render.\n * 303 rather than 302 so the browser follows with GET and a reload doesn't\n * resubmit the form.\n *\n * The redirect carries a fragment so the visitor lands back ON the gate\n * instead of at the top of the page, hunting for what they just unlocked.\n */\napi.post(\"/unlock\", async (c) => {\n const form = await c.req.parseBody();\n const gate = String(form.gate ?? \"\").toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n const anchor = gate ? `#${gateAnchorId(gate)}` : \"\";\n\n const result = await unlockGate(String(form.email ?? \"\"), gate);\n\n if (!result.success) {\n // Query string before the fragment, or the browser reads the whole tail\n // as part of the fragment and the error is never seen.\n return c.redirect(`/?error=email${anchor}`, 303);\n }\n\n setCookie(c, UNLOCK_COOKIE, result.data.email, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 365,\n });\n\n return c.redirect(`/${anchor}`, 303);\n});\n\nexport default api;\n",[],[162,415,431],"ef6aa159-7970-4f5d-88d3-c3eff6d43af7",["D",1788952323787],[181,182,183,184],[162,415],"3a87a817-b62c-474d-b155-8b2fdf12d61f","page.controller.ts","495aa7bc-ac3f-11f1-8027-1607ee4eb77e",["D",1789038102875],"import { getContentFile } from \"../services/content.service.ts\";\nimport { getGoogleClientId } from \"../services/google.oauth.service.ts\";\nimport { parseFrontmatter } from \"../utils/frontmatter.ts\";\nimport { renderMarkdown } from \"../utils/markdown.ts\";\nimport { toSafeSlug } from \"../utils/slug.ts\";\nimport {\n findGateNames,\n type GateError,\n GSI_SCRIPT,\n renderGatePrompt,\n renderUnlockedNote,\n replaceGate,\n wrapGate,\n} from \"../utils/gate.ts\";\nimport type { PageView, ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/** What the route knows about whoever is asking. */\nexport interface Viewer {\n /** The address they already traded, or null. */\n email: string | null;\n /** Their last attempt failed, so the prompt should say so. */\n error?: GateError;\n /** Absolute origin of this request — Google needs an absolute login_uri. */\n origin: string;\n}\n\n/**\n * Resolve a slug to a rendered page.\n *\n * Returns `ServiceResponse` rather than an HTTP `Response` on\n * purpose: that is what lets an MCP tool handler call this exact function\n * later without a route in front of it.\n */\nexport async function getPage(\n slug: string,\n viewer: Viewer,\n): Promise> {\n // Validation is the controller's job. `toSafeSlug` also closes path\n // traversal — a slug can only ever be a flat name inside content/.\n const safeSlug = toSafeSlug(slug);\n if (!safeSlug) return createErrorResponse(\"Invalid page slug\", 404);\n\n const file = await getContentFile(`/content/${safeSlug}.md`);\n if (!file.success) {\n // Wrap the service error with context rather than leaking its wording.\n return createErrorResponse(`No page named \"${safeSlug}\"`, 404);\n }\n\n const { data, body } = parseFrontmatter(file.data);\n let html = renderMarkdown(body);\n\n const clientId = getGoogleClientId();\n const scripts: string[] = [];\n let onloadEmitted = false;\n\n // Whether a gate opens is a business decision, so it happens HERE — not in\n // the route, and not in the renderer.\n for (const name of new Set(findGateNames(html))) {\n const gate = await resolveGate(name, viewer, clientId, !onloadEmitted);\n\n if (gate.renderedGoogle) {\n // Exactly one #g_id_onload per page, and Google's script pulled in only\n // when something on the page actually needs it.\n onloadEmitted = true;\n if (!scripts.includes(GSI_SCRIPT)) scripts.push(GSI_SCRIPT);\n }\n\n // Wrapped in both states, locked and unlocked, so the anchor an unlock\n // redirects to exists on the page it lands on.\n html = replaceGate(html, name, wrapGate(name, gate.html));\n }\n\n return createSuccessResponse({\n slug: safeSlug,\n title: data.title ?? safeSlug,\n description: data.description ?? \"\",\n html,\n scripts,\n });\n}\n\ninterface ResolvedGate {\n html: string;\n renderedGoogle: boolean;\n}\n\nasync function resolveGate(\n name: string,\n viewer: Viewer,\n clientId: string | null,\n includeOnload: boolean,\n): Promise {\n const file = await getContentFile(`/content/gates/${name}.md`);\n\n if (!file.success) {\n // A page referencing a gate that doesn't exist is our bug, not the\n // visitor's problem — log it and render nothing rather than show a token.\n console.error(`[gate] page references missing gate file \"${name}\"`);\n return { html: \"\", renderedGoogle: false };\n }\n\n const { data, body } = parseFrontmatter(file.data);\n\n // Already paid — hand over the reward, plus a way back out. Without that\n // way out an unlock is permanent and invisible, and nobody (author\n // included) can ever see the gate again.\n if (viewer.email) {\n return {\n // The note comes FIRST: it says whose view this is before handing over\n // what they unlocked, rather than as a footnote after a 600px embed.\n //\n // The body is rendered as written. Which PART of a reward is a card is a\n // content decision, not one for this layer — the calendar gate wraps its\n // embed in an article itself and leaves the fallback line outside it.\n html: `${renderUnlockedNote(viewer.email)}\\n${renderMarkdown(body)}`,\n renderedGoogle: false,\n };\n }\n\n return {\n html: renderGatePrompt({\n name,\n // No default: a gate says nothing unless its file asks it to. Prose\n // belongs in the page around the token, not inside the gate.