${post.title}

${truncateHTML(post.content, 300)}

Verify Your Blog Post

Hello,

We received a blog post submission with the title \"${postTitle}\" from this email address.

To confirm that you sent this post and publish it to the blog, please click the verification link below:

\n \n Verify and Publish Post\n \n

Or copy and paste this link into your browser:

\n ${verificationUrl}\n

Important: This verification link will expire in 24 hours for security reasons.

If you did not send this blog post, please ignore this email. The post will not be published without verification.

\n This is an automated message from your blog system. Please do not reply to this email.\n

\n \n \n `;\n\n const textContent = `\nVerify Your Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"${postTitle}\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please visit this verification link:\n\n${verificationUrl}\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email. The post will not be published without verification.\n\n---\nThis is an automated message from your blog system. Please do not reply to this email.\n `;\n\n console.log(\"📤 Sending email via Val Town email service:\", {\n to: recipientEmail,\n subject: subject,\n htmlLength: htmlContent.length,\n textLength: textContent.length,\n });\n\n try {\n await email({\n to: recipientEmail,\n subject: subject,\n html: htmlContent,\n text: textContent,\n });\n\n console.log(\"✅ Verification email sent successfully:\", {\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n } catch (error) {\n console.error(\"❌ Failed to send verification email:\", {\n error: error.message,\n stack: error.stack,\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n throw new Error(`Failed to send verification email: ${error.message}`);\n }\n}\n\n/**\n * Calculate expiration time (24 hours from now)\n */\nexport function getVerificationExpiration(): string {\n const expirationTime = new Date();\n expirationTime.setHours(expirationTime.getHours() + 24);\n return expirationTime.toISOString();\n}",[],[153,199,233],{"_103":240,"_95":241,"_154":242,"_156":200,"_157":139,"_158":243,"_160":161,"_105":244,"_99":32,"_163":183,"_165":245,"_166":22,"_167":-5,"_168":246,"_98":247},"1410fe72-5dca-11f0-bb45-0224a6c84d84","rss.ts","1410ff4e-5dca-11f0-bb45-0224a6c84d84",11,["D",1752178294984],"import { BlogPost, RSSItem } from \"../../shared/types.ts\";\nimport { formatRSSDate, truncateHTML } from \"../../shared/utils.ts\";\n\n/**\n * Generate RSS 2.0 feed XML\n */\nexport function generateRSSFeed(posts: BlogPost[], baseUrl: string): string {\n const now = new Date();\n const items = posts.map(post => generateRSSItem(post, baseUrl));\n \n const rssXML = `\n\n \n Email Blog\n ${baseUrl}\n A blog powered by email publishing\n en-us\n ${formatRSSDate(now)}\n Email Blog Platform\n \n blog@${getDomain(baseUrl)} (Email Blog)\n blog@${getDomain(baseUrl)} (Email Blog)\n 60\n \n ${items.map(item => `\n \n <![CDATA[${item.title}]]>\n ${item.link}\n ${item.guid}\n \n \n ${item.pubDate}\n ${item.author}\n `).join('')}\n \n`;\n\n return rssXML;\n}\n\n/**\n * Generate RSS item from blog post\n */\nfunction generateRSSItem(post: BlogPost, baseUrl: string): RSSItem & { content: string } {\n const link = `${baseUrl}/post/${post.slug}`;\n const description = truncateHTML(post.content, 300);\n \n return {\n title: post.title,\n link,\n guid: link,\n description,\n content: post.content,\n pubDate: formatRSSDate(new Date(post.published_at)),\n author: `${post.author_email} (${post.author_name || post.author_email})`\n };\n}\n\n/**\n * Extract domain from URL\n */\nfunction getDomain(url: string): string {\n try {\n return new URL(url).hostname;\n } catch {\n return 'localhost';\n }\n}",[],[153,199,241],{"_103":249,"_95":250,"_154":251,"_156":200,"_157":139,"_158":252,"_160":22,"_105":253,"_99":32,"_163":183,"_165":254,"_166":22,"_167":-5,"_168":255,"_98":256},"3663d564-5dd7-11f0-afd7-0224a6c84d84","webfinger.ts","3663d62c-5dd7-11f0-afd7-0224a6c84d84",48,["D",1752183936029],"/**\n * WebFinger implementation for ActivityPub discovery\n * \n * WebFinger allows users to discover ActivityPub actors using the format:\n * acct:username@domain.com\n * \n * The WebFinger endpoint is typically at:\n * /.well-known/webfinger?resource=acct:username@domain.com\n */\n\nexport interface WebFingerResource {\n subject: string;\n aliases?: string[];\n properties?: { [key: string]: string | null };\n links: WebFingerLink[];\n}\n\nexport interface WebFingerLink {\n rel: string;\n type?: string;\n href?: string;\n template?: string;\n titles?: { [lang: string]: string };\n properties?: { [key: string]: string | null };\n}\n\n/**\n * Generate WebFinger response for the blog actor\n */\nexport function generateWebFingerResponse(resource: string, domain: string): WebFingerResource | null {\n // Parse the resource parameter\n // Expected formats:\n // - acct:blog@domain.com\n // - acct:username@domain.com\n // - https://domain.com/actor\n \n let username: string;\n let requestedDomain: string;\n \n if (resource.startsWith('acct:')) {\n const acctPart = resource.substring(5); // Remove 'acct:' prefix\n const parts = acctPart.split('@');\n if (parts.length !== 2) {\n return null;\n }\n username = parts[0];\n requestedDomain = parts[1];\n } else if (resource.startsWith('https://')) {\n // Handle direct actor URL requests\n const url = new URL(resource);\n if (url.pathname === '/actor') {\n requestedDomain = url.hostname;\n username = 'blog'; // Default username for the blog\n } else {\n return null;\n }\n } else {\n return null;\n }\n \n // Verify the domain matches\n if (requestedDomain !== domain) {\n return null;\n }\n \n // For now, we only support the main blog actor\n // In a multi-user system, you'd check if the username exists\n if (username !== 'blog') {\n return null;\n }\n \n const actorUrl = `https://${domain}/actor`;\n const profileUrl = `https://${domain}/`;\n \n return {\n subject: `acct:${username}@${domain}`,\n aliases: [\n actorUrl,\n profileUrl\n ],\n properties: {\n \"http://schema.org/name\": \"Email Blog\"\n },\n links: [\n {\n rel: \"http://webfinger.net/rel/profile-page\",\n type: \"text/html\",\n href: profileUrl\n },\n {\n rel: \"self\",\n type: \"application/activity+json\",\n href: actorUrl\n },\n {\n rel: \"http://ostatus.org/schema/1.0/subscribe\",\n template: `https://${domain}/authorize_interaction?uri={uri}`\n }\n ]\n };\n}\n\n/**\n * Validate WebFinger resource parameter\n */\nexport function isValidWebFingerResource(resource: string): boolean {\n if (!resource) return false;\n \n // Check for acct: format\n if (resource.startsWith('acct:')) {\n const acctPart = resource.substring(5);\n const parts = acctPart.split('@');\n return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;\n }\n \n // Check for direct URL format\n if (resource.startsWith('https://')) {\n try {\n new URL(resource);\n return true;\n } catch {\n return false;\n }\n }\n \n return false;\n}\n\n/**\n * Extract domain from various sources\n */\nexport function extractDomain(request: Request): string {\n // Try to get domain from environment variable first\n const envDomain = Deno.env.get('ACTIVITYPUB_DOMAIN');\n if (envDomain) {\n return envDomain;\n }\n \n // Fall back to Host header\n const host = request.headers.get('host');\n if (host) {\n return host;\n }\n \n // Last resort: try to extract from URL\n try {\n const url = new URL(request.url);\n return url.hostname;\n } catch {\n return 'localhost';\n }\n}",[],[153,199,250],{"_103":258,"_95":259,"_154":260,"_156":200,"_157":139,"_158":261,"_160":161,"_105":262,"_99":263,"_163":183,"_165":264,"_166":22,"_167":-5,"_168":265,"_98":266},"7bb1ba76-5dca-11f0-8d47-0224a6c84d84","websub.ts","1eea101e-5dc9-11f0-b5a0-0224a6c84d84",22,["D",1752178468845],1,"import { getActiveWebSubSubscriptions, addWebSubSubscription } from \"../database/queries.ts\";\n\n/**\n * Notify WebSub subscribers of new content\n */\nexport async function notifyWebSubSubscribers(): Promise {\n const hubUrl = Deno.env.get('WEBSUB_HUB_URL');\n if (!hubUrl) {\n console.log('WebSub hub URL not configured, skipping notifications');\n return;\n }\n\n try {\n const subscriptions = await getActiveWebSubSubscribers();\n \n if (subscriptions.length === 0) {\n console.log('No active WebSub subscriptions found');\n return;\n }\n\n // Notify the hub that our feed has been updated\n const topicUrl = `${getBaseUrl()}/rss`;\n \n const formData = new FormData();\n formData.append('hub.mode', 'publish');\n formData.append('hub.url', topicUrl);\n\n const response = await fetch(hubUrl, {\n method: 'POST',\n body: formData\n });\n\n if (response.ok) {\n console.log(`WebSub hub notified successfully for ${subscriptions.length} subscriptions`);\n } else {\n console.error('Failed to notify WebSub hub:', response.status, await response.text());\n }\n } catch (error) {\n console.error('Error notifying WebSub subscribers:', error);\n throw error;\n }\n}\n\n/**\n * Handle WebSub subscription requests\n */\nexport async function handleWebSubSubscription(\n mode: string,\n callback: string,\n topic: string,\n challenge?: string,\n leaseSeconds?: number,\n secret?: string\n): Promise {\n const expectedTopic = `${getBaseUrl()}/rss`;\n \n if (topic !== expectedTopic) {\n throw new Error(`Invalid topic URL: ${topic}`);\n }\n\n if (mode === 'subscribe') {\n // Store subscription (will be verified when challenge is confirmed)\n await addWebSubSubscription(callback, topic, leaseSeconds, secret);\n \n if (challenge) {\n // Verify the subscription by returning the challenge\n return challenge;\n }\n } else if (mode === 'unsubscribe') {\n // Handle unsubscription\n await removeWebSubSubscription(callback);\n \n if (challenge) {\n return challenge;\n }\n }\n\n return null;\n}\n\nfunction getBaseUrl(): string {\n // In Val Town, we can construct the base URL from the current environment\n // This would need to be configured based on your actual domain\n return 'https://your-val-name.web.val.run';\n}\n\n// Helper function to remove subscription (implement in queries.ts if needed)\nasync function removeWebSubSubscription(callbackUrl: string): Promise {\n // Implementation would go in queries.ts\n console.log(`Removing WebSub subscription for ${callbackUrl}`);\n}",[],[153,199,259],[153,199],{"_103":269,"_95":270,"_154":271,"_156":155,"_157":139,"_158":272,"_160":22,"_105":273,"_99":274,"_163":275,"_165":276,"_166":22,"_167":-5,"_168":277,"_98":278},"7ca93cac-5e41-11f0-887b-0224a6c84d84","index.ts","260c9582-5dca-11f0-b2ad-0224a6c84d84",113,["D",1752229580574],35,"http","import { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { getAllPosts, getPostBySlug, getRecentPosts, getActiveFollowers, getFollowerCount, getPostActivityCounts, getEmailVerificationByToken, markEmailVerified, publishDraftPost } from \"./database/queries.ts\";\nimport { initializeDatabase } from \"./database/schema.ts\";\nimport { generateActorDocument } from \"./services/activitypub.ts\";\nimport { generateRSSFeed } from \"./services/rss.ts\";\nimport { extractDomain, generateWebFingerResponse, isValidWebFingerResource } from \"./services/webfinger.ts\";\nimport { handleWebSubSubscription } from \"./services/websub.ts\";\nimport { processInboxActivity } from \"./services/activitypub-inbox.ts\";\nimport { notifyWebSubSubscribers } from \"./services/websub.ts\";\nimport { publishToActivityPub } from \"./services/activitypub.ts\";\nimport { publishToATProtocol } from \"./services/atprotocol.ts\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// Initialize database lazily on first request to avoid startup memory issues\nlet dbInitialized = false;\nasync function ensureDbInitialized() {\n if (!dbInitialized) {\n await initializeDatabase();\n dbInitialized = true;\n }\n}\n\n// Get base URL for the application\nfunction getBaseUrl(c: any): string {\n const host = c.req.header(\"host\") || \"localhost:3000\";\n const protocol = c.req.header(\"x-forwarded-proto\") || \"https\";\n return `${protocol}://${host}`;\n}\n\n// Format date for display\nfunction formatDate(dateString: string): string {\n const date = new Date(dateString);\n return date.toLocaleDateString(\"en-US\", {\n year: \"numeric\",\n month: \"long\",\n day: \"numeric\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n });\n}\n\n// Truncate content for previews\nfunction truncateContent(content: string, maxLength: number = 300): string {\n const text = content.replace(/<[^>]*>/g, \"\");\n if (text.length <= maxLength) return text;\n return text.substring(0, maxLength).trim() + \"...\";\n}\n\n// Generate verification success HTML\nfunction generateVerificationSuccessHTML(message: string, alreadyPublished: boolean = false, postUrl?: string): string {\n return `\n\n\n \n \n Email Verified - Email Blog\n \n \n\n\n

