[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_436":437,"_438":439},"routes/_app.x.$handle.$name",{"_99":98,"_32":46,"_107":89,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":61,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":56,"_18":57,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",37,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","backend/utils/gate.ts","latestPath","fileId","495b591e-ac3f-11f1-8027-1607ee4eb77e","name","gate.ts","fileType","script","content","import { escapeHtml } from \"./html.ts\";\n\n/**\n * Gates: trade an identity for something.\n *\n * A gate is a CONTENT file (`content/gates/.md`) plus a `{{gate:}}`\n * token in a page. Adding another gate is a file and a token — never code.\n */\n\n/** Google Identity Services — the script that draws the button and the popup. */\nexport const GSI_SCRIPT = \"https://accounts.google.com/gsi/client\";\n\n/** Records that a visitor has already paid the toll. */\nexport const UNLOCK_COOKIE = \"lw_unlocked\";\n\n/**\n * ⚠️ This cookie is NOT a security boundary and is deliberately unsigned.\n * Forging it reveals a calendar link that is handed to anyone who signs in,\n * so signing it would buy nothing. If a gate ever fronts something of real\n * value, this decision has to be revisited — sign it then.\n */\n\n/**\n * A gate token — with or without the paragraph `marked` may have wrapped it in.\n *\n * ⚠️ BOTH have to work, because the difference is invisible to whoever is\n * writing the page. `marked` treats a run of lines starting with a raw HTML\n * tag as ONE html block that ends at the first blank line, so this:\n *\n *

\n *\n * {{gate:calendar}}\n *\n *

\n *\n * renders the token as its own paragraph, while this:\n *\n *

\n * {{gate:calendar}}\n *

\n *\n * emits it as bare text inside the html block. Requiring the paragraph made\n * the second form fail silently — the literal token was printed on the page.\n * Matching the wrapper OPTIONALLY means an author never has to know that rule.\n * When the paragraph is present it is consumed along with the token, so no\n * empty paragraph is left behind.\n */\nconst GATE_TOKEN = /(?:

\\s*)?\\{\\{gate:([a-z0-9-]+)\\}\\}(?:\\s*<\\/p>)?/g;\n\nexport function findGateNames(html: string): string[] {\n return [...html.matchAll(GATE_TOKEN)].map((match) => match[1]);\n}\n\nexport function replaceGate(\n html: string,\n name: string,\n replacement: string,\n): string {\n // The replacement is passed as a FUNCTION, not a string, so a dollar sign in\n // the reward content (say, a price) is never read as a replacement pattern.\n //\n // `name` is safe to interpolate into the pattern: it only ever arrives from\n // `findGateNames`, which matched it against [a-z0-9-]+, so it can carry no\n // regex metacharacters.\n return html.replace(\n new RegExp(\n `(?:

\\\\s*)?\\\\{\\\\{gate:${name}\\\\}\\\\}(?:\\\\s*

)?`,\n \"g\",\n ),\n () => replacement,\n );\n}\n\n/**\n * The DOM id a gate renders under.\n *\n * Ours, not `marked`'s: heading ids would depend on the renderer's slugging of\n * whatever the heading happens to say, and would break the moment the copy\n * changes. This is keyed to the gate name instead.\n *\n * The name is used BARE — `#calendar`, not `#gate-calendar` — because the\n * anchor is a public URL someone might type or share, and the prefix was\n * machinery leaking into it. Nothing else on these pages emits ids (marked is\n * not configured to slug headings), so there is nothing to collide with. If\n * that ever changes, this function is the single place to re-prefix.\n *\n * Every caller goes through here — the page wrapper, the unlock redirect, and\n * the Google callback redirect — so the shape of the anchor is decided once.\n */\nexport function gateAnchorId(name: string): string {\n return name;\n}\n\n/**\n * Wraps a gate so an unlock can land the visitor back on it.\n *\n * An `article`, not a plain div: a gate is a bounded, self-contained thing —\n * a prompt in one state, an embedded calendar in the other — and Pico styles\n * `article` as a card, which is exactly that reading.\n *\n * Doing it HERE rather than around the token in markdown also removes a trap.\n * Raw HTML written around the token in a content file can swallow it into one\n * html block, and then the token never becomes a paragraph (see GATE_TOKEN\n * above). Owning the wrapper in code means an author writes only the token.\n */\nexport function wrapGate(name: string, html: string): string {\n const id = escapeHtml(gateAnchorId(name));\n // TWO hooks, doing two different jobs:\n // id — unique, per gate, so an unlock redirect can land on this one.\n // class — shared by every gate, so one CSS rule styles all of them.\n // Styling the id instead would mean the next gate inherits nothing.\n return `

\\n${html}\\n

`;\n}\n\nexport type GateError = \"email\" | \"google\" | null;\n\n/**\n * ⚠️ EVERY visitor-facing word in a locked gate arrives here from the gate's\n * own content file. None of it is written into this module.\n *\n * That is the same rule the token follows — adding a gate is a file, never\n * code — and it has to hold for the copy too, or the second gate inherits\n * calendar-flavoured wording it cannot change without a code edit.\n */\nexport interface GatePromptInput {\n name: string;\n /**\n * Optional lead-in above the button. Usually absent: the page around the\n * token is a better place for prose, because it can be edited, moved and\n * read in context. A gate that sets none renders only its controls.\n */\n prompt?: string;\n button: string;\n /** Summary on the disclosure hiding the email form. */\n fallback: string;\n /**\n * Optional line under the form. Omitted ENTIRELY when the gate file doesn't\n * set one — the absence is the point, so a gate says only what it needs to.\n */\n assurance?: string;\n /** Null when GOOGLE_CLIENT_ID isn't set. */\n googleClientId: string | null;\n /** Absolute. Must EXACTLY match an authorized redirect URI on the client. */\n loginUri: string;\n /** Only ONE #g_id_onload may exist per page — the first gate emits it. */\n includeOnload: boolean;\n error?: GateError;\n}\n\nexport function renderGatePrompt(\n {\n name,\n prompt,\n button,\n fallback,\n assurance,\n googleClientId,\n loginUri,\n includeOnload,\n error,\n }: GatePromptInput,\n): string {\n const gate = escapeHtml(name);\n const fieldId = `gate-${name}-email`;\n\n const notice = error === \"google\"\n ? `

Google sign-in didn't finish. Try again, or use your email below.

\\n`\n : error === \"email\"\n ? `

That doesn't look like an email address — try again?

\\n`\n : \"\";\n\n // The ARTICLE is what the disclosure reveals — the form arrives as a card\n // rather than as loose fields under a summary.\n //\n // fieldset role=\"group\" is Pico's own grouped-input markup: it strips the\n // inner border radii so field and button read as one control. Its rules\n // select DIRECT children, so ONLY those two may live inside it — the hidden\n // gate field sits outside, or it would take the first-child slot and the\n // rounding would land on the wrong element.\n //\n // The label sits ABOVE the fieldset, not in it — inside, it would be a\n // direct child of the group and take the first-child slot, flattening the\n // corners of the wrong element. And a real label means no aria-label: with\n // both present the aria-label wins and the visible text is what gets\n // ignored, which is backwards.\n const form = `

\n \n

`;\n\n // Google is the DEFAULT: one click, an account picked in Google's own popup,\n // and an address that comes back verified. Typing is the fallback.\n //\n // `data-auto_prompt=\"false\"` suppresses One Tap — a button was asked for, not\n // an uninvited flyover on page load. `data-state` carries which gate was\n // clicked; Google echoes it back in the POST.\n //\n // `data-text=\"continue_with\"` renders \"Continue with Google\" rather than\n // \"Sign in with Google\": this is a marketing page, and \"sign in\" implies an\n // account they don't have and never wanted.\n const onload = includeOnload\n ? `

\n`\n : \"\";\n\n const google = googleClientId\n ? `${onload}

`\n // Visible on purpose rather than hidden: a missing button reads as a bug,\n // and this says what to fix. It disappears once the client id is set.\n : `

\n Set GOOGLE_CLIENT_ID to enable this.

`;\n\n // Rendered only when the gate file asks for it, so silence is the default.\n const note = assurance ? `\\n${escapeHtml(assurance)}` : \"\";\n\n // Both the lead-in and the assurance are opt-in, so a gate that sets neither\n // renders exactly its controls: the button, and the form behind a summary.\n const lead = prompt ? `

${escapeHtml(prompt)}

\\n` : \"\";\n\n return `${lead}${notice}${google}\n

${escapeHtml(fallback)}

\n${form}\n

${note}`;\n}\n\n/**\n * Shown ABOVE an unlocked reward. The escape hatch out of a year-long,\n * httpOnly cookie — without it the gate becomes invisible forever to anyone\n * who has opened it once.\n *\n * A paragraph rather than `small`: it sits as a block-level child of the gate,\n * so it needs an element that carries its own spacing, and shrinking the one\n * control that undoes a year-long cookie was the wrong emphasis anyway.\n */\nexport function renderUnlockedNote(email: string): string {\n // \"Continuing as\", not \"Signed in as\" — this is a marketing page, and\n // sign-in language implies an account nobody here has or wants.\n return `

Continuing as ${\n escapeHtml(email)\n } · (Not you?)

