${post.title}

${truncateHTML(post.content, 300)}

Verify Your Blog Post

Hello,

We received a blog post submission with the title \"${postTitle}\" from this email address.

To confirm that you sent this post and publish it to the blog, please click the verification link below:

\n \n Verify and Publish Post\n \n

Or copy and paste this link into your browser:

\n ${verificationUrl}\n

Important: This verification link will expire in 24 hours for security reasons.

If you did not send this blog post, please ignore this email. The post will not be published without verification.

\n This is an automated message from your blog system. Please do not reply to this email.\n

\n \n \n `;\n\n const textContent = `\nVerify Your Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"${postTitle}\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please visit this verification link:\n\n${verificationUrl}\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email. The post will not be published without verification.\n\n---\nThis is an automated message from your blog system. Please do not reply to this email.\n `;\n\n console.log(\"📤 Sending email via Val Town email service:\", {\n to: recipientEmail,\n subject: subject,\n htmlLength: htmlContent.length,\n textLength: textContent.length,\n });\n\n try {\n await email({\n to: recipientEmail,\n subject: subject,\n html: htmlContent,\n text: textContent,\n });\n\n console.log(\"✅ Verification email sent successfully:\", {\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n } catch (error) {\n console.error(\"❌ Failed to send verification email:\", {\n error: error.message,\n stack: error.stack,\n recipientEmail: recipientEmail,\n subject: subject,\n verificationUrl: verificationUrl,\n });\n throw new Error(`Failed to send verification email: ${error.message}`);\n }\n}\n\n/**\n * Calculate expiration time (24 hours from now)\n */\nexport function getVerificationExpiration(): string {\n const expirationTime = new Date();\n expirationTime.setHours(expirationTime.getHours() + 24);\n return expirationTime.toISOString();\n}",[],[154,201,235],{"_104":243,"_95":244,"_155":245,"_157":202,"_158":140,"_159":246,"_161":22,"_106":247,"_100":248,"_164":184,"_166":249,"_167":22,"_168":-5,"_169":250,"_98":251},"763e60ec-5e49-11f0-80c0-0224a6c84d84","http-signatures.ts","042bd184-5e48-11f0-814c-0224a6c84d84",181,["D",1752233005781],2,"/**\n * HTTP Signatures implementation for ActivityPub\n * Based on the HTTP Signatures specification: https://tools.ietf.org/html/draft-cavage-http-signatures\n */\n\n// Store for RSA key pair (cached after first load)\nlet keyPairCache: { publicKey: CryptoKey; privateKey: CryptoKey; publicKeyPem: string } | null = null;\n\n/**\n * Get the RSA key pair for HTTP signatures from environment variables\n */\nasync function getKeyPair(): Promise<{ publicKey: CryptoKey; privateKey: CryptoKey; publicKeyPem: string }> {\n if (keyPairCache) {\n return keyPairCache;\n }\n\n try {\n // Try to load keys from environment variables first\n const publicKeyPem = Deno.env.get('ACTIVITYPUB_PUBLIC_KEY');\n const privateKeyPem = Deno.env.get('ACTIVITYPUB_PRIVATE_KEY');\n\n if (publicKeyPem && privateKeyPem) {\n console.log('🔐 Loading RSA key pair from environment variables...');\n \n // Import public key\n const publicKeyBuffer = Uint8Array.from(\n atob(publicKeyPem.replace(/-----BEGIN PUBLIC KEY-----|\\n|-----END PUBLIC KEY-----/g, '')),\n c => c.charCodeAt(0)\n );\n const publicKey = await crypto.subtle.importKey(\n 'spki',\n publicKeyBuffer,\n {\n name: 'RSASSA-PKCS1-v1_5',\n hash: 'SHA-256',\n },\n false,\n ['verify']\n );\n\n // Import private key\n const privateKeyBuffer = Uint8Array.from(\n atob(privateKeyPem.replace(/-----BEGIN PRIVATE KEY-----|\\n|-----END PRIVATE KEY-----/g, '')),\n c => c.charCodeAt(0)\n );\n const privateKey = await crypto.subtle.importKey(\n 'pkcs8',\n privateKeyBuffer,\n {\n name: 'RSASSA-PKCS1-v1_5',\n hash: 'SHA-256',\n },\n false,\n ['sign']\n );\n\n keyPairCache = {\n publicKey,\n privateKey,\n publicKeyPem\n };\n\n console.log('✅ RSA key pair loaded from environment variables');\n return keyPairCache;\n }\n\n // Fallback: Generate