\n ${alreadyPublished ? '📝' : '✅'}\n

\n ${alreadyPublished ? 'Already Published' : 'Email Verified!'}\n

${escapeHtml(message)}

\n ${postUrl ? `\n \n View Your Post\n \n ` : ''}\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate verification error HTML\nfunction generateVerificationErrorHTML(message: string): string {\n return `\n\n\n \n \n Verification Error - Email Blog\n \n \n\n\n

\n ❌\n

Verification Failed

${escapeHtml(message)}

\n If you believe this is an error, please try sending your email again.\n

\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate main blog HTML\nfunction generateBlogHTML(posts: any[], baseUrl: string): string {\n const postsHTML = posts.length === 0\n ? `

\n ✉️\n

No posts yet

Send an email to start publishing!

`\n : posts.map(post => `\n

\n \n ${escapeHtml(post.title)}\n \n

\n By ${escapeHtml(post.author_name || post.author_email)}\n ${formatDate(post.published_at)}\n

${escapeHtml(truncateContent(post.content))}

\n \n Read more →\n \n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n `).join(\"\");\n\n return `\n\n\n \n \n Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n 📧\n

Email Blog

\n \n

\n\n \n

\n ${postsHTML}\n

\n\n \n \n\n`;\n}\n\n// Generate individual post HTML\nfunction generatePostHTML(post: any, baseUrl: string, activityCounts?: { likes: number; shares: number; replies: number }): string {\n const postUrl = `${baseUrl}/post/${post.slug}`;\n const description = post.content.replace(/<[^>]*>/g, \"\").substring(0, 160);\n\n return `\n\n\n \n \n ${escapeHtml(post.title)} - Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n \n 📧\n

Email Blog

← Back to all posts

\n \n \n

\n\n \n

\n \n

${escapeHtml(post.title)}

\n 👤\n ${escapeHtml(post.author_name || post.author_email)}\n

\n 📅\n ${formatDate(post.published_at)}\n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n\n \n

\n ${post.content}\n

\n\n \n \n

\n\n \n \n\n \n\n`;\n}\n\n// Generate 404 HTML\nfunction generate404HTML(): string {\n return `\n\n\n \n \n Post Not Found - Email Blog\n \n \n\n\n

\n ❌\n

Post Not Found

The requested post could not be found.