`;\n}","import { escapeHtml } from \"./html.ts\";\n\n/**\n * Gates: trade an identity for something.\n *\n * A gate is a CONTENT file (`content/gates/.md`) plus a `{{gate:}}`\n * token in a page. Adding another gate is a file and a token — never code.\n */\n\n/** Google Identity Services — the script that draws the button and the popup. */\nexport const GSI_SCRIPT = \"https://accounts.google.com/gsi/client\";\n\n/** Records that a visitor has already paid the toll. */\nexport const UNLOCK_COOKIE = \"lw_unlocked\";\n\n/**\n * ⚠️ This cookie is NOT a security boundary and is deliberately unsigned.\n * Forging it reveals a calendar link that is handed to anyone who signs in,\n * so signing it would buy nothing. If a gate ever fronts something of real\n * value, this decision has to be revisited — sign it then.\n */\n\n/**\n * ⚠️ THE TYPED-EMAIL FALLBACK IS TEMPORARILY OFF.\n *\n * It is the one door that verifies nothing, which makes it the way around\n * Google sign-in. Nothing has been deleted: the disclosure, the form, the\n * controller path and the Notion write are all still here and still wired.\n * This flag is the switch that shows them again.\n *\n * Flip it to true once the remediations land — at minimum a honeypot and a\n * rate limit on /api/unlock, and ideally the flow where a typed submission\n * becomes a REQUEST (thank-you, manual vetting) rather than an unlock.\n *\n * Read in TWO places on purpose, so the form and the endpoint cannot drift\n * apart: renderGatePrompt omits the whole disclosure, and unlockGate refuses.\n * Hiding only the form would leave /api/unlock accepting posts from anything\n * that knows the URL — and that URL is in the page source of every visit made\n * before today, so it is not a secret.\n */\nexport const EMAIL_FALLBACK_ENABLED = false;\n\n/**\n * A gate token — with or without the paragraph `marked` may have wrapped it in.\n *\n * ⚠️ BOTH have to work, because the difference is invisible to whoever is\n * writing the page. `marked` treats a run of lines starting with a raw HTML\n * tag as ONE html block that ends at the first blank line, so this:\n *\n *

\n *\n * {{gate:calendar}}\n *\n *

\n *\n * renders the token as its own paragraph, while this:\n *\n *

\n * {{gate:calendar}}\n *

\\\\s*)?\\\\{\\\\{gate:${name}\\\\}\\\\}(?:\\\\s*

\\n${html}\\n

Google sign-in didn't finish. Try again, or use your email below.

\\n`\n : error === \"email\"\n ? `

That doesn't look like an email address — try again?

\n \n

\n`\n : \"\";\n\n const google = googleClientId\n ? `${onload}

`\n // Visible on purpose rather than hidden: a missing button reads as a bug,\n // and this says what to fix. It disappears once the client id is set.\n : `

\n Set GOOGLE_CLIENT_ID to enable this.

${escapeHtml(prompt)}

\\n` : \"\";\n\n return `${lead}${notice}${google}\n

${escapeHtml(fallback)}

\n${form}\n

Continuing as ${\n escapeHtml(email)\n } · (Not you?)