temporary keys (not recommended for production)\n console.log('⚠️ No persistent keys found in environment variables');\n console.log('🔐 Generating temporary RSA key pair (will change on restart)...');\n \n const keyPair = await crypto.subtle.generateKey(\n {\n name: \"RSASSA-PKCS1-v1_5\",\n modulusLength: 2048,\n publicExponent: new Uint8Array([1, 0, 1]),\n hash: \"SHA-256\",\n },\n true, // extractable\n [\"sign\", \"verify\"]\n );\n\n // Export public key to PEM format\n const publicKeyBuffer = await crypto.subtle.exportKey(\"spki\", keyPair.publicKey);\n const publicKeyBase64 = btoa(String.fromCharCode(...new Uint8Array(publicKeyBuffer)));\n const generatedPublicKeyPem = `-----BEGIN PUBLIC KEY-----\\n${publicKeyBase64.match(/.{1,64}/g)?.join('\\n')}\\n-----END PUBLIC KEY-----`;\n\n keyPairCache = {\n publicKey: keyPair.publicKey,\n privateKey: keyPair.privateKey,\n publicKeyPem: generatedPublicKeyPem\n };\n\n console.log('⚠️ Temporary RSA key pair generated - set ACTIVITYPUB_PUBLIC_KEY and ACTIVITYPUB_PRIVATE_KEY for persistence');\n return keyPairCache;\n \n } catch (error) {\n console.error('❌ Failed to load/generate RSA key pair:', error);\n throw error;\n }\n}\n\n/**\n * Create HTTP signature for ActivityPub request\n */\nexport async function createHttpSignature(\n method: string,\n url: string,\n headers: Record,\n body?: string\n): Promise {\n try {\n const urlObj = new URL(url);\n const host = urlObj.host;\n const path = urlObj.pathname + urlObj.search;\n const date = headers['date'] || new Date().toUTCString();\n \n // Create the signing string\n const signingStringParts = [\n `(request-target): ${method.toLowerCase()} ${path}`,\n `host: ${host}`,\n `date: ${date}`\n ];\n \n if (body && headers['digest']) {\n signingStringParts.push(`digest: ${headers['digest']}`);\n }\n \n const signingString = signingStringParts.join('\\n');\n \n console.log('📝 HTTP Signature signing string created:', {\n method,\n host,\n path,\n date,\n hasDigest: !!(body && headers['digest']),\n signingStringLength: signingString.length\n });\n \n // Get key pair\n const { privateKey } = await getKeyPair();\n \n // Sign the signing string\n const encoder = new TextEncoder();\n const data = encoder.encode(signingString);\n const signatureBuffer = await crypto.subtle.sign(\n \"RSASSA-PKCS1-v1_5\",\n privateKey,\n data\n );\n \n // Convert signature to base64\n const signatureBase64 = btoa(String.fromCharCode(...new Uint8Array(signatureBuffer)));\n \n // Create signature header\n const keyId = `${urlObj.protocol}//${host}/actor#main-key`;\n const algorithm = 'rsa-sha256';\n const headersList = body ? '(request-target) host date digest' : '(request-target) host date';\n \n const signatureHeader = `keyId=\"${keyId}\",algorithm=\"${algorithm}\",headers=\"${headersList}\",signature=\"${signatureBase64}\"`;\n \n console.log('✅ HTTP signature created successfully:', {\n keyId,\n algorithm,\n headers: headersList,\n signatureLength: signatureBase64.length\n });\n \n return signatureHeader;\n \n } catch (error) {\n console.error('❌ Error creating HTTP signature:', error);\n throw error;\n }\n}\n\n/**\n * Create SHA-256 digest for request body\n */\nexport async function createDigest(body: string): Promise {\n try {\n // Use Web Crypto API to create SHA-256 hash\n const encoder = new TextEncoder();\n const data = encoder.encode(body);\n const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n const hashArray = new Uint8Array(hashBuffer);\n const hashBase64 = btoa(String.fromCharCode(...hashArray));\n return `SHA-256=${hashBase64}`;\n } catch (error) {\n console.error('❌ Error creating digest:', error);\n throw error;\n }\n}\n\n/**\n * Check if HTTP signatures are properly configured\n */\nexport function isHttpSignaturesEnabled(): boolean {\n // Enable HTTP signatures now that we have a proper implementation\n return true;\n}\n\n/**\n * Get the public key PEM for the actor document\n */\nexport async function getPublicKeyPem(): Promise {\n const { publicKeyPem } = await getKeyPair();\n return publicKeyPem;\n}\n\n/**\n * Create headers for ActivityPub request with optional HTTP signature\n */\nexport async function createActivityPubHeaders(\n