\n ← Back to Blog\n

\n\n`;\n}\n\n// Escape HTML to prevent XSS\nfunction escapeHtml(text: string): string {\n const map: { [key: string]: string } = {\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n \"\\\"\": \""\",\n \"'\": \"'\",\n };\n return text.replace(/[&<>\"']/g, (m) => map[m]);\n}\n\n// Get custom CSS\nfunction getCustomCSS(): string {\n return `\n /* Typography */\n .prose {\n max-width: none;\n }\n .prose h1 { @apply text-3xl font-bold text-gray-900 mb-4; }\n .prose h2 { @apply text-2xl font-semibold text-gray-800 mb-3 mt-6; }\n .prose h3 { @apply text-xl font-medium text-gray-700 mb-2 mt-4; }\n .prose p { @apply text-gray-600 mb-4 leading-relaxed; }\n .prose a { @apply text-blue-600 hover:text-blue-800 underline; }\n .prose ul, .prose ol { @apply mb-4 pl-6; }\n .prose li { @apply mb-1; }\n .prose blockquote { @apply border-l-4 border-gray-300 pl-4 italic text-gray-600 my-4; }\n .prose code { @apply bg-gray-100 px-1 py-0.5 rounded text-sm font-mono; }\n .prose pre { @apply bg-gray-100 p-4 rounded overflow-x-auto mb-4; }\n .prose pre code { @apply bg-transparent p-0; }\n\n /* Blog post styling */\n .blog-post-content { @apply prose max-w-none; }\n .blog-post-content img { @apply max-w-full h-auto rounded-lg shadow-sm my-4; }\n\n /* Post cards */\n .post-card { @apply bg-white rounded-lg shadow-sm border border-gray-200 hover:shadow-md transition-shadow duration-200; }\n .post-card:hover { @apply border-gray-300; }\n\n /* Email icon animation */\n .email-icon { animation: bounce 2s infinite; }\n @keyframes bounce {\n 0%, 20%, 53%, 80%, 100% { transform: translateY(0); }\n 40%, 43% { transform: translateY(-10px); }\n 70% { transform: translateY(-5px); }\n 90% { transform: translateY(-2px); }\n }\n\n /* Social links */\n .social-links a { @apply inline-flex items-center px-3 py-2 text-sm font-medium text-gray-600 hover:text-gray-900 hover:bg-gray-100 rounded-md transition-colors duration-200; }\n\n /* Responsive adjustments */\n @media (max-width: 640px) {\n .prose h1 { @apply text-2xl; }\n .prose h2 { @apply text-xl; }\n .prose h3 { @apply text-lg; }\n }\n `;\n}\n\n// Serve static files\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n\n// Main blog page\napp.get(\"/\", async c => {\n try {\n await ensureDbInitialized();\n const posts = await getAllPosts(20);\n const baseUrl = getBaseUrl(c);\n\n const html = generateBlogHTML(posts, baseUrl);\n return c.html(html);\n } catch (error) {\n console.error(\"Error serving main page:\", error);\n return c.text(\"Error loading blog\", 500);\n }\n});\n\n// Individual post page\napp.get(\"/post/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.html(generate404HTML(), 404);\n }\n\n // Get activity counts for this post\n const activityCounts = await getPostActivityCounts(slug);\n\n const baseUrl = getBaseUrl(c);\n const html = generatePostHTML(post, baseUrl, activityCounts);\n return c.html(html);\n } catch (error) {\n console.error(\"Error serving post:\", error);\n return c.text(\"Error loading post\", 500);\n }\n});\n\n// RSS feed\napp.get(\"/rss\", async c => {\n try {\n await ensureDbInitialized();\n const posts = await getRecentPosts(50);\n const baseUrl = getBaseUrl(c);\n const rssXML = generateRSSFeed(posts, baseUrl);\n\n return c.text(rssXML, 200, {\n \"Content-Type\": \"application/rss+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=3600\",\n });\n } catch (error) {\n console.error(\"Error generating RSS feed:\", error);\n return c.text(\"Error generating RSS feed\", 500);\n }\n});\n\n// API: Get all posts\napp.get(\"/api/posts\", async c => {\n try {\n await ensureDbInitialized();\n const limit = parseInt(c.req.query(\"limit\") || \"20\");\n const offset = parseInt(c.req.query(\"offset\") || \"0\");\n const posts = await getAllPosts(limit, offset);\n\n return c.json({ posts });\n } catch (error) {\n console.error(\"Error fetching posts:\", error);\n return c.json({ error: \"Failed to fetch posts\" }, 500);\n }\n});\n\n// API: Get single post\napp.get(\"/api/posts/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n // Get activity counts\n const activityCounts = await getPostActivityCounts(slug);\n\n return c.json({ post, activityCounts });\n } catch (error) {\n console.error(\"Error fetching post:\", error);\n return c.json({ error: \"Failed to fetch post\" }, 500);\n }\n});\n\n// API: Get activity counts for a post\napp.get(\"/api/posts/:slug/activities\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n const activityCounts = await getPostActivityCounts(slug);\n return c.json({ activityCounts });\n } catch (error) {\n console.error(\"Error fetching activity counts:\", error);\n return c.json({ error: \"Failed to fetch activity counts\" }, 500);\n }\n});\n\n// WebSub hub endpoint\napp.get(\"/websub\", async c => {\n try {\n await ensureDbInitialized();\n const mode = c.req.query(\"hub.mode\");\n const callback = c.req.query(\"hub.callback\");\n const topic = c.req.query(\"hub.topic\");\n const challenge = c.req.query(\"hub.challenge\");\n const leaseSeconds = c.req.query(\"hub.lease_seconds\");\n const secret = c.req.query(\"hub.secret\");\n\n if (!mode || !callback || !topic) {\n return c.text(\"Missing required parameters\", 400);\n }\n\n const result = await handleWebSubSubscription(\n mode,\n callback,\n topic,\n challenge,\n leaseSeconds ? parseInt(leaseSeconds) : undefined,\n secret,\n );\n\n if (result) {\n return c.text(result);\n }\n\n return c.text(\"OK\", 200);\n } catch (error) {\n console.error(\"WebSub error:\", error);\n return c.text(\"WebSub error\", 400);\n }\n});\n\n// ActivityPub actor endpoint\napp.get(\"/actor\", async c => {\n try {\n const domain = extractDomain(c.req.raw);\n const actor = generateActorDocument(domain);\n return c.json(actor, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub actor error:\", error);\n return c.json({ error: \"Failed to generate actor document\" }, 500);\n }\n});\n\n// ActivityPub inbox (for receiving activities)\napp.post(\"/inbox\", async c => {\n try {\n await ensureDbInitialized();\n const activity = await c.req.json();\n const domain = extractDomain(c.req.raw);\n \n console.log(\"Received ActivityPub activity:\", {\n id: activity.id,\n type: activity.type,\n actor: typeof activity.actor === 'string' ? activity.actor : activity.actor?.id\n });\n\n // Process the activity\n const result = await processInboxActivity(activity, domain);\n \n if (result.success) {\n console.log(\"Activity processed successfully:\", result.message);\n return c.text(\"\", 202);\n } else {\n console.error(\"Activity processing failed:\", result.message);\n return c.text(\"Error processing activity\", 400);\n }\n } catch (error) {\n console.error(\"ActivityPub inbox error:\", error);\n return c.text(\"Error processing activity\", 400);\n }\n});\n\n// ActivityPub outbox (for serving activities)\napp.get(\"/outbox\", async c => {\n try {\n const domain = extractDomain(c.req.raw);\n const baseUrl = `https://${domain}`;\n\n // Get recent posts to create activities\n const posts = await getRecentPosts(20);\n\n const activities = posts.map(post => ({\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"Create\",\n id: `${baseUrl}/post/${post.slug}#create`,\n actor: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n object: {\n type: \"Note\",\n id: `${baseUrl}/post/${post.slug}#note`,\n attributedTo: `${baseUrl}/actor`,\n content: `

${escapeHtml(post.title)}

${\n escapeHtml(truncateContent(post.content, 300))\n }

My Post Title

Post content...