`;\n}","createdAt",["D",1789042182523],"branchVersion","branchId","882c282b-dbad-4f8a-8f35-51665afdbc22","id","e5478a0f-89bc-4c6b-b160-450142887dc4","lightweightindustries",["D",1788890813214],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Tools that travel","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/b36c9f74-c526-4d15-b99d-8536563aa401/square512?exp=1789592399&sig=b47bdaf4518798985839cc428ba4e1848b97ed80922e72e40951ab0a83633d7e","449588c0-326d-11f0-a80c-0741f032ef73","pinnedFileId","495ac9a4-ac3f-11f1-8027-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a038d7-2f56-77a8-813a-73db7ed08bec","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":98,"_101":102,"_18":-5,"_103":104,"_105":61},"branch",{"_13":88,"_32":89,"_44":43,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":46,"_97":98},"isOwned",318,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","lightweightorg","handle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/f0c72fa6-9948-4a8c-bb6c-89aef6f85d01/square512?exp=1789592399&sig=387bba815bb9d8aef990fe79286bdcc5f2dc3f3891b481ad7ef58869766990b0","tier","business","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":432,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":56,"_18":57,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":65,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":433,"_83":434,"_85":435,"_87":25},"tree",[172,197,202,206],"files",[172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206],"counts",{"_160":65,"_161":162,"_163":65,"_164":165,"_166":167},"contents",[130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{"_59":129},"lightweightindustries.com",{"_44":155,"_32":156,"_30":157,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":158,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_27":159},{"_44":151,"_32":36,"_30":152,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":153,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_27":154},{"_44":145,"_32":146,"_30":147,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":148,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_27":150},{"_44":134,"_32":135,"_30":136,"_137":-5,"_42":43,"_41":138,"_139":61,"_39":140,"_13":141,"_34":20,"_36":142,"_24":25,"_143":-5,"_27":144},"f272eff0-2378-4c9a-a1c1-428583659da6","README.md","beddc99e-ac42-11f1-aac6-1607ee4eb77e","parentId",32,"latest",["D",1789038102875],2,"# lightweightindustries\n\nThe public website at **lightweightindustries.com**, plus the backend behind it.\n\nContent is authored as markdown and rendered to HTML on the server. There is no client-side\nframework and no build step — a request comes in, a markdown file is read, and finished HTML\ngoes out.\n\n---\n\n## The website\n\n**A page is a markdown file.** `content/home.md` is the home page.\n\nThe block at the top of the file, between the `---` lines, is the frontmatter. It sets the\nbrowser tab title and the description search engines show:\n\n```markdown\n---\ntitle: Lightweight Industries\ndescription: Small, sharp software for people who'd rather own their tools.\n---\n\nEverything below the frontmatter is the page body, written as ordinary markdown.\n```\n\n**Adding a page is adding a file.** Dropping in `content/about.md` serves it at `/about` with\nno code change. An unknown slug returns a real 404.\n\nPages are server-rendered on purpose rather than assembled in the browser: a marketing site\nneeds to be crawlable by search engines and to paint immediately, and neither is true of a\nJavaScript app that fetches its own content after loading.\n\n### Other routes\n\n| Route | What it does |\n| --- | --- |\n| `/` | the home page |\n| `/` | the page in `content/.md` |\n| `/source` | redirects to this val's code |\n| `/auth/reset` | clears the unlock cookie (see below) |\n| `/api/unlock` | receives the email form |\n| `/auth/google/callback` | receives Google's sign-in POST |\n| `/mcp` | the MCP server (see below) |\n\n---\n\n## Gates\n\nA gate trades a visitor's identity for something you don't give away for free. The site ships\nwith one: your booking calendar.\n\n### How it works\n\nA gate is **a content file plus a token**. Its frontmatter holds every word the gate says\nwhile it is locked; its body is what a visitor gets once it opens:\n\n```markdown\n---\nprompt: Let me know who's asking and I'll show you my calendar.\nbutton: Show me the calendar\nfallback: Use your email instead\n---\n\n\n```\n\n| Key | Where it shows | If you leave it out |\n| --- | --- | --- |\n| `prompt` | the line above the Google button | a plain generic sentence |\n| `button` | the email form's submit button | \"Continue\" |\n| `fallback` | the summary on the collapsed email form | \"Use your email instead\" |\n| `assurance` | a small line under the form | **nothing at all** — the line simply doesn't exist |\n\n**No visitor-facing copy lives in the code.** That is deliberate: a second gate offering\nsomething other than a calendar writes its own words instead of inheriting these. `assurance`\nhaving no default is part of the same idea — a gate should be able to say less, not just\nsay something different.\n\nA page opts in by putting the matching token on a line of its own:\n\n```markdown\n## Availability\n\n{{gate:calendar}}\n```\n\nThe server replaces that token with one of two things.\n\n**If the visitor hasn't identified themselves,** they get the prompt, a **Continue with\nGoogle** button, and a collapsed disclosure hiding a plain email form.\n\n**If they have,** they get a line reading *\"Continuing as name@example.com · (Not you?)\"*\nand then the reward. The identity line comes first on purpose — it says whose view this is\nbefore handing over what was unlocked, rather than trailing after a 600px embed.\n\n### What happens in between\n\n- **The Google path** (the default) opens Google's own account chooser in a popup. It returns\n a **verified** address along with the visitor's given name, family name, and company domain.\n- **The email form** (the fallback) captures whatever they type. It is not verified.\n\nEither way the address is written to a Notion database, and a cookie records that this\nvisitor has already paid the toll so they are never asked twice.\n\n### Adding a second gate\n\nCreate `content/gates/.md` and put `{{gate:}}` on its own line in a page.\n**That's the whole procedure — adding a gate is never a code change.**\n\n### Two deliberate decisions worth knowing\n\n**The unlock cookie is unsigned.** Forging it reveals a calendar link that is handed to\nanyone who signs in, so signing the cookie would buy nothing. It is not a security boundary.\nIf a gate is ever put in front of something genuinely valuable, that decision has to be\nrevisited.\n\n**The cookie lasts a year and is `httpOnly`,** which means that without an escape hatch\nnobody — the author included — could ever see their own gate again after opening it once.\nThat is what `/auth/reset` and the \"not you?\" link are for.\n\n---\n\n## The MCP server\n\nAn [MCP](https://modelcontextprotocol.io) server lets an AI assistant call specific functions\nyou have defined, instead of poking at the site blindly. This one is mounted at `/mcp` and\nspeaks streamable HTTP.\n\n| Tool | What it does |\n| --- | --- |\n| `list_content` | Lists the page slugs and gate names the site is made of |\n| `read_content` | Returns one page or gate as raw markdown, frontmatter intact |\n\nBoth are read-only.\n\nIt is built on `@modelcontextprotocol/server@2` — the v2 TypeScript SDK, compatible with the\n2026-07-28 MCP spec and still serving older clients — which is the shape Val Town's own\n`templates/mcp-server` uses.\n\n### Protecting it\n\nMost Val Town MCP servers are protected by making the whole val private, letting the platform\nedge turn away anyone without a bypass token. **That is not available here**, because this val\nserves a public website. So `/mcp` checks a secret of its own:\n\n```\nAuthorization: Bearer \n```\n\nIt **fails closed** — if `MCP_TOKEN` is not set, every request is refused rather than allowed\nthrough. While the val's HTTP privacy is still `restricted`, a client needs the platform's\n`X-Val-Town-Access` header *as well*; once the val is public, the bearer token is the only\nthing standing in front of the tools.\n\n### Connecting a client\n\n```json\n{\n \"mcpServers\": {\n \"lightweightindustries\": {\n \"type\": \"http\",\n \"url\": \"https://lightweightindustries.val.run/mcp\",\n \"headers\": {\n \"Authorization\": \"Bearer \"\n }\n }\n }\n}\n```\n\nMCP clients cache the tool list per session, so a newly added or renamed tool only appears\nafter the client reconnects. Tool *behavior* is always live.\n\n---\n\n## Environment variables\n\nNone of these are required for the site to serve pages. Each one missing degrades a feature\nrather than breaking the site.\n\n| Variable | Powers | If it is missing |\n| --- | --- | --- |\n| `GOOGLE_CLIENT_ID` | the Continue with Google button | the button renders disabled and visibly names the variable, rather than vanishing — a missing button reads as a bug |\n| `NOTION_API_KEY` | recording registrations in Notion | the gate still unlocks; the address is logged, not recorded |\n| `REGISTRATIONS_DATABASE_ID` | which Notion database receives them | same as above |\n| `MCP_TOKEN` | the `/mcp` guard | `/mcp` refuses every request |\n\nThere is no Google client *secret*. The sign-in flow is Google Identity Services, which\nhappens in the browser and has no code exchange, so no secret exists to store.\n\n### The registrations database\n\nEvery unlock writes one row. It is an **append-only event log** — nothing is ever read back or\nupdated, so the same person registering twice produces two rows. That is intended: events are\nthe lossless record, and a deduplicated view of *people* is a separate, derived thing best\nbuilt later against real data. Keeping this write-only is also what stops an unverified typed\nsubmission from ever mutating a row that Google verified.\n\nThe Notion integration must be **shared with the database** in Notion's own UI. The schema the\ncode writes:\n\n| Property | Type | Notes |\n| --- | --- | --- |\n| `Name` | title | display name from Google, or the address when there isn't one |\n| `Email` | email | |\n| `Given name`, `Family name`, `Domain` | text | Google path only; blank for typed submissions |\n| `Gate` | select | which gate they opened |\n| `Source` | select | `google` or `typed` — **the column that says how much to trust the address** |\n\n`Created time` is Notion's own, and it is the event timestamp.