method: string,\n url: string,\n body?: string\n): Promise> {\n const headers: Record = {\n 'Content-Type': 'application/activity+json',\n 'Accept': 'application/activity+json',\n 'User-Agent': 'EmailBlog/1.0 (ActivityPub Bot)',\n 'Date': new Date().toUTCString()\n };\n \n if (body) {\n headers['Digest'] = await createDigest(body);\n }\n \n if (isHttpSignaturesEnabled()) {\n try {\n headers['Signature'] = await createHttpSignature(method, url, headers, body);\n console.log('✅ HTTP signature added to headers');\n } catch (error) {\n console.error('❌ Failed to create HTTP signature, proceeding without:', error.message);\n }\n } else {\n console.log('⚠️ HTTP signatures disabled - some servers may reject unsigned requests');\n }\n \n return headers;\n}",[],[154,201,244],{"_104":253,"_95":254,"_155":255,"_157":202,"_158":140,"_159":256,"_161":162,"_106":257,"_100":32,"_164":184,"_166":258,"_167":22,"_168":-5,"_169":259,"_98":260},"1410fe72-5dca-11f0-bb45-0224a6c84d84","rss.ts","1410ff4e-5dca-11f0-bb45-0224a6c84d84",11,["D",1752178294984],"import { BlogPost, RSSItem } from \"../../shared/types.ts\";\nimport { formatRSSDate, truncateHTML } from \"../../shared/utils.ts\";\n\n/**\n * Generate RSS 2.0 feed XML\n */\nexport function generateRSSFeed(posts: BlogPost[], baseUrl: string): string {\n const now = new Date();\n const items = posts.map(post => generateRSSItem(post, baseUrl));\n \n const rssXML = `\n\n \n Email Blog\n ${baseUrl}\n A blog powered by email publishing\n en-us\n ${formatRSSDate(now)}\n Email Blog Platform\n \n blog@${getDomain(baseUrl)} (Email Blog)\n blog@${getDomain(baseUrl)} (Email Blog)\n 60\n \n ${items.map(item => `\n \n <![CDATA[${item.title}]]>\n ${item.link}\n ${item.guid}\n \n \n ${item.pubDate}\n ${item.author}\n `).join('')}\n \n`;\n\n return rssXML;\n}\n\n/**\n * Generate RSS item from blog post\n */\nfunction generateRSSItem(post: BlogPost, baseUrl: string): RSSItem & { content: string } {\n const link = `${baseUrl}/post/${post.slug}`;\n const description = truncateHTML(post.content, 300);\n \n return {\n title: post.title,\n link,\n guid: link,\n description,\n content: post.content,\n pubDate: formatRSSDate(new Date(post.published_at)),\n author: `${post.author_email} (${post.author_name || post.author_email})`\n };\n}\n\n/**\n * Extract domain from URL\n */\nfunction getDomain(url: string): string {\n try {\n return new URL(url).hostname;\n } catch {\n return 'localhost';\n }\n}",[],[154,201,254],{"_104":262,"_95":263,"_155":264,"_157":202,"_158":140,"_159":265,"_161":22,"_106":266,"_100":248,"_164":184,"_166":267,"_167":22,"_168":-5,"_169":268,"_98":269},"1c7cb4c2-5e45-11f0-8774-0224a6c84d84","webfinger.ts","3663d62c-5dd7-11f0-afd7-0224a6c84d84",154,["D",1752231137208],"/**\n * WebFinger implementation for ActivityPub discovery\n * \n * WebFinger allows users to discover ActivityPub actors using the format:\n * acct:username@domain.com\n * \n * The WebFinger endpoint is typically at:\n * /.well-known/webfinger?resource=acct:username@domain.com\n */\n\nexport interface WebFingerResource {\n subject: string;\n aliases?: string[];\n properties?: { [key: string]: string | null };\n links: WebFingerLink[];\n}\n\nexport interface WebFingerLink {\n rel: string;\n type?: string;\n href?: string;\n template?: string;\n titles?: { [lang: string]: string };\n properties?: { [key: string]: string | null };\n}\n\n/**\n * Generate WebFinger response for the blog actor\n */\nexport function generateWebFingerResponse(resource: string, domain: string): WebFingerResource | null {\n // Parse the resource parameter\n // Expected formats:\n // - acct:blog@domain.com\n // - acct:username@domain.com\n // - https://domain.com/actor\n \n let username: string;\n let requestedDomain: string;\n \n if (resource.startsWith('acct:')) {\n const acctPart = resource.substring(5); // Remove 'acct:' prefix\n const parts = acctPart.split('@');\n if (parts.length !== 2) {\n return null;\n }\n username = parts[0];\n requestedDomain = parts[1];\n } else if (resource.startsWith('https://')) {\n // Handle direct actor URL requests\n const url = new URL(resource);\n if (url.pathname === '/actor') {\n requestedDomain = url.hostname;\n username = 'blog'; // Default username for the blog\n } else {\n return null;\n }\n } else {\n return null;\n }\n \n // Verify the domain matches\n if (requestedDomain !