\",\n \"published\": \"2024-01-01T12:00:00Z\",\n \"url\": \"https://your-domain.com/post/my-post\",\n \"to\": [\"https://www.w3.org/ns/activitystreams#Public\"]\n }\n}\n```\n\n## 🚧 Current Limitations\n\n1. **No HTTP Signatures**: Authentication is not yet implemented\n2. **No Follow Processing**: The inbox doesn't process Follow activities yet\n3. **No Push Notifications**: New posts aren't automatically pushed to followers\n4. **Placeholder Collections**: Followers/following collections are empty\n5. **No Public Key**: The public key in the actor document is a placeholder\n\n## 🛠️ Future Enhancements\n\n1. **HTTP Signatures**: Implement cryptographic signatures for authentication\n2. **Follow Management**: Process Follow/Unfollow activities\n3. **Push Delivery**: Send new posts to followers' inboxes\n4. **Database Storage**: Store followers and following relationships\n5. **Key Generation**: Generate and manage cryptographic keys\n6. **Rich Content**: Support for images, mentions, and hashtags\n\n## 🧪 Testing\n\nUse the `/test-activitypub.ts` endpoint to verify all ActivityPub endpoints are working correctly.\n\n## 📚 References\n\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [WebFinger Specification](https://tools.ietf.org/html/rfc7033)\n- [ActivityStreams Vocabulary](https://www.w3.org/TR/activitystreams-vocabulary/)\n- [Mastodon API Documentation](https://docs.joinmastodon.org/spec/activitypub/)\n\n---\n\nYour blog is now discoverable and followable from the fediverse! 🎉",[],[324],{"_103":333,"_95":334,"_154":335,"_156":-5,"_157":139,"_158":336,"_160":22,"_105":337,"_99":338,"_163":328,"_165":339,"_166":22,"_167":-5,"_168":340,"_98":341},"b6aba3ea-5e41-11f0-adc3-0224a6c84d84","README.md","e96c1ab8-5dc8-11f0-bf16-0224a6c84d84",120,["D",1752229677898],20,"# Email Blog Platform\n\nA modern blog platform inspired by Posterous that allows publishing posts via email.\n\n## 🚀 Status: READY TO USE\n\nYour email blog platform is fully functional! Send an email to start publishing.\n\n## ✨ Features\n\n- **📧 Email-to-Publish**: Send an email to publish posts instantly\n- **🔒 Email Security**: Allowlist and verification system to prevent unauthorized posts\n- **🎨 Multi-format Support**: HTML and plain text posts\n- **📡 RSS Feed**: Full RSS 2.0 support for syndication\n- **🌐 WebSub**: Real-time feed updates via WebSub protocol (configured)\n- **🐘 ActivityPub**: Full federated social networking with followers, likes, and shares ✅\n- **🦋 AT Protocol**: Bluesky integration for cross-platform syndication (configured)\n- **🔗 SEO Friendly**: Clean URLs with slugified titles\n- **📱 Responsive Design**: Mobile-first responsive interface with TailwindCSS\n- **⚡ Fast**: Built on Val Town with SQLite storage and static HTML generation\n- **🚀 No JavaScript**: Pure HTML/CSS frontend for maximum performance\n\n## 🏗️ Architecture\n\n### Backend (`/backend/`)\n- `index.ts` - Main Hono server with HTML generation and API routes ✅\n- `database/` - SQLite schema and query functions ✅\n- `services/` - External service integrations ✅\n\n### Email Handler (`/email.ts`)\n- Email trigger handler with security verification ✅\n- Allowlist checking and draft post creation ✅\n- Automated verification email sending ✅\n\n### Static HTML Generation\n- Server-side HTML rendering with TailwindCSS ✅\n- No client-side JavaScript dependencies ✅\n- Fast loading and SEO optimized ✅\n\n## 🎯 Quick Start\n\n1. **Configure Security**: Set `ALLOWED_EMAIL_ADDRESSES` environment variable (see Security section)\n2. **Send Email**: Send email from an allowed address to your Val Town email address\n3. **Verify Email**: Click the verification link sent to your email\n4. **View Blog**: Visit your backend HTTP val URL after verification\n5. **RSS Feed**: Access `/rss` for syndication\n6. **Individual Posts**: Visit `/post/[slug]`\n\n## 🔧 Configuration\n\nSee [SETUP.md](./SETUP.md) for detailed setup instructions and [ACTIVITYPUB.md](./ACTIVITYPUB.md) for ActivityPub federation details.\n\n### Environment Variables (Required for Security)\n\n- `ALLOWED_EMAIL_ADDRESSES` - Comma-separated list of allowed email addresses (required)\n- `BASE_URL` - Your blog's base URL for verification links (optional, auto-detected)\n\n### Environment Variables (Optional)\n\n- `WEBSUB_HUB_URL` - WebSub hub URL\n- `ACTIVITYPUB_DOMAIN` - Domain for ActivityPub federation\n- `ATPROTO_HANDLE` - AT Protocol handle\n- `ATPROTO_PASSWORD` - AT Protocol app password\n\n## 📊 API Endpoints\n\n- `GET /` - Main blog interface\n- `GET /post/:slug` - Individual post page\n- `GET /rss` - RSS 2.0 feed\n- `GET /api/posts` - JSON API for posts\n- `GET /api/posts/:slug` - JSON API for single post\n- `GET /websub` - WebSub subscription endpoint\n- `GET /.well-known/webfinger` - WebFinger discovery for ActivityPub ✅\n- `GET /actor` - ActivityPub actor document ✅\n- `GET /outbox` - ActivityPub outbox (published activities) ✅\n- `GET /followers` - ActivityPub followers collection ✅\n- `GET /following` - ActivityPub following collection ✅\n- `POST /inbox` - ActivityPub inbox (processes Follow, Like, Announce, Undo) ✅\n- `GET /api/posts/:slug/activities` - Get activity counts (likes, shares, replies) ✅\n- `GET /verify-email` - Email verification endpoint ✅\n- `GET /health` - Health check\n\n## 🔒 Security Features\n\n### Email Allowlist\nOnly emails from pre-configured addresses can publish posts. Configure via environment variable:\n\n```\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n### Email Verification\nTo prevent spoofing, all emails go through a verification process:\n\n1. **Email Received**: Email is stored as a draft (not published)\n2. **Verification Sent**: Automated verification email sent to sender\n3. **User Clicks Link**: Sender clicks verification link in email\n4. **Post Published**: After verification, post is published and syndicated\n\n### Security Benefits\n- **Anti-spoofing**: Prevents unauthorized users from publishing posts\n- **Email confirmation**: Ensures the sender actually sent the email\n- **Time-limited**: Verification links expire after 24 hours\n- **Automatic cleanup**: Expired drafts are automatically removed\n\n## 🧪 Testing\n\nUse `/test-publish.ts` to create sample posts for testing.\n\n## 📝 Usage Example\n\nSend an email like this:\n\n```\nTo: your-email-val@val.town\nFrom: allowed-user@example.com (must be in ALLOWED_EMAIL_ADDRESSES)\nSubject: My Amazing Blog Post\nBody:

Hello World!

This post was published via email!