\n\n---\n\n## Architecture\n\nThree layers, no shortcuts between them:\n\n```\nrequest → route → controller → service → outside world\n```\n\n- **Routes** (`backend/routes/`) extract what the request carries and return a response. No\n decisions.\n- **Controllers** (`backend/controllers/`) validate, decide, and orchestrate. They return a\n plain result object, never an HTTP response — which is exactly what lets the MCP tools call\n the same functions the web pages use, with no route in front.\n- **Services** (`backend/services/`) talk to the outside world — files, Notion, Google. They\n never throw; every failure comes back as a value.\n\n`backend/utils/` holds pure backend helpers, and `shared/` holds code safe for both the server\nand a browser.\n\n**`content.service.ts` is the seam.** Content is files today, but every read goes through that\none service — so moving content to Notion or a CMS later changes that file and nothing else.\n\n```\nbackend/\n index.http.ts entry — mounts the routes\n routes/ pages, api, auth, mcp\n controllers/ page (renders), content (reads source), gate\n services/ content, notion, google.oauth, blob\n utils/ frontmatter, markdown, layout, html, gate, slug\ncontent/\n home.md a page\n gates/calendar.md a gate\nshared/ types + the result helper, browser-safe\n```\n","label",[135],"142716a6-d7eb-4636-9f12-e261188535fa","shared","01a085de-26c9-705c-866d-b894979a2c42",["D",1788952323787],"directory",[146],"d8374e7b-e471-44f7-ae1e-f02d63902f84","01a085de-26c9-705c-866d-b21816253a09",["D",1788952323787],[36],"525a0c10-b0c9-43f6-b63a-5e7a98f49f56","backend","01a085de-26c9-705c-866d-984268dc880b",["D",1788952323787],[156],"pulls","branches",1,"forks","envVars",{"_168":170,"_171":65},"connections",{"_168":65,"_169":65},"count","unfilledCount",4,"emptyCount",{"_44":155,"_32":156,"_30":157,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":429,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":430,"_27":431},{"_44":425,"_32":410,"_30":405,"_137":157,"_42":43,"_41":141,"_139":61,"_39":426,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":427,"_27":428},{"_44":418,"_32":419,"_30":420,"_137":405,"_42":43,"_41":170,"_139":61,"_39":421,"_13":65,"_34":35,"_36":422,"_24":25,"_143":-5,"_208":423,"_27":424},{"_44":411,"_32":412,"_30":413,"_137":405,"_42":43,"_41":332,"_139":25,"_39":414,"_13":162,"_34":35,"_36":415,"_24":25,"_143":-5,"_208":416,"_27":417},{"_44":402,"_32":403,"_30":404,"_137":405,"_42":43,"_41":138,"_139":61,"_39":406,"_13":141,"_34":35,"_36":407,"_24":25,"_143":-5,"_208":408,"_27":409},{"_44":398,"_32":376,"_30":371,"_137":157,"_42":43,"_41":141,"_139":61,"_39":399,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":400,"_27":401},{"_44":391,"_32":392,"_30":393,"_137":371,"_42":43,"_41":141,"_139":61,"_39":394,"_13":65,"_34":35,"_36":395,"_24":25,"_143":-5,"_208":396,"_27":397},{"_44":384,"_32":385,"_30":386,"_137":371,"_42":43,"_41":141,"_139":61,"_39":387,"_13":65,"_34":35,"_36":388,"_24":25,"_143":-5,"_208":389,"_27":390},{"_44":377,"_32":378,"_30":379,"_137":371,"_42":43,"_41":170,"_139":61,"_39":380,"_13":65,"_34":35,"_36":381,"_24":25,"_143":-5,"_208":382,"_27":383},{"_44":368,"_32":369,"_30":370,"_137":371,"_42":43,"_41":141,"_139":61,"_39":372,"_13":65,"_34":35,"_36":373,"_24":25,"_143":-5,"_208":374,"_27":375},{"_44":364,"_32":349,"_30":344,"_137":157,"_42":43,"_41":141,"_139":61,"_39":365,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":366,"_27":367},{"_44":357,"_32":358,"_30":359,"_137":344,"_42":43,"_41":170,"_139":61,"_39":360,"_13":162,"_34":35,"_36":361,"_24":25,"_143":-5,"_208":362,"_27":363},{"_44":350,"_32":351,"_30":352,"_137":344,"_42":43,"_41":141,"_139":61,"_39":353,"_13":65,"_34":35,"_36":354,"_24":25,"_143":-5,"_208":355,"_27":356},{"_44":341,"_32":342,"_30":343,"_137":344,"_42":43,"_41":332,"_139":61,"_39":345,"_13":162,"_34":35,"_36":346,"_24":25,"_143":-5,"_208":347,"_27":348},{"_44":337,"_32":226,"_30":331,"_137":157,"_42":43,"_41":141,"_139":61,"_39":338,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":339,"_27":340},{"_44":328,"_32":329,"_30":330,"_137":331,"_42":43,"_41":332,"_139":61,"_39":333,"_13":65,"_34":35,"_36":334,"_24":25,"_143":-5,"_208":335,"_27":336},{"_44":324,"_32":291,"_30":286,"_137":157,"_42":43,"_41":141,"_139":61,"_39":325,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":326,"_27":327},{"_44":317,"_32":318,"_30":319,"_137":286,"_42":43,"_41":141,"_139":61,"_39":320,"_13":65,"_34":35,"_36":321,"_24":25,"_143":-5,"_208":322,"_27":323},{"_44":313,"_32":33,"_30":31,"_137":286,"_42":43,"_41":14,"_139":25,"_39":314,"_13":141,"_34":35,"_36":38,"_24":25,"_143":-5,"_208":315,"_27":316},{"_44":306,"_32":307,"_30":308,"_137":286,"_42":43,"_41":141,"_139":61,"_39":309,"_13":65,"_34":35,"_36":310,"_24":25,"_143":-5,"_208":311,"_27":312},{"_44":299,"_32":300,"_30":301,"_137":286,"_42":43,"_41":138,"_139":25,"_39":302,"_13":141,"_34":35,"_36":303,"_24":25,"_143":-5,"_208":304,"_27":305},{"_44":292,"_32":293,"_30":294,"_137":286,"_42":43,"_41":141,"_139":61,"_39":295,"_13":65,"_34":35,"_36":296,"_24":25,"_143":-5,"_208":297,"_27":298},{"_44":283,"_32":284,"_30":285,"_137":286,"_42":43,"_41":170,"_139":61,"_39":287,"_13":65,"_34":35,"_36":288,"_24":25,"_143":-5,"_208":289,"_27":290},{"_44":277,"_32":278,"_30":59,"_137":157,"_42":43,"_41":170,"_139":61,"_39":279,"_13":162,"_34":272,"_36":280,"_24":25,"_143":46,"_208":281,"_27":282},{"_44":267,"_32":268,"_30":269,"_137":157,"_42":43,"_41":270,"_139":61,"_39":271,"_13":65,"_34":272,"_36":273,"_24":25,"_143":274,"_208":275,"_27":276},{"_44":151,"_32":36,"_30":152,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":264,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":265,"_27":266},{"_44":260,"_32":259,"_30":254,"_137":152,"_42":43,"_41":141,"_139":61,"_39":261,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":262,"_27":263},{"_44":251,"_32":252,"_30":253,"_137":254,"_42":43,"_41":138,"_139":61,"_39":255,"_13":162,"_34":20,"_36":256,"_24":25,"_143":-5,"_208":257,"_27":258},{"_44":242,"_32":243,"_30":244,"_137":152,"_42":43,"_41":245,"_139":25,"_39":246,"_13":247,"_34":20,"_36":248,"_24":25,"_143":-5,"_208":249,"_27":250},{"_44":234,"_32":235,"_30":236,"_137":152,"_42":43,"_41":138,"_139":25,"_39":237,"_13":238,"_34":20,"_36":239,"_24":25,"_143":-5,"_208":240,"_27":241},{"_44":145,"_32":146,"_30":147,"_137":-5,"_42":43,"_41":141,"_139":61,"_39":231,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":232,"_27":233},{"_44":227,"_32":226,"_30":221,"_137":147,"_42":43,"_41":141,"_139":61,"_39":228,"_13":65,"_34":149,"_36":-5,"_24":25,"_143":-5,"_208":229,"_27":230},{"_44":218,"_32":219,"_30":220,"_137":221,"_42":43,"_41":141,"_139":61,"_39":222,"_13":65,"_34":35,"_36":223,"_24":25,"_143":-5,"_208":224,"_27":225},{"_44":211,"_32":212,"_30":213,"_137":147,"_42":43,"_41":141,"_139":61,"_39":214,"_13":65,"_34":35,"_36":215,"_24":25,"_143":-5,"_208":216,"_27":217},{"_44":134,"_32":135,"_30":136,"_137":-5,"_42":43,"_41":138,"_139":61,"_39":207,"_13":141,"_34":20,"_36":142,"_24":25,"_143":-5,"_208":209,"_27":210},["D",1789038102875],"children",[],[135],"2eace418-7434-4751-aa7a-7a91320b5ad9","response.ts","495bab08-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import type { ServiceResponse } from \"./types/index.ts\";\n\nexport function createSuccessResponse(data: T): ServiceResponse {\n return { success: true, data };\n}\n\nexport function createErrorResponse(\n error: string,\n status = 500,\n): ServiceResponse {\n return { success: false, error, status };\n}\n",[],[146,212],"8a8abe52-a94a-4397-b830-720416c69752","index.ts","495bb0b2-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-be21fdb6784a",["D",1788952323787],"/**\n * Contracts that cross the layer boundary.\n *\n * Pure types only — `shared/` must stay browser-safe, so nothing here may\n * import a Deno API.\n */\n\n/** Every controller and service returns this. Callers branch on `success`. */\nexport type ServiceResponse =\n | { success: true; data: T }\n | { success: false; error: string; status: number };\n\n/** A rendered content page, ready for a route to wrap in the layout. */\nexport interface PageView {\n slug: string;\n title: string;\n description: string;\n /** Markdown already rendered to HTML. Injected unescaped by the layout. */\n html: string;\n /**\n * External scripts this page actually needs. Kept as data so a page with no\n * gate never loads Google's script — the controller decides, the layout just\n * renders what it is handed.\n */\n scripts: string[];\n}\n",[],[146,226,219],"types","90d0a12a-e93a-495a-a871-bd023f356be8",["D",1788952323787],[204],[146,226],["D",1788952323787],[203,205],[146],"9eb4ca44-99c5-4e6b-9e2c-f78bf54c6e4c","privacy.md","8055aa7e-ac5c-11f1-8558-1607ee4eb77e",["D",1789038102875],5,"---\ntitle: Privacy · Lightweight Industries\ndescription: Data collected by this site.\n---\n\n# Privacy\n\n## Email\n\nThis site collects your email address and your name if you sign in with Google\nto view my calendar.\n\nI will also use your email to follow up with you.\n\n---\n\n## Cookies\n\n`lw_unlocked` remembers the email you used to register to see my calendar, so\nyou aren't asked again on every visit. It lasts a year. Clear it whenever you\nlike at [/auth/reset](/auth/reset)\n\n---\n\n## Other companies involved\n\n- Google: handles calendar registration\n- Notion: stores what you gave me\n- Val Town: hosts this site\n- jsDelivr: serves the stylesheet\n\n---\n\nLast updated: 9 September 2026",[],[36,235],"070cc8f1-708c-4ed2-86fa-ac845266a3e4","home.md","495ba220-ac3f-11f1-8027-1607ee4eb77e",36,["D",1789041622832],27,"---\ntitle: Lightweight Industries\ndescription: Messaging and tools for CEOs choosing what travels.\n---\n\n# Messaging and tools that travel.\n\n---\n\n_Recently_\n\n- “No more pipeline gatekeeping” — Notion charts of Salesforce data, right from\n Slack\n\n- A mission statement for a software company consolidating three brands and two\n business models into one\n\n- A grassroots campaign message to rally a thousand ski bums to fund a $2.5\n million land purchase\n\n---\n\n## Lightweight Industries is Brad Noble's messaging and tools business.\n\nFor CEOs and founders choosing what travels.\n\n