== domain) {\n return null;\n }\n \n // For now, we only support the main blog actor\n // In a multi-user system, you'd check if the username exists\n if (username !== 'blog') {\n return null;\n }\n \n const actorUrl = `https://${domain}/actor`;\n const profileUrl = `https://${domain}/`;\n \n return {\n subject: `acct:${username}@${domain}`,\n aliases: [\n actorUrl,\n profileUrl\n ],\n properties: {\n \"http://schema.org/name\": \"Email Blog\"\n },\n links: [\n {\n rel: \"http://webfinger.net/rel/profile-page\",\n type: \"text/html\",\n href: profileUrl\n },\n {\n rel: \"self\",\n type: \"application/activity+json\",\n href: actorUrl\n },\n {\n rel: \"http://ostatus.org/schema/1.0/subscribe\",\n template: `https://${domain}/authorize_interaction?uri={uri}`\n }\n ]\n };\n}\n\n/**\n * Validate WebFinger resource parameter\n */\nexport function isValidWebFingerResource(resource: string): boolean {\n if (!resource) return false;\n \n // Check for acct: format\n if (resource.startsWith('acct:')) {\n const acctPart = resource.substring(5);\n const parts = acctPart.split('@');\n return parts.length === 2 && parts[0].length > 0 && parts[1].length > 0;\n }\n \n // Check for direct URL format\n if (resource.startsWith('https://')) {\n try {\n new URL(resource);\n return true;\n } catch {\n return false;\n }\n }\n \n return false;\n}\n\n/**\n * Extract domain from various sources\n */\nexport function extractDomain(request: Request): string {\n // Try to get domain from BASE_URL environment variable first (for custom domains)\n const baseUrl = Deno.env.get('BASE_URL');\n if (baseUrl) {\n try {\n // Handle BASE_URL with or without protocol\n let urlToProcess = baseUrl;\n if (!baseUrl.startsWith('http://') && !baseUrl.startsWith('https://')) {\n urlToProcess = `https://${baseUrl}`;\n }\n const url = new URL(urlToProcess);\n return url.hostname;\n } catch {\n // If BASE_URL is malformed, fall through to other methods\n }\n }\n \n // Try to get domain from ACTIVITYPUB_DOMAIN environment variable\n const envDomain = Deno.env.get('ACTIVITYPUB_DOMAIN');\n if (envDomain) {\n return envDomain;\n }\n \n // Fall back to Host header\n const host = request.headers.get('host');\n if (host) {\n return host;\n }\n \n // Last resort: try to extract from URL\n try {\n const url = new URL(request.url);\n return url.hostname;\n } catch {\n return 'localhost';\n }\n}",[],[154,201,263],{"_104":271,"_95":272,"_155":273,"_157":202,"_158":140,"_159":274,"_161":162,"_106":275,"_100":276,"_164":184,"_166":277,"_167":22,"_168":-5,"_169":278,"_98":279},"7bb1ba76-5dca-11f0-8d47-0224a6c84d84","websub.ts","1eea101e-5dc9-11f0-b5a0-0224a6c84d84",22,["D",1752178468845],1,"import { getActiveWebSubSubscriptions, addWebSubSubscription } from \"../database/queries.ts\";\n\n/**\n * Notify WebSub subscribers of new content\n */\nexport async function notifyWebSubSubscribers(): Promise {\n const hubUrl = Deno.env.get('WEBSUB_HUB_URL');\n if (!hubUrl) {\n console.log('WebSub hub URL not configured, skipping notifications');\n return;\n }\n\n try {\n const subscriptions = await getActiveWebSubSubscribers();\n \n if (subscriptions.length === 0) {\n console.log('No active WebSub subscriptions found');\n return;\n }\n\n // Notify the hub that our feed has been updated\n const topicUrl = `${getBaseUrl()}/rss`;\n \n const formData = new FormData();\n formData.append('hub.mode', 'publish');\n formData.append('hub.url', topicUrl);\n\n const response = await fetch(hubUrl, {\n method: 'POST',\n body: formData\n });\n\n if (response.ok) {\n console.log(`WebSub hub notified successfully for ${subscriptions.length} subscriptions`);\n } else {\n console.error('Failed to notify WebSub hub:', response.status, await response.text());\n }\n } catch (error) {\n console.error('Error notifying WebSub subscribers:', error);\n throw error;\n }\n}\n\n/**\n * Handle WebSub subscription requests\n */\nexport async function handleWebSubSubscription(\n mode: string,\n callback: string,\n topic: string,\n challenge?: string,\n leaseSeconds?: number,\n secret?: string\n): Promise {\n const expectedTopic = `${getBaseUrl()}/rss`;\n \n if (topic !