\n```\n\nThe process will be:\n1. Email received and stored as draft\n2. Verification email sent to `allowed-user@example.com`\n3. User clicks verification link\n4. Post published with:\n - Title: \"My Amazing Blog Post\"\n - Slug: \"my-amazing-blog-post\"\n - Content: Rendered HTML\n - Author: Extracted from email address\n\n## 🎨 Customization\n\n- Edit HTML generation functions in `/backend/index.ts`\n- Modify CSS styles in the `getCustomCSS()` function\n- Update branding in HTML templates\n- Configure federation services via environment variables\n\n## 🔄 Syndication\n\nPosts are automatically syndicated to:\n- RSS feed (always enabled)\n- WebSub subscribers (if configured)\n- ActivityPub followers (with full interaction support) ✅\n- AT Protocol/Bluesky (if configured)\n\n### ActivityPub Federation\n\nYour blog is now fully federated with ActivityPub! Users can:\n\n- **Follow** your blog from Mastodon, Pleroma, and other ActivityPub platforms\n- **Like** your blog posts (shows ❤️ count on posts)\n- **Share/Boost** your posts (shows 🔄 count on posts)\n- **Reply** to your posts (shows 💬 count on posts)\n\n**Discovery formats:**\n- **WebFinger**: `@blog@your-domain.com`\n- **Direct actor URL**: `https://your-domain.com/actor`\n\n**Real-time interaction tracking:**\n- All likes, shares, and replies are stored and displayed on individual post pages\n- Follower count is maintained and accurate\n- Full ActivityPub inbox processing for Follow/Unfollow activities\n\nExample: If your blog is at `myblog.web.val.run`, users can follow `@blog@myblog.web.val.run` from their Mastodon client and interact with your posts!\n\n---\n\n**Ready to blog via email? Send your first post now!** 📧✨",[],[334],{"_103":343,"_95":344,"_154":345,"_156":-5,"_157":139,"_158":346,"_160":161,"_105":347,"_99":32,"_163":328,"_165":348,"_166":22,"_167":-5,"_168":349,"_98":350},"de55c72c-5e41-11f0-b084-0224a6c84d84","SECURITY.md","de55c808-5e41-11f0-b084-0224a6c84d84",121,["D",1752229744445],"# Email Blog Security Configuration\n\n## Overview\n\nThe email blog platform includes robust security features to prevent unauthorized posting and email spoofing. This guide explains how to configure and use these security features.\n\n## Required Configuration\n\n### 1. Set Allowed Email Addresses\n\nConfigure the `ALLOWED_EMAIL_ADDRESSES` environment variable with a comma-separated list of email addresses that are allowed to publish posts:\n\n```bash\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n**Important Notes:**\n- Email addresses are case-insensitive\n- Whitespace around commas is automatically trimmed\n- If this variable is not set, **no emails will be allowed**\n- Only exact email matches are allowed (no wildcards or domains)\n\n### 2. Set Base URL (Optional)\n\nSet your blog's base URL for verification links:\n\n```bash\nBASE_URL=https://your-blog.web.val.run\n```\n\nIf not set, the system will auto-detect the URL from incoming requests.\n\n## How Email Security Works\n\n### Step 1: Email Allowlist Check\nWhen an email is received:\n1. The sender's email address is checked against `ALLOWED_EMAIL_ADDRESSES`\n2. If not allowed, the email is ignored (logged but not processed)\n3. If allowed, the process continues to verification\n\n### Step 2: Draft Creation\nFor allowed emails:\n1. Post content is extracted from the email\n2. A draft post is created (not published yet)\n3. A unique verification token is generated\n4. The draft expires after 24 hours if not verified\n\n### Step 3: Verification Email\n1. An automated verification email is sent to the original sender\n2. The email contains a secure verification link\n3. The link expires after 24 hours for security\n\n### Step 4: Verification and Publishing\nWhen the sender clicks the verification link:\n1. The token is validated and checked for expiration\n2. The email verification is marked as complete\n3. The draft post is converted to a published post\n4. External services are notified (RSS, ActivityPub, etc.)\n5. The draft and verification records are cleaned up\n\n## Security Benefits\n\n### Anti-Spoofing Protection\n- **Email confirmation required**: Even if someone spoofs your email address, they can't access your email to click the verification link\n- **Time-limited tokens**: Verification links expire after 24 hours\n- **One-time use**: Each verification token can only be used once\n\n### Access Control\n- **Allowlist-based**: Only pre-approved email addresses can publish\n- **No wildcards**: Exact email matching prevents subdomain attacks\n- **Easy management**: Add/remove allowed emails via environment variable\n\n### Automatic Cleanup\n- **Expired drafts**: Unverified drafts are automatically deleted after 24 hours\n- **Token cleanup**: Used and expired verification tokens are removed\n- **Database efficiency**: Regular cleanup prevents database bloat\n\n## Email Templates\n\n### Verification Email Template\nThe system sends a professional verification email with:\n- Clear subject line indicating verification needed\n- HTML and plain text versions\n- Secure verification link\n- Expiration warning (24 hours)\n- Instructions for non-senders to ignore\n\n### Example Verification Email\n```\nSubject: Verify your blog post: My Amazing Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"My Amazing Blog Post\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please click the verification link below:\n\n[Verify and Publish Post]\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email.\n```\n\n## Troubleshooting\n\n### Email Not Processing\n1. **Check allowlist**: Ensure sender email is in `ALLOWED_EMAIL_ADDRESSES`\n2. **Check logs**: Look for \"Email from X is not in the allowed list\" messages\n3. **Verify format**: Ensure environment variable is properly formatted\n\n### Verification Link Issues\n1. **Check expiration**: Links expire after 24 hours\n2. **Check BASE_URL**: Ensure it's set correctly or auto-detection is working\n3. **One-time use**: Each link can only be used once\n\n### Posts Not Publishing\n1. **Click verification link**: Posts remain as drafts until verified\n2. **Check email delivery**: Ensure verification emails aren't in spam\n3. **Check token validity**: Tokens expire after 24 hours\n\n## Best Practices\n\n### Email Management\n- Use dedicated email addresses for blog posting\n- Keep the allowlist minimal (only trusted users)\n- Regularly review who has posting access\n\n### Security Monitoring\n- Monitor logs for unauthorized posting attempts\n- Review verification patterns for unusual activity\n- Keep environment variables secure\n\n### Backup Strategy\n- Regular database backups include draft posts\n- Consider notification systems for failed verifications\n- Document your allowed email addresses\n\n## API Endpoints\n\n### Verification Endpoint\n- **URL**: `GET /verify-email?token=`\n- **Purpose**: Handles email verification and post publishing\n- **Responses**:\n - `200`: Successful verification and publishing\n - `400`: Missing or invalid token\n - `404`: Token not found\n - `410`: Token expired\n - `500`: Server error during publishing\n\n### Security Headers\nAll verification pages include:\n- Proper HTML escaping to prevent XSS\n- Responsive design for mobile verification\n- Clear success/error messaging\n- Links back to the main blog\n\n## Migration from Unsecured Version\n\nIf upgrading from a version without security:\n\n1. **Set environment variables** before receiving new emails\n2. **Existing posts** remain published (not affected)\n3. **New emails** will require verification from the first email received\n4. **Test thoroughly** with a test email before going live\n\n---\n\n**Security is enabled by default. Configure `ALLOWED_EMAIL_ADDRESSES` to start receiving posts!**",[],[344],{"_103":352,"_95":353,"_154":354,"_156":-5,"_157":139,"_158":355,"_160":22,"_105":356,"_99":159,"_163":328,"_165":357,"_166":22,"_167":-5,"_168":358,"_98":359},"3d381ba2-5dcd-11f0-9863-0224a6c84d84","SETUP.md","db9f912e-5dca-11f0-b4e8-0224a6c84d84",47,["D",1752179652511],"# Email Blog Platform Setup Guide\n\n## Quick Start\n\nYour email blog platform is now ready to use! Here's how to get started:\n\n### 1. Email Publishing\n\nTo publish a blog post, simply send an email to your Val Town email address:\n\n- **Subject**: Becomes the post title\n- **Body**: Becomes the post content (HTML preferred, plain text will be converted)\n- **From**: Becomes the author information\n\nExample email:\n```\nTo: your-email-val@val.town\nSubject: My First Blog Post\nBody:

Hello World!

This is my first post published via email!

\n```\n\n### 2. Accessing Your Blog\n\n- **Main Blog**: Visit your backend HTTP val URL\n- **Individual Posts**: `/post/[slug]` (auto-generated from title)\n- **RSS Feed**: `/rss`\n- **API**: `/api/posts` for JSON data\n\n### 3. Current Features\n\n✅ **Core Features**\n- Email-to-publish functionality\n- HTML and plain text support\n- Automatic slug generation\n- SQLite database storage\n- RSS 2.0 feed\n- Responsive web interface\n- SEO-friendly URLs\n- Social media meta tags\n\n✅ **Technical Features**\n- Static HTML generation (no client-side JavaScript)\n- Hono backend API\n- TailwindCSS styling\n- Error handling and logging\n- Fast loading and SEO optimized\n\n### 4. Federation & Syndication Setup\n\nThe platform includes foundation code for:\n\n#### WebSub (PubSubHubbub)\n- Set `WEBSUB_HUB_URL` environment variable\n- Endpoint: `/websub` for subscription management\n- Automatically notifies subscribers of new posts\n\n#### ActivityPub (Mastodon, etc.)\n- Set `ACTIVITYPUB_DOMAIN` environment variable\n- Actor endpoint: `/actor`\n- Inbox endpoint: `/inbox`\n- Note: Requires additional setup for full federation\n\n#### AT Protocol (Bluesky)\n- Set `ATPROTO_HANDLE` and `ATPROTO_PASSWORD` environment variables\n- Automatically cross-posts to Bluesky when publishing\n\n### 5. Environment Variables\n\nOptional configuration:\n\n```bash\n# WebSub Hub URL (e.g., https://pubsubhubbub.appspot.com/)\nWEBSUB_HUB_URL=your-hub-url\n\n# ActivityPub domain for federation\nACTIVITYPUB_DOMAIN=your-domain.com\n\n# AT Protocol (Bluesky) credentials\nATPROTO_HANDLE=your-handle.bsky.social\nATPROTO_PASSWORD=your-app-password\n```\n\n### 6. Customization\n\n#### Styling\n- Edit CSS in the `getCustomCSS()` function in `/backend/index.ts`\n- Uses TailwindCSS classes throughout\n- Modify HTML generation functions for layout changes\n\n#### Branding\n- Update blog title and description in HTML generation functions\n- Change favicon in HTML templates\n- Modify footer text in `generateBlogHTML()` and `generatePostHTML()`\n\n#### Database Schema\n- Posts are stored in SQLite table `blog_posts_v1`\n- To modify schema, create new table name (e.g., `blog_posts_v2`)\n\n### 7. Testing\n\nUse the `/test-publish.ts` val to create sample posts for testing.\n\n### 8. Monitoring\n\n- Check Val Town logs for email processing\n- Use `/health` endpoint for status checks\n- Monitor `/api/posts` for data integrity\n\n## Architecture Overview\n\n```\nEmail → email.ts (Email Trigger)\n ↓\n Database (SQLite)\n ↓\n backend/index.ts (HTTP API + HTML Generation)\n ↓\n Static HTML (TailwindCSS)\n```\n\n## Next Steps\n\n1. **Set up email forwarding** to your Val Town email address\n2. **Configure environment variables** for federation features\n3. **Customize styling** and branding to match your preferences\n4. **Test email publishing** with different content types\n5. **Share your RSS feed** for syndication\n\n## Support\n\n- Check Val Town logs for debugging\n- Use the `/health` endpoint to verify system status\n- Test individual components using the API endpoints\n\nYour email blog platform is ready to use! Send your first email to start publishing.",[],[353],{"_103":361,"_95":362,"_154":363,"_156":-5,"_157":139,"_158":364,"_160":22,"_105":365,"_99":263,"_163":275,"_165":366,"_166":22,"_167":-5,"_168":367,"_98":368},"bc1480e4-5e42-11f0-aa0d-0224a6c84d84","debug-config.ts","b97156fa-5e42-11f0-9c52-0224a6c84d84",129,["D",1752230116472],"// Debug configuration tool - HTTP endpoint to check email security settings\nimport { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { isEmailAllowed } from \"./backend/services/email-security.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const testEmail = c.req.query(\"email\");\n \n // Get environment variables\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n const baseUrl = Deno.env.get('BASE_URL');\n \n // Parse allowed emails\n let allowedList: string[] = [];\n if (allowedEmails) {\n allowedList = allowedEmails\n .split(',')\n .map(email => email.trim().toLowerCase())\n .filter(email => email.length > 0);\n }\n \n // Test email if provided\n let emailTestResult = null;\n if (testEmail) {\n emailTestResult = {\n testEmail: testEmail,\n normalizedEmail: testEmail.trim().toLowerCase(),\n isAllowed: isEmailAllowed(testEmail),\n matchesAny: allowedList.includes(testEmail.trim().toLowerCase())\n };\n }\n \n const html = `\n\n\n\n \n \n Email Blog Debug Configuration\n \n\n\n