\n “Brad was masterful in helping us get at the heart of our distinction and shaping that into our core messaging. I wish we had that core message and his leadership long before we did.”\n
\n - Ed Boyajian, EDB CEO\n
\n

\n “Brad has a rare ability to cut through complexity and help teams align around simple, powerful decisions.”\n
\n - Kevin McIntyre, Leadfeeder CEO\n
\n

\n “Brad single-handedly translated our tech solution into a business problem solution for line of business owners. Pivotal moment.”\n
\n - Mike Miller, Cloudant co-founder, partner at Liquid 2 Ventures\n
\n

\n\n---\n\n## Availability\n\nI'm booked 3 days per week right now. Grab a spot on my calendar.\n\n{{gate:calendar}}",[],[36,243],"da0c33bf-dd01-47e0-82f6-ecd15732bd8f","calendar.md","495b98ac-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-b4ca08beac5b",["D",1789038102875],"---\nbutton: Submit\nfallback: Don't use Google for email? Use your email address instead\n---\n\n\n\n

\n\n

\n\nIf my calendar isn't embedded in the page,\n[visit it directly](https://calendar.google.com/calendar/appointments/schedules/AcZssZ18hnwEHvVR_DDPrq_2FsDuoFKGdNOGze_NizHosyg1yKpBqNOE6YEuIO1tGg0_jq6DStuTf5Mj).",[],[36,259,252],"gates","4fc79300-b39f-4abb-9c6f-c904a2d63c58",["D",1788952323787],[199],[36,259],["D",1788952323787],[198,200,201],[36],"95be9f8d-27d2-4f82-9750-6ea57a23364d","preview-parking.http.ts","65a38254-ac3f-11f1-8290-1607ee4eb77e",3,["D",1788952371320],"http","// Holds the {valname}-preview subdomain while no branch is being previewed.\n// Pointed here by the merge-branch skill when a preview branch is merged & deleted;\n// start-branch moves the subdomain back onto a live branch's HTTP entry.\nexport default () =>\n new Response(\n [\n \"No branch is currently in preview.\",\n \"\",\n \"This URL follows the branch under active development. It's idle because the\",\n \"last preview branch was merged and deleted. Start a new branch (the start-branch\",\n \"rail) to point this URL at it again.\",\n ].join(\"\\n\"),\n { status: 200, headers: { \"content-type\": \"text/plain; charset=utf-8\" } },\n );\n","lightweightindustries-preview",[],[156,268],"45498dfe-f270-4748-98bf-2dd0f692d11b","index.http.ts",["D",1788953809222],"import { Hono } from \"npm:hono@4.11.9\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport pages from \"./routes/pages.ts\";\nimport api from \"./routes/api.ts\";\nimport auth from \"./routes/auth.ts\";\nimport mcp from \"./routes/mcp.ts\";\n\nconst app = new Hono();\n\n// All registered BEFORE the page routes: `pages` owns \"/:slug\", which would\n// otherwise swallow these paths and 404 them as missing content files.\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.route(\"/api\", api);\napp.route(\"/auth\", auth);\napp.route(\"/mcp\", mcp);\n\napp.route(\"/\", pages);\n\n// Let uncaught exceptions reach the Val Town log instead of being swallowed.\napp.onError((err) => Promise.reject(err));\n\n// Hono exports `app.fetch`, never `app`.\nexport default app.fetch;\n",[],[156,278],"4d7ef298-fca6-4305-bd87-6526041ad7b4","slug.ts","beddc05c-ac42-11f1-aac6-1607ee4eb77e","01a085de-26c9-705c-866d-ae7e6a176e09",["D",1788953809222],"/**\n * Content slugs. Backend-only pure helper: no I/O, no business decisions.\n *\n * Extracted out of `page.controller.ts` on its SECOND consumer (the MCP tools),\n * per the house rule — not in anticipation of one.\n */\n\n/**\n * Reduce anything to a flat, safe content slug.\n *\n * This is also what closes path traversal: the result can only ever name a\n * file sitting directly inside a content directory, never a path that climbs\n * out of one. Every caller that builds a content path from caller-supplied\n * text must go through here first.\n */\nexport function toSafeSlug(slug: string): string {\n return slug.trim().toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n}\n",[],[156,291,284],"utils","75266379-5f2e-4856-afc8-ad7688172a7a","markdown.ts","495b9276-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { marked } from \"npm:marked@18.0.12\";\n\n/**\n * Markdown → HTML. Backend-only pure helper: no I/O, no business decisions.\n *\n * `npm:` is correct here because this only ever runs in Deno. If this render\n * ever has to happen in the browser too, it moves to `shared/` and the\n * specifier becomes `https://esm.sh/marked@18.0.12`.\n */\nexport function renderMarkdown(markdown: string): string {\n return marked.parse(markdown, { async: false }) as string;\n}\n",[],[156,291,293],"7263ee6a-4395-4197-b3e1-49f8703a0b76","layout.ts","495b848e-ac3f-11f1-8027-1607ee4eb77e",["D",1789038102875],"import { escapeHtml } from \"./html.ts\";\n\n/**\n * The HTML shell. Backend-only pure helper — server-rendered, so the browser\n * receives finished markup rather than an empty div a script has to fill.\n * That is the whole reason the public site is not a React SPA: `title` and\n * `description` below are in the source a crawler reads.\n */\n\nconst PICO_CSS =\n \"https://cdn.jsdelivr.net/npm/@picocss/pico@2/css/pico.min.css\";\n\nexport interface LayoutInput {\n title: string;\n description: string;\n /** Trusted, already-rendered HTML. Injected unescaped. */\n html: string;\n /** External scripts this page asked for. Usually empty. */\n scripts?: string[];\n}\n\nexport function renderLayout(\n { title, description, html, scripts = [] }: LayoutInput,\n): string {\n // Loaded after the markup so Google's script finds its target elements\n // already in the DOM.\n const tags = scripts\n .map((src) => ` `)\n .join(\"\\n\");\n\n return `\n\n \n \n \n ${escapeHtml(title)}\n \n \n \n \n \n \n \n \n \n