== expectedTopic) {\n throw new Error(`Invalid topic URL: ${topic}`);\n }\n\n if (mode === 'subscribe') {\n // Store subscription (will be verified when challenge is confirmed)\n await addWebSubSubscription(callback, topic, leaseSeconds, secret);\n \n if (challenge) {\n // Verify the subscription by returning the challenge\n return challenge;\n }\n } else if (mode === 'unsubscribe') {\n // Handle unsubscription\n await removeWebSubSubscription(callback);\n \n if (challenge) {\n return challenge;\n }\n }\n\n return null;\n}\n\nfunction getBaseUrl(): string {\n // In Val Town, we can construct the base URL from the current environment\n // This would need to be configured based on your actual domain\n return 'https://your-val-name.web.val.run';\n}\n\n// Helper function to remove subscription (implement in queries.ts if needed)\nasync function removeWebSubSubscription(callbackUrl: string): Promise {\n // Implementation would go in queries.ts\n console.log(`Removing WebSub subscription for ${callbackUrl}`);\n}",[],[154,201,272],[154,201],{"_104":282,"_95":283,"_155":284,"_157":156,"_158":140,"_159":285,"_161":22,"_106":286,"_100":287,"_164":288,"_166":289,"_167":22,"_168":-5,"_169":290,"_98":291},"99766f1e-5e49-11f0-b40c-0224a6c84d84","index.ts","260c9582-5dca-11f0-b2ad-0224a6c84d84",183,["D",1752233064870],55,"http","import { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { getAllPosts, getPostBySlug, getRecentPosts, getActiveFollowers, getFollowerCount, getPostActivityCounts, getEmailVerificationByToken, markEmailVerified, publishDraftPost } from \"./database/queries.ts\";\nimport { initializeDatabase } from \"./database/schema.ts\";\nimport { generateActorDocument } from \"./services/activitypub.ts\";\nimport { generateRSSFeed } from \"./services/rss.ts\";\nimport { extractDomain, generateWebFingerResponse, isValidWebFingerResource } from \"./services/webfinger.ts\";\nimport { handleWebSubSubscription } from \"./services/websub.ts\";\nimport { processInboxActivity } from \"./services/activitypub-inbox.ts\";\nimport { notifyWebSubSubscribers } from \"./services/websub.ts\";\nimport { publishToActivityPub } from \"./services/activitypub.ts\";\nimport { publishToATProtocol } from \"./services/atprotocol.ts\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, c) => {\n throw err;\n});\n\n// Initialize database lazily on first request to avoid startup memory issues\nlet dbInitialized = false;\nasync function ensureDbInitialized() {\n if (!dbInitialized) {\n await initializeDatabase();\n dbInitialized = true;\n }\n}\n\n// Get base URL for the application\nfunction getBaseUrl(c: any): string {\n // Prioritize BASE_URL environment variable for custom domains\n const baseUrl = Deno.env.get('BASE_URL');\n if (baseUrl) {\n // Ensure the BASE_URL has a protocol\n if (baseUrl.startsWith('http://') || baseUrl.startsWith('https://')) {\n return baseUrl.replace(/\\/$/, ''); // Remove trailing slash if present\n } else {\n // Assume https if no protocol is specified\n return `https://${baseUrl}`;\n }\n }\n \n // Fall back to request headers\n const host = c.req.header(\"host\") || \"localhost:3000\";\n const protocol = c.req.header(\"x-forwarded-proto\") || \"https\";\n return `${protocol}://${host}`;\n}\n\n// Format date for display\nfunction formatDate(dateString: string): string {\n const date = new Date(dateString);\n return date.toLocaleDateString(\"en-US\", {\n year: \"numeric\",\n month: \"long\",\n day: \"numeric\",\n hour: \"2-digit\",\n minute: \"2-digit\",\n });\n}\n\n// Truncate content for previews\nfunction truncateContent(content: string, maxLength: number = 300): string {\n const text = content.replace(/<[^>]*>/g, \"\");\n if (text.length <= maxLength) return text;\n return text.substring(0, maxLength).trim() + \"...\";\n}\n\n// Generate verification success HTML\nfunction generateVerificationSuccessHTML(message: string, alreadyPublished: boolean = false, postUrl?: string): string {\n return `\n\n\n \n \n Email Verified - Email Blog\n \n \n\n\n