📧 Email Blog Debug Configuration

\n \n

🔧 Environment Variables

\n ALLOWED_EMAIL_ADDRESSES:\n

\n ${allowedEmails || 'NOT SET'}\n

\n ${!allowedEmails ? '

⚠️ This must be set for emails to be processed!

' : ''}\n

\n BASE_URL:\n

\n ${baseUrl || 'NOT SET (will auto-detect)'}\n

\n\n \n

📋 Parsed Configuration

\n Allowed Email Count: ${allowedList.length}\n

\n Allowed Emails (normalized):\n

✅ ${email}
❌ No emails configured

\n\n \n

🧪 Test Email Address

\n \n \n ${emailTestResult ? `\n

\n ${emailTestResult.isAllowed ? '✅ Email ALLOWED' : '❌ Email BLOCKED'}\n

Original: ${emailTestResult.testEmail}

Normalized: ${emailTestResult.normalizedEmail}

Matches allowlist: ${emailTestResult.matchesAny ? 'Yes' : 'No'}

\n ` : ''}\n

\n\n \n

📝 Setup Instructions

1. Set Environment Variable:

\n ALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com\n

\n \n

2. Send Test Email:

Send from an allowed email address
Subject becomes the post title
Body becomes the post content
You'll receive a verification email

\n \n

3. Check Logs:

Use the requests tool to see detailed logs of email processing.