\n lightweight\n

\n${html}\n

\n \n${tags}\n \n\n`;\n}",[],[156,291,300],"932bb45b-8c24-4c59-9ca8-ac4df0ede94d","html.ts","495b7ef8-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"/** Escape a string for interpolation into HTML. Backend-only pure helper. */\nexport function escapeHtml(value: string): string {\n return value\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\");\n}\n",[],[156,291,307],"0f74d50e-3143-4d11-9473-f25cb453e901",["D",1789042182523],[],[156,291,33],"811c4125-d8ec-4bd5-9b8b-6dd7b6c76cf4","frontmatter.ts","495b4b86-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"/**\n * Split a leading `---` frontmatter block off a markdown document.\n *\n * Backend-only pure helper: no I/O, no business decisions.\n *\n * ⚠️ The trap this exists to avoid: our content uses `---` as a horizontal\n * rule BETWEEN sections, so a parser that splits the document on every `---`\n * eats half the page. Only a fence on line 1 opens frontmatter, and only the\n * FIRST fence after it closes the block. Everything past that is body,\n * horizontal rules included.\n */\n\nexport interface ParsedDocument {\n data: Record;\n body: string;\n}\n\nconst FENCE = \"---\";\n\nexport function parseFrontmatter(raw: string): ParsedDocument {\n const lines = raw.split(/\\r?\\n/);\n\n // No opening fence on line 1 → the whole document is body.\n if (lines[0]?.trim() !== FENCE) return { data: {}, body: raw };\n\n let closingLine = -1;\n for (let i = 1; i < lines.length; i++) {\n if (lines[i].trim() === FENCE) {\n closingLine = i;\n break;\n }\n }\n\n // Unterminated block → treat the document as body rather than swallowing it.\n if (closingLine === -1) return { data: {}, body: raw };\n\n const data: Record = {};\n for (const line of lines.slice(1, closingLine)) {\n if (!line.trim() || line.trimStart().startsWith(\"#\")) continue;\n\n const separator = line.indexOf(\":\");\n if (separator === -1) continue;\n\n const key = line.slice(0, separator).trim();\n if (!key) continue;\n\n let value = line.slice(separator + 1).trim();\n const quoted = (value.startsWith('\"') && value.endsWith('\"')) ||\n (value.startsWith(\"'\") && value.endsWith(\"'\"));\n if (quoted && value.length >= 2) value = value.slice(1, -1);\n\n data[key] = value;\n }\n\n return { data, body: lines.slice(closingLine + 1).join(\"\\n\") };\n}\n",[],[156,291,318],"032dd2d7-a6c0-43c7-9cb8-178a12880f6b",["D",1788952323787],[189,190,191,192,193,194],[156,291],"060d1a09-6240-4071-b6f9-58a9661b4466","registration.types.ts","61ee55d0-ac58-11f1-9896-1607ee4eb77e","01a085de-26c9-705c-866d-a96c4be70635",6,["D",1788963102513],"/**\n * A captured registration, shaped for the Notion row it becomes.\n *\n * Shared by the gate controller (which builds it) and the Notion service\n * (which writes it), so it lives here rather than in either one.\n *\n * ⚠️ \"Registration\", NOT \"lead\". A row is written every time someone\n * identifies themselves at a gate, so this is an EVENT — while \"lead\" is a\n * person-noun, and that mismatch is what made repeat sign-ins look like a bug\n * in the write path. A person-noun belongs to the DERIVED table that dedupes\n * these, not to this one.\n *\n * \"Registration\" is also the only nearby word that doesn't claim the address\n * was verified: registering is by definition putting your own name down.\n * \"Login\" and \"sign-in\" would be true of the Google path and false of the\n * typed one. `source` is what records the difference.\n */\nexport interface RegistrationCapture {\n /**\n * The Notion title. Google's display name when we have it, otherwise the\n * address — the typed path has no name, and a row reading \"Untitled\" is\n * worse than a row titled by email.\n */\n name: string;\n givenName: string | null;\n familyName: string | null;\n email: string;\n /**\n * Google Workspace host domain (the `hd` claim) — `acme.com`.\n *\n * Deliberately NOT called \"company\": it is a domain, not a company name.\n * Null for personal Google accounts and for every typed submission.\n */\n domain: string | null;\n gate: string;\n /**\n * How the address arrived. `google` means Google returned it; `typed` means\n * a human typed it and it could be anything.\n */\n source: \"google\" | \"typed\";\n}\n",[],[156,226,329],"ac7be3d3-6e73-43fc-ae2a-48bcec3159fc",["D",1788952323787],[187],[156,226],"e72d6542-e47d-49e2-b077-08d5f1281dfe","notion.service.ts","495b2bc4-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-a7fe58e12594",["D",1788963102513],"import { Client } from \"npm:@notionhq/client@5.26.0\";\nimport type { RegistrationCapture } from \"../types/registration.types.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Records a registration in Notion. One external API, no business decisions,\n * never throws.\n *\n * The database is an append-only EVENT log — one row per time someone\n * identified themselves at a gate. It is deliberately never read or updated\n * here: deduping into people is a separate, derived concern, and keeping this\n * write-only is what stops an unverified typed submission from ever mutating\n * a row that Google verified.\n */\n\n/**\n * ⚠️ SDK v5 splits `database_id` from `data_source_id`, and `pages.create`\n * needs the DATA SOURCE. The id copied out of a Notion URL is the database, so\n * we resolve it here and the operator never has to know the difference.\n * It lives at `data_sources[0].id` — not `.data_source_id`.\n */\nlet cachedDataSourceId: string | null = null;\n\nasync function resolveDataSourceId(\n notion: Client,\n databaseId: string,\n): Promise {\n if (cachedDataSourceId) return cachedDataSourceId;\n\n const database = await notion.databases.retrieve({ database_id: databaseId });\n const id = (database as { data_sources?: { id: string }[] })\n .data_sources?.[0]?.id;\n\n if (!id) throw new Error(`Database ${databaseId} exposes no data source`);\n\n cachedDataSourceId = id;\n return id;\n}\n\n/** Notion rich_text wants an array; an empty one renders as a blank cell. */\nfunction text(value: string | null) {\n return value\n ? { rich_text: [{ type: \"text\" as const, text: { content: value } }] }\n : { rich_text: [] };\n}\n\nexport async function recordRegistration(\n registration: RegistrationCapture,\n): Promise> {\n const auth = Deno.env.get(\"NOTION_API_KEY\");\n const databaseId = Deno.env.get(\"REGISTRATIONS_DATABASE_ID\");\n\n if (!auth || !databaseId) {\n // Not wired up yet. Log the address so it is recoverable from the val log\n // rather than silently lost.\n console.warn(\n `[registrations] Notion not configured — UNRECORDED: ${registration.email} (gate: ${registration.gate})`,\n );\n return createErrorResponse(\n \"Notion is not configured (needs NOTION_API_KEY and REGISTRATIONS_DATABASE_ID)\",\n 503,\n );\n }\n\n try {\n const notion = new Client({ auth });\n const dataSourceId = await resolveDataSourceId(notion, databaseId);\n\n await notion.pages.create({\n parent: { type: \"data_source_id\", data_source_id: dataSourceId },\n properties: {\n Name: {\n title: [{ type: \"text\", text: { content: registration.name } }],\n },\n Email: { email: registration.email },\n \"Given name\": text(registration.givenName),\n \"Family name\": text(registration.familyName),\n Domain: text(registration.domain),\n Gate: { select: { name: registration.gate } },\n Source: { select: { name: registration.source } },\n },\n } as Parameters[0]);\n\n return createSuccessResponse({ recorded: true });\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n console.error(\n `[registrations] Notion write FAILED — ${registration.email} (gate: ${registration.gate}): ${detail}`,\n );\n return createErrorResponse(`Notion write failed: ${detail}`, 502);\n }\n}\n",[],[156,349,342],"services","c74f541b-d740-4df0-b009-5557bdb6c339","google.oauth.service.ts","495b0e8c-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Google Identity Services — the popup account chooser.\n *\n * The browser gets the branded button from Google's own script; Google then\n * POSTs a signed ID token to our endpoint. NOT Val Town's `std/oauth`, which\n * gates on a VAL TOWN account a visitor does not have.\n */\n\nconst TOKENINFO = \"https://oauth2.googleapis.com/tokeninfo\";\nconst VALID_ISSUERS = [\"accounts.google.com\", \"https://accounts.google.com\"];\n\nexport interface GoogleProfile {\n email: string;\n emailVerified: boolean;\n name: string | null;\n givenName: string | null;\n familyName: string | null;\n /**\n * The `hd` claim — a Google Workspace account's host domain, e.g. `acme.com`.\n * Absent for personal accounts, and its absence is itself signal.\n */\n domain: string | null;\n /** Google's stable user id. The only safe identity key — an address can move. */\n subject: string;\n}\n\nexport function getGoogleClientId(): string | null {\n return Deno.env.get(\"GOOGLE_CLIENT_ID\") ?? null;\n}\n\nexport function isGoogleConfigured(): boolean {\n return Boolean(getGoogleClientId());\n}\n\n/**\n * Verify an ID token that arrived FROM THE BROWSER.\n *\n * ⚠️ Signature verification is mandatory here, unlike a server-to-server code\n * exchange: the token passed through the client, so anything in it is\n * attacker-controlled until Google says otherwise.\n *\n * Uses Google's tokeninfo endpoint rather than local RS256 + JWKS caching:\n * one network hop per sign-in, no crypto code and no key rotation to get\n * wrong. That is the right trade at this site's volume. If sign-ins ever get\n * frequent enough for the hop to matter, verify locally instead.\n */\nexport async function verifyIdToken(\n credential: string,\n): Promise> {\n const clientId = getGoogleClientId();\n if (!clientId) {\n return createErrorResponse(\"GOOGLE_CLIENT_ID is not set\", 503);\n }\n\n try {\n const response = await fetch(\n `${TOKENINFO}?id_token=${encodeURIComponent(credential)}`,\n );\n\n // tokeninfo returns 400 for a bad signature, a malformed token, or one\n // that has expired — so this single check covers all three.\n if (!response.ok) {\n return createErrorResponse(\n `Google rejected the ID token (${response.status})`,\n 401,\n );\n }\n\n const claims = await response.json() as Record;\n\n // tokeninfo proves the token is genuine; it does NOT prove it was minted\n // for US. Without this check, a valid token issued to any other Google\n // app would be accepted here.\n if (claims.aud !== clientId) {\n return createErrorResponse(\"ID token was issued for another app\", 401);\n }\n if (!VALID_ISSUERS.includes(String(claims.iss))) {\n return createErrorResponse(`Unexpected issuer: ${claims.iss}`, 401);\n }\n\n const email = typeof claims.email === \"string\" ? claims.email : null;\n const subject = typeof claims.sub === \"string\" ? claims.sub : null;\n if (!email || !subject) {\n return createErrorResponse(\"ID token carried no email\", 401);\n }\n\n const str = (key: string): string | null =>\n typeof claims[key] === \"string\" && claims[key] ? claims[key] as string : null;\n\n return createSuccessResponse({\n email,\n subject,\n name: str(\"name\"),\n givenName: str(\"given_name\"),\n familyName: str(\"family_name\"),\n domain: str(\"hd\"),\n // tokeninfo stringifies booleans.\n emailVerified: String(claims.email_verified) === \"true\",\n });\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not reach Google: ${detail}`, 502);\n }\n}\n",[],[156,349,351],"7c8e686e-8aff-497a-9343-7749bd0638f8","content.service.ts","495b019e-ac3f-11f1-8027-1607ee4eb77e",["D",1788953809222],"import {\n listFilesByPath,\n readFile,\n} from \"https://esm.town/v/std/utils/index.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Where content comes from.\n *\n * This is a SERVICE, not a util, even though v1's content is \"just files\":\n * Val Town has no filesystem, so `readFile` is a Val Town API call — real I/O.\n *\n * It is also the seam. When content moves to Notion or a CMS, this file is the\n * only one that changes; the controller, the renderer, and the routes never\n * learn the difference.\n *\n * `import.meta.url` is passed explicitly so a branch reads ITS OWN content\n * files rather than whatever `main` happens to be serving.\n */\nexport async function getContentFile(\n path: string,\n): Promise> {\n try {\n const raw = await readFile(path, import.meta.url);\n return createSuccessResponse(raw);\n } catch (error) {\n // Services never throw — `readFile` does, on a missing file.\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not read \"${path}\": ${detail}`, 404);\n }\n}\n\n/**\n * The slugs of the markdown files directly inside one content directory.\n *\n * ONE API call by design: this deliberately does not open each file to read a\n * title out of its frontmatter. An MCP tool callback is killed a few seconds\n * after its response flushes, so a listing that read N files would start dying\n * partway through as the site grows — and it would fail silently, mid-loop.\n * Callers that want a title read the one file they care about.\n *\n * Listing is filtered to the directory's OWN files, because the underlying\n * call may descend into subdirectories — without this, `content` would report\n * the gates in `content/gates` as if they were pages.\n */\nexport async function listContentFiles(\n dir: string,\n): Promise> {\n const prefix = dir.replace(/^\\/+|\\/+$/g, \"\");\n\n try {\n const files = await listFilesByPath(dir, import.meta.url);\n const slugs = files\n .map((file) => file.path.replace(/^\\/+/, \"\"))\n .filter((path) => path.endsWith(\".md\"))\n .filter((path) => path.startsWith(`${prefix}/`))\n .map((path) => path.slice(prefix.length + 1))\n .filter((name) => !name.includes(\"/\"))\n .map((name) => name.replace(/\\.md$/, \"\"))\n .sort();\n return createSuccessResponse(slugs);\n } catch (error) {\n const detail = error instanceof Error ? error.message : String(error);\n return createErrorResponse(`Could not list \"${dir}\": ${detail}`, 404);\n }\n}\n",[],[156,349,358],"2541e365-1496-4118-b1df-0f30f4b1fbab",["D",1788952323787],[183,184,185],[156,349],"e4fac905-57c4-438b-810e-92efff3d1ca9","pages.ts","495af712-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-a22a2b29fc5e",["D",1788952323787],"import { type Context, Hono } from \"npm:hono@4.11.9\";\nimport { getCookie } from \"npm:hono@4.11.9/cookie\";\nimport { getPage, type Viewer } from \"../controllers/page.controller.ts\";\nimport { renderLayout } from \"../utils/layout.ts\";\nimport { UNLOCK_COOKIE } from \"../utils/gate.ts\";\nimport type { ContentfulStatusCode } from \"npm:hono@4.11.9/utils/http-status\";\n\n/**\n * Public HTML routes. Thin wrappers: extract, call the controller, map\n * `success === false` to a status, return a Response. No business logic — the\n * route reads the cookie but never decides what it means.\n */\nconst pages = new Hono();\n\n/** Cookies, query params and origin are HTTP concerns — the ROUTE extracts them. */\nfunction viewerFrom(c: Context): Viewer {\n const error = c.req.query(\"error\");\n return {\n email: getCookie(c, UNLOCK_COOKIE) ?? null,\n error: error === \"email\" || error === \"google\" ? error : null,\n // Derived, never hardcoded — the same code serves preview, production and\n // the custom domain.\n origin: new URL(c.req.url).origin,\n };\n}\n\nasync function servePage(c: Context, slug: string) {\n const result = await getPage(slug, viewerFrom(c));\n\n if (!result.success) {\n return c.html(\n renderLayout({\n title: \"Not found\",\n description: \"\",\n html:\n `