\n ${alreadyPublished ? '📝' : '✅'}\n

\n ${alreadyPublished ? 'Already Published' : 'Email Verified!'}\n

${escapeHtml(message)}

\n ${postUrl ? `\n \n View Your Post\n \n ` : ''}\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate verification error HTML\nfunction generateVerificationErrorHTML(message: string): string {\n return `\n\n\n \n \n Verification Error - Email Blog\n \n \n\n\n

\n ❌\n

Verification Failed

${escapeHtml(message)}

\n If you believe this is an error, please try sending your email again.\n

\n \n ← Back to Blog\n \n

\n\n`;\n}\n\n// Generate main blog HTML\nfunction generateBlogHTML(posts: any[], baseUrl: string): string {\n const postsHTML = posts.length === 0\n ? `

\n ✉️\n

No posts yet

Send an email to start publishing!

`\n : posts.map(post => `\n

\n \n ${escapeHtml(post.title)}\n \n

\n By ${escapeHtml(post.author_name || post.author_email)}\n ${formatDate(post.published_at)}\n

${escapeHtml(truncateContent(post.content))}

\n \n Read more →\n \n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n `).join(\"\");\n\n return `\n\n\n \n \n Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n 📧\n

Email Blog

\n \n

\n\n \n

\n ${postsHTML}\n

\n\n \n \n\n`;\n}\n\n// Generate individual post HTML\nfunction generatePostHTML(post: any, baseUrl: string, activityCounts?: { likes: number; shares: number; replies: number }): string {\n const postUrl = `${baseUrl}/post/${post.slug}`;\n const description = post.content.replace(/<[^>]*>/g, \"\").substring(0, 160);\n\n return `\n\n\n \n \n ${escapeHtml(post.title)} - Email Blog\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n 📧\">\n \n \n \n \n\n\n \n

\n \n 📧\n

Email Blog

← Back to all posts

\n \n \n

\n\n \n

\n \n

${escapeHtml(post.title)}

\n 👤\n ${escapeHtml(post.author_name || post.author_email)}\n

\n 📅\n ${formatDate(post.published_at)}\n

\n ${post.content_type === \"html\" ? \"🌐 HTML\" : \"📝 Text\"}\n

\n\n \n

\n ${post.content}\n

\n\n \n \n

\n\n \n \n\n \n\n`;\n}\n\n// Generate 404 HTML\nfunction generate404HTML(): string {\n return `\n\n\n \n \n Post Not Found - Email Blog\n \n \n\n\n

\n ❌\n

Post Not Found

The requested post could not be found.

\n ← Back to Blog\n

\n\n`;\n}\n\n// Escape HTML to prevent XSS\nfunction escapeHtml(text: string): string {\n const map: { [key: string]: string } = {\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n \"\\\"\": \""\",\n \"'\": \"'\",\n };\n return text.replace(/[&<>\"']/g, (m) => map[m]);\n}\n\n// Get custom CSS\nfunction getCustomCSS(): string {\n return `\n /* Typography */\n .prose {\n max-width: none;\n }\n .prose h1 { @apply text-3xl font-bold text-gray-900 mb-4; }\n .prose h2 { @apply text-2xl font-semibold text-gray-800 mb-3 mt-6; }\n .prose h3 { @apply text-xl font-medium text-gray-700 mb-2 mt-4; }\n .prose p { @apply text-gray-600 mb-4 leading-relaxed; }\n .prose a { @apply text-blue-600 hover:text-blue-800 underline; }\n .prose ul, .prose ol { @apply mb-4 pl-6; }\n .prose li { @apply mb-1; }\n .prose blockquote { @apply border-l-4 border-gray-300 pl-4 italic text-gray-600 my-4; }\n .prose code { @apply bg-gray-100 px-1 py-0.5 rounded text-sm font-mono; }\n .prose pre { @apply bg-gray-100 p-4 rounded overflow-x-auto mb-4; }\n .prose pre code { @apply bg-transparent p-0; }\n\n /* Blog post styling */\n .blog-post-content { @apply prose max-w-none; }\n .blog-post-content img { @apply max-w-full h-auto rounded-lg shadow-sm my-4; }\n\n /* Post cards */\n .post-card { @apply bg-white rounded-lg shadow-sm border border-gray-200 hover:shadow-md transition-shadow duration-200; }\n .post-card:hover { @apply border-gray-300; }\n\n /* Email icon animation */\n .email-icon { animation: bounce 2s infinite; }\n @keyframes bounce {\n 0%, 20%, 53%, 80%, 100% { transform: translateY(0); }\n 40%, 43% { transform: translateY(-10px); }\n 70% { transform: translateY(-5px); }\n 90% { transform: translateY(-2px); }\n }\n\n /* Social links */\n .social-links a { @apply inline-flex items-center px-3 py-2 text-sm font-medium text-gray-600 hover:text-gray-900 hover:bg-gray-100 rounded-md transition-colors duration-200; }\n\n /* Responsive adjustments */\n @media (max-width: 640px) {\n .prose h1 { @apply text-2xl; }\n .prose h2 { @apply text-xl; }\n .prose h3 { @apply text-lg; }\n }\n `;\n}\n\n// Serve static files\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n\n// Main blog page\napp.get(\"/\", async c => {\n try {\n await ensureDbInitialized();\n const posts = await getAllPosts(20);\n const baseUrl = getBaseUrl(c);\n\n const html = generateBlogHTML(posts, baseUrl);\n \n // Add Link headers for ActivityPub discovery\n return c.html(html, 200, {\n \"Link\": `<${baseUrl}/actor>; rel=\"alternate\"; type=\"application/activity+json\"`\n });\n } catch (error) {\n console.error(\"Error serving main page:\", error);\n return c.text(\"Error loading blog\", 500);\n }\n});\n\n// Individual post page\napp.get(\"/post/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.html(generate404HTML(), 404);\n }\n\n // Check if this is an ActivityPub request\n const acceptHeader = c.req.header(\"accept\") || \"\";\n const isActivityPubRequest = acceptHeader.includes(\"application/activity+json\") || \n acceptHeader.includes(\"application/ld+json\");\n\n if (isActivityPubRequest) {\n // Return ActivityPub Note object\n const baseUrl = getBaseUrl(c);\n const contentHtml = post.content_type === 'html' \n ? post.content \n : `