\n\n\n `;\n \n return c.html(html);\n});\n\nexport default app.fetch;",[],[362],{"_103":370,"_95":371,"_154":372,"_156":-5,"_157":139,"_158":373,"_160":22,"_105":374,"_99":182,"_163":375,"_165":376,"_166":22,"_167":377,"_168":378,"_98":379},"f2e68d4c-5e42-11f0-9a7b-0224a6c84d84","email.ts","1168efdc-5dc9-11f0-b87a-0224a6c84d84",132,["D",1752230208439],"email","import { createDraftPost, generateUniqueSlug, createEmailVerification, cleanupExpiredDrafts } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML } from \"./shared/utils.ts\";\nimport { CreateDraftPostData } from \"./shared/types.ts\";\nimport { isEmailAllowed, generateVerificationToken, sendVerificationEmail, getVerificationExpiration } from \"./backend/services/email-security.ts\";\n\n// Helper function to extract email address from display name format\nfunction extractEmailAddress(emailString: string): string {\n // Handle formats like \"Display Name \" or just \"email@domain.com\"\n const match = emailString.match(/<([^>]+)>/);\n if (match) {\n return match[1].trim();\n }\n return emailString.trim();\n}\n\ninterface Email {\n from: string;\n to: string[];\n subject: string;\n text?: string;\n html?: string;\n headers: Record;\n}\n\nexport default async function(email: Email) {\n const startTime = Date.now();\n console.log('=== EMAIL PROCESSING START ===');\n \n try {\n // Log full email details\n console.log('📧 Email received:', {\n from: email.from,\n to: email.to,\n subject: email.subject,\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlLength: email.html?.length || 0,\n textLength: email.text?.length || 0,\n headers: Object.keys(email.headers || {}),\n timestamp: new Date().toISOString()\n });\n\n // Log environment configuration\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n console.log('🔧 Environment check:', {\n hasAllowedEmails: !!allowedEmails,\n allowedEmailsLength: allowedEmails?.length || 0,\n baseUrl: Deno.env.get('BASE_URL') || 'auto-detect'\n });\n\n console.log('🗄️ Initializing database...');\n await initializeDatabase();\n console.log('✅ Database initialized');\n\n console.log('🧹 Cleaning up expired drafts...');\n await cleanupExpiredDrafts();\n console.log('✅ Cleanup completed');\n\n // Check if sender email is allowed\n const senderEmail = email.from;\n console.log('🔒 Checking email allowlist:', {\n senderEmail: senderEmail,\n normalizedSender: senderEmail.trim().toLowerCase()\n });\n\n if (!isEmailAllowed(senderEmail)) {\n console.error('❌ SECURITY: Email not allowed!', {\n senderEmail: senderEmail,\n allowedEmails: allowedEmails,\n reason: 'Email address not in ALLOWED_EMAIL_ADDRESSES environment variable'\n });\n return;\n }\n console.log('✅ Email address is allowed');\n\n // Extract post data from email\n const title = email.subject.trim();\n console.log('📝 Processing email content:', {\n originalSubject: email.subject,\n trimmedTitle: title,\n titleLength: title.length\n });\n\n if (!title) {\n console.error('❌ Email subject is empty, cannot create post');\n return;\n }\n\n // Prefer HTML content over plain text\n let content = email.html || email.text || '';\n console.log('📄 Content analysis:', {\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlPreview: email.html ? email.html.substring(0, 100) + '...' : null,\n textPreview: email.text ? email.text.substring(0, 100) + '...' : null,\n finalContentLength: content.length\n });\n\n if (!content.trim()) {\n console.error('❌ Email body is empty, cannot create post');\n return;\n }\n\n // Determine content type and process content\n let contentType: 'html' | 'text';\n if (email.html && isHTML(email.html)) {\n contentType = 'html';\n content = email.html;\n console.log('📋 Content type: HTML (using email.html)');\n } else if (email.text) {\n contentType = 'html'; // Convert text to HTML for consistent rendering\n content = textToHTML(email.text);\n console.log('📋 Content type: Text converted to HTML (using email.text)');\n } else {\n contentType = 'html';\n content = textToHTML(content);\n console.log('📋 Content type: Fallback text converted to HTML');\n }\n\n // Generate slug\n console.log('🔗 Generating slug...');\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n console.log('✅ Slug generated:', {\n baseSlug: baseSlug,\n finalSlug: slug\n });\n\n // Extract author info - use the actual email address, not the display name\n const authorEmail = extractEmailAddress(email.from);\n const authorName = extractAuthorName(email.from);\n console.log('👤 Author info:', {\n originalFrom: email.from,\n authorEmail: authorEmail,\n authorName: authorName\n });\n\n // Generate verification token and expiration\n console.log('🔐 Generating verification token...');\n const verificationToken = generateVerificationToken();\n const expiresAt = getVerificationExpiration();\n console.log('✅ Verification token generated:', {\n tokenLength: verificationToken.length,\n expiresAt: expiresAt,\n expiresInHours: Math.round((new Date(expiresAt).getTime() - Date.now()) / (1000 * 60 * 60))\n });\n\n // Create draft post data\n const draftData: CreateDraftPostData = {\n title,\n slug,\n content,\n content_type: contentType,\n author_email: authorEmail,\n author_name: authorName,\n verification_token: verificationToken,\n expires_at: expiresAt\n };\n\n console.log('💾 Creating draft post in database...');\n const draftPost = await createDraftPost(draftData);\n console.log('✅ Draft post created:', { \n id: draftPost.id, \n title: draftPost.title, \n slug: draftPost.slug,\n verificationToken: draftPost.verification_token\n });\n\n console.log('📝 Creating email verification record...');\n await createEmailVerification(authorEmail, verificationToken, draftPost.id, expiresAt);\n console.log('✅ Email verification record created');\n\n console.log('📧 Sending verification email...');\n try {\n await sendVerificationEmail(authorEmail, verificationToken, title);\n console.log('✅ Verification email sent successfully');\n } catch (emailError) {\n console.error('❌ Failed to send verification email:', {\n error: emailError.message,\n stack: emailError.stack,\n recipientEmail: authorEmail,\n verificationToken: verificationToken\n });\n throw emailError;\n }\n\n const processingTime = Date.now() - startTime;\n console.log('🎉 EMAIL PROCESSING COMPLETED SUCCESSFULLY:', {\n processingTimeMs: processingTime,\n draftPostId: draftPost.id,\n verificationToken: verificationToken,\n recipientEmail: authorEmail\n });\n\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error('💥 EMAIL PROCESSING FAILED:', {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n emailFrom: email?.from,\n emailSubject: email?.subject\n });\n throw error;\n } finally {\n console.log('=== EMAIL PROCESSING END ===');\n }\n}","kinlan-postherous",[],[371],{"_103":381,"_95":382,"_154":383,"_156":-5,"_157":139,"_158":384,"_160":22,"_105":385,"_99":263,"_163":275,"_165":386,"_166":22,"_167":-5,"_168":387,"_98":388},"8b7debc2-5dda-11f0-bab4-0224a6c84d84","test-activitypub-inbox.ts","875c0f7e-5dda-11f0-9812-0224a6c84d84",84,["D",1752185367288],"/**\n * Test script for ActivityPub inbox functionality\n * \n * This script simulates various ActivityPub activities to test the inbox processing.\n */\n\nconst BASE_URL = 'https://paulkinlan--260c95825dca11f0b2ad0224a6c84d84.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubInbox() {\n console.log('🧪 Testing ActivityPub inbox functionality...\\n');\n \n // Test Follow activity\n const followActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: {\n id: 'https://mastodon.social/users/testuser',\n type: 'Person',\n preferredUsername: 'testuser',\n name: 'Test User',\n inbox: 'https://mastodon.social/users/testuser/inbox',\n icon: {\n type: 'Image',\n url: 'https://mastodon.social/avatars/testuser.jpg'\n },\n endpoints: {\n sharedInbox: 'https://mastodon.social/inbox'\n }\n },\n object: `${BASE_URL}/actor`,\n published: new Date().toISOString()\n };\n\n console.log('📤 Testing Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(followActivity)\n });\n\n if (response.ok) {\n console.log('✅ Follow activity processed successfully');\n \n // Check if follower was added\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n \n if (followersData.totalItems > 0) {\n console.log(` New follower: ${followersData.orderedItems[0]}`);\n }\n } else {\n console.log(`❌ Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Follow activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Like activity\n const likeActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#likes/456',\n type: 'Like',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`, // Assuming there's a post with slug 'test'\n published: new Date().toISOString()\n };\n\n console.log('❤️ Testing Like activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(likeActivity)\n });\n\n if (response.ok) {\n console.log('✅ Like activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Like activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Like activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Announce (share) activity\n const announceActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#announces/789',\n type: 'Announce',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`,\n published: new Date().toISOString(),\n to: ['https://www.w3.org/ns/activitystreams#Public']\n };\n\n console.log('🔄 Testing Announce (share) activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(announceActivity)\n });\n\n if (response.ok) {\n console.log('✅ Announce activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Announce activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Announce activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Undo Follow activity\n const undoFollowActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#undo/123',\n type: 'Undo',\n actor: 'https://mastodon.social/users/testuser',\n object: {\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/actor`\n },\n published: new Date().toISOString()\n };\n\n console.log('↩️ Testing Undo Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(undoFollowActivity)\n });\n\n if (response.ok) {\n console.log('✅ Undo Follow activity processed successfully');\n \n // Check if follower was removed\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n } else {\n console.log(`❌ Undo Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Undo Follow activity error: ${error.message}`);\n }\n\n console.log('\\n🎉 ActivityPub inbox testing complete!');\n console.log('\\n📊 Final Status:');\n \n // Get final followers count\n try {\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Total followers: ${followersData.totalItems}`);\n } catch (error) {\n console.log(` Could not fetch followers: ${error.message}`);\n }\n\n // Get final activity counts for test post\n try {\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Test post activities - Likes: ${activityData.activityCounts.likes}, Shares: ${activityData.activityCounts.shares}, Replies: ${activityData.activityCounts.replies}`);\n }\n } catch (error) {\n console.log(` Could not fetch activity counts: ${error.message}`);\n }\n}\n\nexport default async function() {\n await testActivityPubInbox();\n return new Response('ActivityPub inbox test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n}",[],[382],{"_103":390,"_95":391,"_154":392,"_156":-5,"_157":139,"_158":393,"_160":22,"_105":394,"_99":263,"_163":275,"_165":395,"_166":22,"_167":-5,"_168":396,"_98":397},"0f4ecd02-5dd8-11f0-9361-0224a6c84d84","test-activitypub.ts","0927eefe-5dd8-11f0-a245-0224a6c84d84",66,["D",1752184299952],"/**\n * Test script to verify ActivityPub and WebFinger implementation\n * \n * This script tests all the ActivityPub endpoints to ensure they're working correctly.\n */\n\nconst BASE_URL = 'https://your-val-name.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubEndpoints() {\n console.log('🧪 Testing ActivityPub and WebFinger endpoints...\\n');\n \n const tests = [\n {\n name: 'WebFinger - acct format',\n url: `${BASE_URL}/.well-known/webfinger?resource=acct:blog@your-domain.com`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'WebFinger - direct URL format',\n url: `${BASE_URL}/.well-known/webfinger?resource=${BASE_URL}/actor`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'ActivityPub Actor',\n url: `${BASE_URL}/actor`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Outbox',\n url: `${BASE_URL}/outbox`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Followers',\n url: `${BASE_URL}/followers`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Following',\n url: `${BASE_URL}/following`,\n expectedContentType: 'application/activity+json'\n }\n ];\n \n for (const test of tests) {\n try {\n console.log(`Testing: ${test.name}`);\n const response = await fetch(test.url);\n \n if (response.ok) {\n const contentType = response.headers.get('content-type');\n const data = await response.json();\n \n console.log(`✅ ${test.name}: OK (${response.status})`);\n console.log(` Content-Type: ${contentType}`);\n \n if (test.name.includes('WebFinger')) {\n console.log(` Subject: ${data.subject}`);\n console.log(` Links: ${data.links?.length || 0} found`);\n } else if (test.name.includes('Actor')) {\n console.log(` Type: ${data.type}`);\n console.log(` Username: ${data.preferredUsername}`);\n console.log(` Name: ${data.name}`);\n } else if (test.name.includes('Outbox')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n } else if (test.name.includes('Followers') || test.name.includes('Following')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n }\n \n console.log('');\n } else {\n console.log(`❌ ${test.name}: Failed (${response.status})`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n console.log('');\n }\n } catch (error) {\n console.log(`❌ ${test.name}: Error`);\n console.log(` ${error.message}`);\n console.log('');\n }\n }\n \n console.log('🎉 ActivityPub testing complete!');\n console.log('\\n📝 Next steps:');\n console.log('1. Replace BASE_URL with your actual domain');\n console.log('2. Test WebFinger with your actual domain in the resource parameter');\n console.log('3. Try following your blog from a Mastodon instance using @blog@your-domain.com');\n}\n\nexport default async function() {\n await testActivityPubEndpoints();\n return new Response('ActivityPub test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n}",[],[391],{"_103":399,"_95":400,"_154":401,"_156":-5,"_157":139,"_158":402,"_160":22,"_105":403,"_99":263,"_163":275,"_165":404,"_166":22,"_167":-5,"_168":405,"_98":406},"a190b8d2-5dca-11f0-a4b8-0224a6c84d84","test-publish.ts","9f538f54-5dca-11f0-a2a2-0224a6c84d84",26,["D",1752178532376],"// Test endpoint to simulate email publishing\nimport { createPost, generateUniqueSlug } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML } from \"./shared/utils.ts\";\nimport { CreatePostData } from \"./shared/types.ts\";\n\nexport default async function(req: Request) {\n try {\n // Initialize database\n await initializeDatabase();\n\n // Create a test post\n const title = \"Welcome to Email Blog!\";\n const content = `

Hello World!