Not found

\\n

${result.error}

\\n

Home

`,\n }),\n result.status as ContentfulStatusCode,\n );\n }\n\n return c.html(\n renderLayout({\n title: result.data.title,\n description: result.data.description,\n html: result.data.html,\n scripts: result.data.scripts,\n }),\n );\n}\n\npages.get(\"/\", (c) => servePage(c, \"home\"));\npages.get(\"/:slug\", (c) => servePage(c, c.req.param(\"slug\")));\n\nexport default pages;\n",[],[156,376,369],"routes","2160fddc-da6b-4a4d-9ddc-baa7088e94f3","mcp.ts","bedd91ea-ac42-11f1-aac6-1607ee4eb77e",["D",1788953809222],"import { Hono } from \"npm:hono@4.11.9\";\nimport {\n createMcpHandler,\n McpServer,\n} from \"npm:@modelcontextprotocol/server@2\";\nimport * as z from \"npm:zod@4/v4\";\nimport {\n type ContentKind,\n listContent,\n readContent,\n} from \"../controllers/content.controller.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\n\n/**\n * The MCP door.\n *\n * A ROUTE in the 3-layer sense: it extracts arguments, calls a controller, and\n * shapes the answer. No business logic lives here — which is why the tools can\n * stay this thin, and why the same controllers could serve an HTTP route later\n * without either door learning about the other.\n *\n * Built on `@modelcontextprotocol/server@2` (the v2 TypeScript SDK, MCP 2.0 /\n * the 2026-07-28 spec, still serving legacy clients), which is what Val Town's\n * own `templates/mcp-server` now uses. The older `@hono/mcp` +\n * `@modelcontextprotocol/sdk@1.x` wiring is superseded: `createMcpHandler`\n * owns the transport, its factory callback is the per-request build, and\n * `inputSchema` takes a real `z.object(...)` rather than a raw Zod shape.\n */\n\n/**\n * ⚠️ AUTH IS OURS, and it has to be.\n *\n * The house pattern gates `/mcp` at the Val Town edge with\n * `httpPrivacy: restricted` plus a bypass token — and that is unavailable to\n * us, twice over. This val is going PUBLIC because it serves the marketing\n * site, which removes the edge gate entirely; and the edge strips its own\n * token before any handler runs, so we could not check it even while\n * restricted. So the guard below is the only thing between the internet and\n * these tools once the privacy flip lands.\n */\nconst TOKEN_VAR = \"MCP_TOKEN\";\n\n/** Pull the token out of `Authorization: Bearer `, or \"\" if absent. */\nfunction presentedToken(header: string | undefined): string {\n if (!header) return \"\";\n const [scheme, ...rest] = header.split(\" \");\n return scheme.toLowerCase() === \"bearer\" ? rest.join(\" \").trim() : \"\";\n}\n\n/**\n * Compare every byte even after a mismatch, so response time doesn't leak how\n * much of the token was guessed correctly. Length is still observable; that is\n * the standard trade and it reveals nothing useful about a random secret.\n */\nfunction tokenMatches(presented: string, expected: string): boolean {\n if (presented.length !== expected.length) return false;\n let difference = 0;\n for (let index = 0; index < presented.length; index++) {\n difference |= presented.charCodeAt(index) ^ expected.charCodeAt(index);\n }\n return difference === 0;\n}\n\n/** Every tool answers in one shape, so a failure never looks like a result. */\nfunction toolResult(result: ServiceResponse) {\n if (!result.success) {\n return {\n isError: true,\n content: [{ type: \"text\" as const, text: result.error }],\n };\n }\n return {\n content: [\n { type: \"text\" as const, text: JSON.stringify(result.data, null, 2) },\n ],\n };\n}\n\nconst handler = createMcpHandler(() => {\n const server = new McpServer({\n name: \"lightweightindustries\",\n version: \"1.0.0\",\n });\n\n server.registerTool(\n \"list_content\",\n {\n title: \"List content\",\n description:\n \"Lists what the site is made of: page slugs and gate names, read from this val's own `content/` directory. A gate is the block on a page that trades a visitor's email address for something hidden behind it. Returns names only — read one file with `read_content` to see its text.\",\n inputSchema: z.object({}),\n annotations: { title: \"List content\", readOnlyHint: true },\n },\n async () => toolResult(await listContent()),\n );\n\n server.registerTool(\n \"read_content\",\n {\n title: \"Read content\",\n description:\n \"Returns one page or gate exactly as written, frontmatter and gate tokens intact. Use for reading before an edit: this is the markdown source, not the rendered HTML a visitor sees, and it resolves no gates. Needs a `slug` from `list_content`.\",\n inputSchema: z.object({\n slug: z\n .string()\n .describe(\n \"File name without `.md`, e.g. `home` or `calendar`. Get one from `list_content`.\",\n ),\n kind: z\n .enum([\"page\", \"gate\"])\n .optional()\n .describe(\n \"Which directory to read from: `page` for `content/`, `gate` for `content/gates/`. Omit to read a page.\",\n ),\n }),\n annotations: { title: \"Read content\", readOnlyHint: true },\n },\n async ({ slug, kind }) =>\n toolResult(await readContent(slug, (kind ?? \"page\") as ContentKind)),\n );\n\n return server;\n});\n\nconst mcp = new Hono();\n\nmcp.all(\"/\", async (c) => {\n const expected = Deno.env.get(TOKEN_VAR);\n\n // Fail CLOSED. With no secret configured there is no way to tell the\n // operator from the internet, and this sits on the same public origin as\n // the marketing page.\n if (!expected) {\n console.error(`[mcp] ${TOKEN_VAR} is not set — refusing every request`);\n return c.json({ error: \"MCP surface is not configured\" }, 503);\n }\n\n if (!tokenMatches(presentedToken(c.req.header(\"authorization\")), expected)) {\n return c.json({ error: \"Unauthorized\" }, 401);\n }\n\n // The handler is shaped to be a val's default export, so it normally sits at\n // the origin root. Handing it the raw request unchanged is the simple case;\n // if it turns out to route on pathname and rejects `/mcp`, the fix is to\n // rewrite the URL to \"/\" before passing it through.\n return await handler.fetch(c.req.raw);\n});\n\nexport default mcp;\n",[],[156,376,378],"ce7dcf6c-b34e-4548-8011-45d5f7b04282","auth.ts","495ae2ea-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { Hono } from \"npm:hono@4.11.9\";\nimport { deleteCookie, getCookie, setCookie } from \"npm:hono@4.11.9/cookie\";\nimport { unlockGateWithGoogle } from \"../controllers/gate.controller.ts\";\nimport { gateAnchorId, UNLOCK_COOKIE } from \"../utils/gate.ts\";\n\nconst auth = new Hono();\n\n/**\n * Google Identity Services posts the signed ID token here after the visitor\n * picks an account in the popup.\n *\n * ⚠️ This path must EXACTLY match an authorized redirect URI on the OAuth\n * client, and match `data-login_uri` on the page, or Google refuses to post.\n */\nauth.post(\"/google/callback\", async (c) => {\n const form = await c.req.parseBody();\n\n const credential = String(form.credential ?? \"\");\n const postedCsrf = String(form.g_csrf_token ?? \"\");\n const cookieCsrf = getCookie(c, \"g_csrf_token\");\n\n // Which gate they clicked, carried in the button's data-state attribute.\n const gate = String(form.state ?? \"\").toLowerCase().replace(/[^a-z0-9-]/g, \"\") ||\n \"calendar\";\n const anchor = `#${gateAnchorId(gate)}`;\n\n // Google's double-submit CSRF check: it sets the same random value as both\n // a cookie and a body field. A mismatch means this POST didn't come from\n // the sign-in we rendered.\n if (!credential || !postedCsrf || postedCsrf !== cookieCsrf) {\n console.warn(\"[auth] Google callback rejected: CSRF token mismatch\");\n return c.redirect(`/?error=google${anchor}`, 303);\n }\n\n const result = await unlockGateWithGoogle(credential, gate);\n\n if (!result.success) {\n console.error(`[auth] Google sign-in failed: ${result.error}`);\n return c.redirect(`/?error=google${anchor}`, 303);\n }\n\n setCookie(c, UNLOCK_COOKIE, result.data.email, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 365,\n });\n\n // Land them back on the gate, looking at what they just unlocked.\n return c.redirect(`/${anchor}`, 303);\n});\n\n/**\n * Forget this visitor and put the gates back.\n *\n * Not a nicety: without it the unlock cookie is httpOnly and lasts a year, so\n * whoever unlocks a gate — the site's own author included — can never see that\n * gate again. It is also the honest thing to offer anyone on a shared machine.\n *\n * GET rather than POST so it can be a plain link. The worst a stray prefetch\n * can do is sign someone out, which costs them one click.\n */\nauth.get(\"/reset\", (c) => {\n deleteCookie(c, UNLOCK_COOKIE, { path: \"/\" });\n return c.redirect(\"/\", 303);\n});\n\nexport default auth;\n",[],[156,376,385],"f9a5a427-4915-49b2-b5b8-8776a2ef2cf3","api.ts","495ad516-ac3f-11f1-8027-1607ee4eb77e",["D",1788952323787],"import { Hono } from \"npm:hono@4.11.9\";\nimport { setCookie } from \"npm:hono@4.11.9/cookie\";\nimport { unlockGate } from \"../controllers/gate.controller.ts\";\nimport { gateAnchorId, UNLOCK_COOKIE } from \"../utils/gate.ts\";\n\nconst api = new Hono();\n\n/**\n * A plain form POST — no JavaScript involved. Post, redirect, re-render.\n * 303 rather than 302 so the browser follows with GET and a reload doesn't\n * resubmit the form.\n *\n * The redirect carries a fragment so the visitor lands back ON the gate\n * instead of at the top of the page, hunting for what they just unlocked.\n */\napi.post(\"/unlock\", async (c) => {\n const form = await c.req.parseBody();\n const gate = String(form.gate ?? \"\").toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n const anchor = gate ? `#${gateAnchorId(gate)}` : \"\";\n\n const result = await unlockGate(String(form.email ?? \"\"), gate);\n\n if (!result.success) {\n // Query string before the fragment, or the browser reads the whole tail\n // as part of the fragment and the error is never seen.\n return c.redirect(`/?error=email${anchor}`, 303);\n }\n\n setCookie(c, UNLOCK_COOKIE, result.data.email, {\n path: \"/\",\n httpOnly: true,\n secure: true,\n sameSite: \"Lax\",\n maxAge: 60 * 60 * 24 * 365,\n });\n\n return c.redirect(`/${anchor}`, 303);\n});\n\nexport default api;\n",[],[156,376,392],"ef6aa159-7970-4f5d-88d3-c3eff6d43af7",["D",1788952323787],[178,179,180,181],[156,376],"3a87a817-b62c-474d-b155-8b2fdf12d61f","page.controller.ts","495aa7bc-ac3f-11f1-8027-1607ee4eb77e","01a085de-26c9-705c-866d-9fe98c62773e",["D",1789038102875],"import { getContentFile } from \"../services/content.service.ts\";\nimport { getGoogleClientId } from \"../services/google.oauth.service.ts\";\nimport { parseFrontmatter } from \"../utils/frontmatter.ts\";\nimport { renderMarkdown } from \"../utils/markdown.ts\";\nimport { toSafeSlug } from \"../utils/slug.ts\";\nimport {\n findGateNames,\n type GateError,\n GSI_SCRIPT,\n renderGatePrompt,\n renderUnlockedNote,\n replaceGate,\n wrapGate,\n} from \"../utils/gate.ts\";\nimport type { PageView, ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/** What the route knows about whoever is asking. */\nexport interface Viewer {\n /** The address they already traded, or null. */\n email: string | null;\n /** Their last attempt failed, so the prompt should say so. */\n error?: GateError;\n /** Absolute origin of this request — Google needs an absolute login_uri. */\n origin: string;\n}\n\n/**\n * Resolve a slug to a rendered page.