${post.content.replace(/\\n/g, '
')}

`;\n \n const textContent = post.content.replace(/<[^>]*>/g, '');\n const summary = textContent.length > 200 \n ? textContent.substring(0, 200) + '...' \n : textContent;\n\n const note = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"Note\",\n id: `${baseUrl}/post/${post.slug}`,\n attributedTo: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n url: `${baseUrl}/post/${post.slug}`,\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n name: post.title,\n summary: summary,\n content: `

${post.title}

${contentHtml}`,\n source: {\n content: post.content,\n mediaType: post.content_type === 'html' ? 'text/html' : 'text/plain'\n },\n tag: [],\n attachment: [],\n sensitive: false,\n // Add replies collection\n replies: {\n type: \"Collection\",\n id: `${baseUrl}/post/${post.slug}/replies`,\n totalItems: 0,\n items: []\n }\n };\n\n return c.json(note, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return HTML for regular requests\n // Get activity counts for this post\n const activityCounts = await getPostActivityCounts(slug);\n\n const baseUrl = getBaseUrl(c);\n const html = generatePostHTML(post, baseUrl, activityCounts);\n \n // Add Link header for ActivityPub discovery\n return c.html(html, 200, {\n \"Link\": `<${baseUrl}/post/${slug}>; rel=\"alternate\"; type=\"application/activity+json\"`\n });\n } catch (error) {\n console.error(\"Error serving post:\", error);\n return c.text(\"Error loading post\", 500);\n }\n});\n\n// RSS feed\napp.get(\"/rss\", async c => {\n try {\n await ensureDbInitialized();\n const posts = await getRecentPosts(50);\n const baseUrl = getBaseUrl(c);\n const rssXML = generateRSSFeed(posts, baseUrl);\n\n return c.text(rssXML, 200, {\n \"Content-Type\": \"application/rss+xml; charset=utf-8\",\n \"Cache-Control\": \"public, max-age=3600\",\n });\n } catch (error) {\n console.error(\"Error generating RSS feed:\", error);\n return c.text(\"Error generating RSS feed\", 500);\n }\n});\n\n// API: Get all posts\napp.get(\"/api/posts\", async c => {\n try {\n await ensureDbInitialized();\n const limit = parseInt(c.req.query(\"limit\") || \"20\");\n const offset = parseInt(c.req.query(\"offset\") || \"0\");\n const posts = await getAllPosts(limit, offset);\n\n return c.json({ posts });\n } catch (error) {\n console.error(\"Error fetching posts:\", error);\n return c.json({ error: \"Failed to fetch posts\" }, 500);\n }\n});\n\n// API: Get single post\napp.get(\"/api/posts/:slug\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n // Get activity counts\n const activityCounts = await getPostActivityCounts(slug);\n\n return c.json({ post, activityCounts });\n } catch (error) {\n console.error(\"Error fetching post:\", error);\n return c.json({ error: \"Failed to fetch post\" }, 500);\n }\n});\n\n// Human-readable followers page\napp.get(\"/followers-list\", async c => {\n try {\n await ensureDbInitialized();\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n const baseUrl = getBaseUrl(c);\n\n const html = `\n\n\n \n \n Followers - Email Blog\n \n \n\n\n

Followers

\n \n ${followerCount} follower${followerCount !== 1 ? 's' : ''}\n \n

\n \n ${followers.length === 0 ? `\n

\n 👥\n

No followers yet

Share your blog to get your first followers!