\n prompt: data.prompt,\n // A default here only so a half-written gate still has a usable button.\n button: data.button ?? \"Continue\",\n fallback: data.fallback ?? \"Use your email instead\",\n // No default: a gate that sets nothing shows nothing.\n assurance: data.assurance,\n googleClientId: clientId,\n loginUri: `${viewer.origin}/auth/google/callback`,\n includeOnload,\n error: viewer.error ?? null,\n }),\n renderedGoogle: Boolean(clientId),\n };\n}\n",[],[162,163,442],"52510d31-08a9-4623-9a1c-c6c8b406a4c0","gate.controller.ts","495a6676-ac3f-11f1-8027-1607ee4eb77e",40,["D",1789042217742],"import { recordRegistration } from \"../services/notion.service.ts\";\nimport { verifyIdToken } from \"../services/google.oauth.service.ts\";\nimport { EMAIL_FALLBACK_ENABLED } from \"../utils/gate.ts\";\nimport type { RegistrationCapture } from \"../types/registration.types.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\nexport interface Unlocked {\n email: string;\n gate: string;\n}\n\n/** Deliberately loose — this is a shape check, not address verification. */\nconst EMAIL_SHAPE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nfunction normaliseGate(raw: string): string {\n return raw.trim().toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n}\n\n/**\n * The typed-email fallback path. No name and no domain — whoever is at the\n * keyboard typed a string, and it could be anything.\n */\nexport async function unlockGate(\n rawEmail: string,\n rawGate: string,\n): Promise> {\n // Refused at the CONTROLLER, not merely hidden in the UI. The form is gone\n // from the page, but /api/unlock is still a live route and its URL is in the\n // page source of every visit made before it was hidden.\n if (!EMAIL_FALLBACK_ENABLED) {\n console.warn(\n `[gate] typed-email unlock REFUSED — the fallback is switched off`,\n );\n return createErrorResponse(\"This route is currently unavailable\", 403);\n }\n\n const email = rawEmail.trim().toLowerCase();\n const gate = normaliseGate(rawGate);\n\n if (!EMAIL_SHAPE.test(email)) {\n return createErrorResponse(\"That doesn't look like an email address\", 400);\n }\n if (!gate) return createErrorResponse(\"Missing gate name\", 400);\n\n return finishUnlock({\n // No name to use, so the address becomes the title. Better than \"Untitled\".\n name: email,\n givenName: null,\n familyName: null,\n email,\n domain: null,\n gate,\n source: \"typed\",\n });\n}\n\n/**\n * The DEFAULT path: they picked an account in Google's popup, so the address\n * arrives with a real name attached and, for Workspace accounts, their domain.\n */\nexport async function unlockGateWithGoogle(\n credential: string,\n rawGate: string,\n): Promise> {\n const gate = normaliseGate(rawGate);\n if (!gate) return createErrorResponse(\"Missing gate name\", 400);\n\n const profile = await verifyIdToken(credential);\n if (!profile.success) {\n return createErrorResponse(`Google sign-in failed: ${profile.error}`, 401);\n }\n\n const google = profile.data;\n\n // ⚠️ `email_verified` is not the whole story. Google is authoritative only\n // for @gmail.com addresses and for Workspace accounts (where `hd` is set).\n // Otherwise the address was verified once at signup and that third-party\n // mailbox may have changed hands since. `Source: google` is a strong signal,\n // not a guarantee.\n if (!google.emailVerified) {\n console.warn(\n `[gate] Google returned an UNVERIFIED address: ${google.email}`,\n );\n }\n\n return finishUnlock({\n name: google.name ?? google.email,\n givenName: google.givenName,\n familyName: google.familyName,\n email: google.email,\n domain: google.domain,\n gate,\n source: \"google\",\n });\n}\n\n/**\n * Record the registration, then open the gate either way.\n *\n * Deliberate: a misconfiguration on OUR side must not cost the visitor the\n * thing they just traded for. The address is in the val log regardless, so it\n * is recoverable — unlike the goodwill of a form that eats a submission.\n */\nasync function finishUnlock(\n registration: RegistrationCapture,\n): Promise> {\n const recorded = await recordRegistration(registration);\n\n if (!recorded.success) {\n console.warn(\n `[gate] unlocking \"${registration.gate}\" for ${registration.email} despite: ${recorded.error}`,\n );\n }\n\n return createSuccessResponse({\n email: registration.email,\n gate: registration.gate,\n });\n}\n",[],[162,163,449],["D",1788953809222],[],[162,163,70],"4242f58a-7287-4339-9a7c-88e6759593f6",["D",1788952323787],[177,178,179],[162,163],"525a0c10-b0c9-43f6-b63a-5e7a98f49f56",["D",1788952323787],[176,180,185,189,191,198,199],[162],["D",1788890813214],{"_11":12,"_130":126},{"_11":12,"_125":12,"_76":126,"_30":-5,"_127":128,"_129":92},{"_38":116,"_13":16,"_32":35,"_117":79,"_118":-5,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":14,"_124":12},"ctx",{"_52":-5,"_149":504,"_505":506,"_507":508,"_509":24,"_510":24,"_511":24,"_512":92,"_513":-5,"_514":-7,"_515":-7,"_516":26,"_517":24,"_518":24,"_519":-5,"_520":24,"_521":24,"_522":24,"_523":-5},"ENV",{"_475":476,"_477":478,"_479":16,"_480":481,"_482":483,"_484":485,"_486":487,"_488":489,"_490":491,"_492":493,"_494":495,"_496":497,"_498":499,"_500":501,"_502":503},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · content.controller.ts