\n *\n * Returns `ServiceResponse` rather than an HTTP `Response` on\n * purpose: that is what lets an MCP tool handler call this exact function\n * later without a route in front of it.\n */\nexport async function getPage(\n slug: string,\n viewer: Viewer,\n): Promise> {\n // Validation is the controller's job. `toSafeSlug` also closes path\n // traversal — a slug can only ever be a flat name inside content/.\n const safeSlug = toSafeSlug(slug);\n if (!safeSlug) return createErrorResponse(\"Invalid page slug\", 404);\n\n const file = await getContentFile(`/content/${safeSlug}.md`);\n if (!file.success) {\n // Wrap the service error with context rather than leaking its wording.\n return createErrorResponse(`No page named \"${safeSlug}\"`, 404);\n }\n\n const { data, body } = parseFrontmatter(file.data);\n let html = renderMarkdown(body);\n\n const clientId = getGoogleClientId();\n const scripts: string[] = [];\n let onloadEmitted = false;\n\n // Whether a gate opens is a business decision, so it happens HERE — not in\n // the route, and not in the renderer.\n for (const name of new Set(findGateNames(html))) {\n const gate = await resolveGate(name, viewer, clientId, !onloadEmitted);\n\n if (gate.renderedGoogle) {\n // Exactly one #g_id_onload per page, and Google's script pulled in only\n // when something on the page actually needs it.\n onloadEmitted = true;\n if (!scripts.includes(GSI_SCRIPT)) scripts.push(GSI_SCRIPT);\n }\n\n // Wrapped in both states, locked and unlocked, so the anchor an unlock\n // redirects to exists on the page it lands on.\n html = replaceGate(html, name, wrapGate(name, gate.html));\n }\n\n return createSuccessResponse({\n slug: safeSlug,\n title: data.title ?? safeSlug,\n description: data.description ?? \"\",\n html,\n scripts,\n });\n}\n\ninterface ResolvedGate {\n html: string;\n renderedGoogle: boolean;\n}\n\nasync function resolveGate(\n name: string,\n viewer: Viewer,\n clientId: string | null,\n includeOnload: boolean,\n): Promise {\n const file = await getContentFile(`/content/gates/${name}.md`);\n\n if (!file.success) {\n // A page referencing a gate that doesn't exist is our bug, not the\n // visitor's problem — log it and render nothing rather than show a token.\n console.error(`[gate] page references missing gate file \"${name}\"`);\n return { html: \"\", renderedGoogle: false };\n }\n\n const { data, body } = parseFrontmatter(file.data);\n\n // Already paid — hand over the reward, plus a way back out. Without that\n // way out an unlock is permanent and invisible, and nobody (author\n // included) can ever see the gate again.\n if (viewer.email) {\n return {\n // The note comes FIRST: it says whose view this is before handing over\n // what they unlocked, rather than as a footnote after a 600px embed.\n //\n // The body is rendered as written. Which PART of a reward is a card is a\n // content decision, not one for this layer — the calendar gate wraps its\n // embed in an article itself and leaves the fallback line outside it.\n html: `${renderUnlockedNote(viewer.email)}\\n${renderMarkdown(body)}`,\n renderedGoogle: false,\n };\n }\n\n return {\n html: renderGatePrompt({\n name,\n // No default: a gate says nothing unless its file asks it to. Prose\n // belongs in the page around the token, not inside the gate.\n prompt: data.prompt,\n // A default here only so a half-written gate still has a usable button.\n button: data.button ?? \"Continue\",\n fallback: data.fallback ?? \"Use your email instead\",\n // No default: a gate that sets nothing shows nothing.\n assurance: data.assurance,\n googleClientId: clientId,\n loginUri: `${viewer.origin}/auth/google/callback`,\n includeOnload,\n error: viewer.error ?? null,\n }),\n renderedGoogle: Boolean(clientId),\n };\n}\n",[],[156,410,403],"controllers","b4410259-b7ee-4d5b-b75b-fc5c1a0217dc","gate.controller.ts","495a6676-ac3f-11f1-8027-1607ee4eb77e",["D",1788963102513],"import { recordRegistration } from \"../services/notion.service.ts\";\nimport { verifyIdToken } from \"../services/google.oauth.service.ts\";\nimport type { RegistrationCapture } from \"../types/registration.types.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\nexport interface Unlocked {\n email: string;\n gate: string;\n}\n\n/** Deliberately loose — this is a shape check, not address verification. */\nconst EMAIL_SHAPE = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n\nfunction normaliseGate(raw: string): string {\n return raw.trim().toLowerCase().replace(/[^a-z0-9-]/g, \"\");\n}\n\n/**\n * The typed-email fallback path. No name and no domain — whoever is at the\n * keyboard typed a string, and it could be anything.\n */\nexport async function unlockGate(\n rawEmail: string,\n rawGate: string,\n): Promise> {\n const email = rawEmail.trim().toLowerCase();\n const gate = normaliseGate(rawGate);\n\n if (!EMAIL_SHAPE.test(email)) {\n return createErrorResponse(\"That doesn't look like an email address\", 400);\n }\n if (!gate) return createErrorResponse(\"Missing gate name\", 400);\n\n return finishUnlock({\n // No name to use, so the address becomes the title. Better than \"Untitled\".\n name: email,\n givenName: null,\n familyName: null,\n email,\n domain: null,\n gate,\n source: \"typed\",\n });\n}\n\n/**\n * The DEFAULT path: they picked an account in Google's popup, so the address\n * arrives with a real name attached and, for Workspace accounts, their domain.\n */\nexport async function unlockGateWithGoogle(\n credential: string,\n rawGate: string,\n): Promise> {\n const gate = normaliseGate(rawGate);\n if (!gate) return createErrorResponse(\"Missing gate name\", 400);\n\n const profile = await verifyIdToken(credential);\n if (!profile.success) {\n return createErrorResponse(`Google sign-in failed: ${profile.error}`, 401);\n }\n\n const google = profile.data;\n\n // ⚠️ `email_verified` is not the whole story. Google is authoritative only\n // for @gmail.com addresses and for Workspace accounts (where `hd` is set).\n // Otherwise the address was verified once at signup and that third-party\n // mailbox may have changed hands since. `Source: google` is a strong signal,\n // not a guarantee.\n if (!google.emailVerified) {\n console.warn(\n `[gate] Google returned an UNVERIFIED address: ${google.email}`,\n );\n }\n\n return finishUnlock({\n name: google.name ?? google.email,\n givenName: google.givenName,\n familyName: google.familyName,\n email: google.email,\n domain: google.domain,\n gate,\n source: \"google\",\n });\n}\n\n/**\n * Record the registration, then open the gate either way.\n *\n * Deliberate: a misconfiguration on OUR side must not cost the visitor the\n * thing they just traded for. The address is in the val log regardless, so it\n * is recoverable — unlike the goodwill of a form that eats a submission.\n */\nasync function finishUnlock(\n registration: RegistrationCapture,\n): Promise> {\n const recorded = await recordRegistration(registration);\n\n if (!recorded.success) {\n console.warn(\n `[gate] unlocking \"${registration.gate}\" for ${registration.email} despite: ${recorded.error}`,\n );\n }\n\n return createSuccessResponse({\n email: registration.email,\n gate: registration.gate,\n });\n}\n",[],[156,410,412],"047682a6-7d3e-4f0f-b761-3d0246fa1dab","content.controller.ts","bedd5bb2-ac42-11f1-aac6-1607ee4eb77e",["D",1788953809222],"import {\n getContentFile,\n listContentFiles,\n} from \"../services/content.service.ts\";\nimport { toSafeSlug } from \"../utils/slug.ts\";\nimport type { ServiceResponse } from \"../../shared/types/index.ts\";\nimport {\n createErrorResponse,\n createSuccessResponse,\n} from \"../../shared/response.ts\";\n\n/**\n * Reading the site's SOURCE, as opposed to rendering it.\n *\n * `page.controller.ts` answers \"what does a visitor see\"; this answers \"what\n * is the site made of\". They deliberately stay apart: rendering resolves\n * gates against a viewer's identity, and an authoring tool wants the markdown\n * exactly as written, gate tokens and frontmatter intact.\n *\n * Returns `ServiceResponse` like every controller, so the MCP door is a\n * thin wrapper and a future HTTP route could serve the same functions.\n */\n\n/** The two kinds of content file, and nothing else. */\nexport type ContentKind = \"page\" | \"gate\";\n\n/** Where each kind lives. One place, so no caller has to guess a path. */\nconst DIRECTORY: Record = {\n page: \"content\",\n gate: \"content/gates\",\n};\n\n/** What the site is made of. */\nexport interface ContentIndex {\n pages: string[];\n gates: string[];\n}\n\n/** One content file, as written. */\nexport interface ContentSource {\n slug: string;\n kind: ContentKind;\n path: string;\n markdown: string;\n}\n\nexport async function listContent(): Promise> {\n const pages = await listContentFiles(DIRECTORY.page);\n if (!pages.success) {\n // Wrap the service error with context rather than leaking its wording.\n return createErrorResponse(\n `Could not list pages: ${pages.error}`,\n pages.status,\n );\n }\n\n const gates = await listContentFiles(DIRECTORY.gate);\n if (!gates.success) {\n return createErrorResponse(\n `Could not list gates: ${gates.error}`,\n gates.status,\n );\n }\n\n return createSuccessResponse({ pages: pages.data, gates: gates.data });\n}\n\nexport async function readContent(\n slug: string,\n kind: ContentKind,\n): Promise> {\n // Validation is the controller's job — the door only extracts and passes on.\n if (!Object.hasOwn(DIRECTORY, kind)) {\n return createErrorResponse(`Unknown content kind \"${kind}\"`, 400);\n }\n\n const safeSlug = toSafeSlug(slug);\n if (!safeSlug) return createErrorResponse(\"Invalid content slug\", 400);\n\n const path = `/${DIRECTORY[kind]}/${safeSlug}.md`;\n const file = await getContentFile(path);\n if (!file.success) {\n return createErrorResponse(`No ${kind} named \"${safeSlug}\"`, 404);\n }\n\n return createSuccessResponse({\n slug: safeSlug,\n kind,\n path,\n markdown: file.data,\n });\n}\n",[],[156,410,419],"4242f58a-7287-4339-9a7c-88e6759593f6",["D",1788952323787],[174,175,176],[156,410],["D",1788952323787],[173,177,182,186,188,195,196],[156],["D",1788890813214],{"_99":98,"_106":102},{"_99":98,"_100":98,"_101":102,"_18":-5,"_103":104,"_105":61},{"_13":88,"_32":89,"_44":43,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":46,"_97":98},"ctx",{"_81":-5,"_126":469,"_470":471,"_472":473,"_474":25,"_475":25,"_476":25,"_477":61,"_478":-5,"_479":-7,"_480":-7,"_481":65,"_482":25,"_483":25,"_484":-5,"_485":25,"_486":25,"_487":25,"_488":-5},"ENV",{"_440":441,"_442":443,"_444":89,"_445":446,"_447":448,"_449":450,"_451":452,"_453":454,"_455":456,"_457":458,"_459":460,"_461":462,"_463":464,"_465":466,"_467":468},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v37