This is a test post created to demonstrate the email blog platform.

Features include:

📧 Email-to-publish functionality
📡 RSS feed support
🌐 Clean, responsive design
🔗 SEO-friendly URLs

Send an email to start publishing your own posts!

`;\n \n const authorEmail = \"demo@example.com\";\n const authorName = \"Demo User\";\n \n // Generate slug\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n \n // Create post data\n const postData: CreatePostData = {\n title,\n slug,\n content,\n content_type: 'html',\n author_email: authorEmail,\n author_name: authorName\n };\n\n // Save post to database\n const post = await createPost(postData);\n \n return new Response(JSON.stringify({\n success: true,\n message: \"Test post created successfully!\",\n post: {\n id: post.id,\n title: post.title,\n slug: post.slug,\n author: post.author_name,\n published_at: post.published_at\n }\n }), {\n headers: { \"Content-Type\": \"application/json\" }\n });\n \n } catch (error) {\n console.error('Error creating test post:', error);\n return new Response(JSON.stringify({\n success: false,\n error: error.message\n }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n });\n }\n}",[],[400],"files",[151,170,176,187,197,203,212,222,231,239,248,257,268,280,287,296,303,312,322,332,342,351,360,369,380,389,398],"counts",{"_411":32,"_412":263,"_413":159,"_414":415},"pulls","branches","forks","envVars",{"_416":417,"_418":32},"count",9,"emptyCount","contents",[421,424,427,430,433,436,439,442,445,448,451,454],{"_103":152,"_95":153,"_154":155,"_156":-5,"_157":139,"_158":159,"_160":161,"_105":422,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":423},["D",1752177826946],[153],{"_103":281,"_95":282,"_154":283,"_156":-5,"_157":139,"_158":284,"_160":161,"_105":425,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":426},["D",1752178341352],[282],{"_103":297,"_95":298,"_154":299,"_156":-5,"_157":139,"_158":300,"_160":161,"_105":428,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":429},["D",1752177802723],[298],{"_103":323,"_95":324,"_154":325,"_156":-5,"_157":139,"_158":326,"_160":22,"_105":431,"_99":263,"_163":328,"_165":329,"_166":22,"_167":-5,"_98":432},["D",1752185548809],[324],{"_103":333,"_95":334,"_154":335,"_156":-5,"_157":139,"_158":336,"_160":22,"_105":434,"_99":338,"_163":328,"_165":339,"_166":22,"_167":-5,"_98":435},["D",1752229677898],[334],{"_103":343,"_95":344,"_154":345,"_156":-5,"_157":139,"_158":346,"_160":161,"_105":437,"_99":32,"_163":328,"_165":348,"_166":22,"_167":-5,"_98":438},["D",1752229744445],[344],{"_103":352,"_95":353,"_154":354,"_156":-5,"_157":139,"_158":355,"_160":22,"_105":440,"_99":159,"_163":328,"_165":357,"_166":22,"_167":-5,"_98":441},["D",1752179652511],[353],{"_103":361,"_95":362,"_154":363,"_156":-5,"_157":139,"_158":364,"_160":22,"_105":443,"_99":263,"_163":275,"_165":366,"_166":22,"_167":-5,"_98":444},["D",1752230116472],[362],{"_103":370,"_95":371,"_154":372,"_156":-5,"_157":139,"_158":373,"_160":22,"_105":446,"_99":182,"_163":375,"_165":376,"_166":22,"_167":377,"_98":447},["D",1752230208439],[371],{"_103":381,"_95":382,"_154":383,"_156":-5,"_157":139,"_158":384,"_160":22,"_105":449,"_99":263,"_163":275,"_165":386,"_166":22,"_167":-5,"_98":450},["D",1752185367288],[382],{"_103":390,"_95":391,"_154":392,"_156":-5,"_157":139,"_158":393,"_160":22,"_105":452,"_99":263,"_163":275,"_165":395,"_166":22,"_167":-5,"_98":453},["D",1752184299952],[391],{"_103":399,"_95":400,"_154":401,"_156":-5,"_157":139,"_158":402,"_160":22,"_105":455,"_99":263,"_163":275,"_165":404,"_166":22,"_167":-5,"_98":456},["D",1752178532376],[400],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_101":465,"_99":100,"_470":471},{"_103":104,"_95":96,"_105":466,"_107":-5,"_108":22,"_109":110,"_111":112,"_113":-5,"_14":114,"_115":-5,"_116":22,"_117":-5,"_118":119,"_16":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":467,"_133":468,"_136":469,"_148":22},["D",1752177490232],{"_93":94,"_131":132},{"_93":94,"_135":132,"_14":114},{"_99":138,"_95":43,"_103":139,"_140":104,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":96,"_147":94},"changes",[472],{"_328":473,"_475":476,"_166":22,"_98":478,"_479":478},{"_154":234,"_95":233,"_163":183,"_165":236,"_105":474,"_158":100,"_157":139},["D",1752230307844],"previous",{"_154":234,"_95":233,"_163":183,"_165":477},"import { email } from \"https://esm.town/v/std/email\";\n\n/**\n * Extract email address from display name format\n */\nfunction extractEmailAddress(emailString: string): string {\n // Handle formats like \"Display Name \" or just \"email@domain.com\"\n const match = emailString.match(/<([^>]+)>/);\n if (match) {\n return match[1].trim();\n }\n return emailString.trim();\n}\n\n/**\n * Check if an email address is in the allowed list\n */\nexport function isEmailAllowed(emailAddress: string): boolean {\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n \n console.log('🔍 Email allowlist check:', {\n checkingEmail: emailAddress,\n envVarExists: !!allowedEmails,\n envVarValue: allowedEmails ? `${allowedEmails.substring(0, 50)}${allowedEmails.length > 50 ? '...' : ''}` : null\n });\n \n if (!allowedEmails) {\n console.error('❌ ALLOWED_EMAIL_ADDRESSES environment variable not set. No emails will be allowed.');\n return false;\n }\n\n // Parse the comma-separated list of allowed emails\n const allowedList = allowedEmails\n .split(',')\n .map(email => email.trim().toLowerCase())\n .filter(email => email.length > 0);\n\n console.log('📋 Parsed allowed emails:', {\n rawCount: allowedEmails.split(',').length,\n processedCount: allowedList.length,\n allowedList: allowedList\n });\n\n // Extract the actual email address from display name format\n const extractedEmail = extractEmailAddress(emailAddress);\n const normalizedEmail = extractedEmail.toLowerCase();\n const isAllowed = allowedList.includes(normalizedEmail);\n \n console.log('✅ Allowlist result:', {\n originalEmail: emailAddress,\n extractedEmail: extractedEmail,\n normalizedEmail: normalizedEmail,\n isAllowed: isAllowed,\n matchedAgainst: allowedList\n });\n \n return isAllowed;\n}\n\n/**\n * Generate a secure random token for verification\n */\nexport function generateVerificationToken(): string {\n const array = new Uint8Array(32);\n crypto.getRandomValues(array);\n return Array.from(array, byte => byte.toString(16).padStart(2, '0')).join('');\n}\n\n/**\n * Send verification email to the sender\n */\nexport async function sendVerificationEmail(\n recipientEmail: string,\n verificationToken: string,\n postTitle: string\n): Promise {\n console.log('📧 Preparing verification email:', {\n recipientEmail: recipientEmail,\n postTitle: postTitle,\n tokenLength: verificationToken.length\n });\n\n const baseUrl = Deno.env.get('BASE_URL') || 'https://your-val-town-url.web.val.run';\n const verificationUrl = `${baseUrl}/verify-email?token=${verificationToken}`;\n\n console.log('🔗 Verification URL generated:', {\n baseUrl: baseUrl,\n fullUrl: verificationUrl\n });\n\n const subject = `Verify your blog post: ${postTitle}`;\n \n const htmlContent = `\n \n \n

Verify Your Blog Post

Hello,

We received a blog post submission with the title \"${postTitle}\" from this email address.

To confirm that you sent this post and publish it to the blog, please click the verification link below:

\n \n Verify and Publish Post\n \n

Or copy and paste this link into your browser:

\n ${verificationUrl}\n

Important: This verification link will expire in 24 hours for security reasons.

If you did not send this blog post, please ignore this email. The post will not be published without verification.

\n This is an automated message from your blog system. Please do not reply to this email.\n