\n People can follow @blog@${new URL(baseUrl).hostname} from Mastodon\n

\n ` : `\n

\n ${followers.map(follower => `\n

\n ${follower.actor_icon_url ? `\n $\"${escapeHtml(follower.actor_display_name$ \n ` : `\n

\n ${(follower.actor_display_name || follower.actor_username || 'U')[0].toUpperCase()}\n

\n `}\n

\n ${escapeHtml(follower.actor_display_name || follower.actor_username || 'Unknown User')}\n

\n ${follower.actor_username ? `\n @${escapeHtml(follower.actor_username)}\n ` : ''}\n

\n ${follower.actor_domain ? `\n 📍 ${escapeHtml(follower.actor_domain)}\n ` : ''}\n 📅 Followed ${formatDate(follower.followed_at)}\n

\n \n View Profile →\n \n

\n `).join('')}\n

\n `}\n \n

\n \n ← Back to Blog\n \n

\n JSON API\n •\n ActivityPub\n

\n\n`;\n\n return c.html(html);\n } catch (error) {\n console.error(\"Error serving followers page:\", error);\n return c.text(\"Error loading followers\", 500);\n }\n});\n\n// API: Get followers list (human-readable)\napp.get(\"/api/followers\", async c => {\n try {\n await ensureDbInitialized();\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n\n return c.json({\n totalFollowers: followerCount,\n followers: followers.map(follower => ({\n actorId: follower.actor_id,\n username: follower.actor_username,\n displayName: follower.actor_display_name,\n domain: follower.actor_domain,\n iconUrl: follower.actor_icon_url,\n followedAt: follower.followed_at,\n lastActivityAt: follower.last_activity_at,\n isActive: follower.is_active === 1\n }))\n });\n } catch (error) {\n console.error(\"Error fetching followers:\", error);\n return c.json({ error: \"Failed to fetch followers\" }, 500);\n }\n});\n\n// API: Get activity counts for a post\napp.get(\"/api/posts/:slug/activities\", async c => {\n try {\n await ensureDbInitialized();\n const slug = c.req.param(\"slug\");\n const post = await getPostBySlug(slug);\n\n if (!post) {\n return c.json({ error: \"Post not found\" }, 404);\n }\n\n const activityCounts = await getPostActivityCounts(slug);\n return c.json({ activityCounts });\n } catch (error) {\n console.error(\"Error fetching activity counts:\", error);\n return c.json({ error: \"Failed to fetch activity counts\" }, 500);\n }\n});\n\n// WebSub hub endpoint\napp.get(\"/websub\", async c => {\n try {\n await ensureDbInitialized();\n const mode = c.req.query(\"hub.mode\");\n const callback = c.req.query(\"hub.callback\");\n const topic = c.req.query(\"hub.topic\");\n const challenge = c.req.query(\"hub.challenge\");\n const leaseSeconds = c.req.query(\"hub.lease_seconds\");\n const secret = c.req.query(\"hub.secret\");\n\n if (!mode || !callback || !topic) {\n return c.text(\"Missing required parameters\", 400);\n }\n\n const result = await handleWebSubSubscription(\n mode,\n callback,\n topic,\n challenge,\n leaseSeconds ? parseInt(leaseSeconds) : undefined,\n secret,\n );\n\n if (result) {\n return c.text(result);\n }\n\n return c.text(\"OK\", 200);\n } catch (error) {\n console.error(\"WebSub error:\", error);\n return c.text(\"WebSub error\", 400);\n }\n});\n\n// ActivityPub actor endpoint\napp.get(\"/actor\", async c => {\n try {\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n const actor = await generateActorDocument(domain);\n return c.json(actor, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub actor error:\", error);\n return c.json({ error: \"Failed to generate actor document\" }, 500);\n }\n});\n\n// ActivityPub inbox (for receiving activities)\napp.post(\"/inbox\", async c => {\n try {\n await ensureDbInitialized();\n const activity = await c.req.json();\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n \n console.log(\"Received ActivityPub activity:\", {\n id: activity.id,\n type: activity.type,\n actor: typeof activity.actor === 'string' ? activity.actor : activity.actor?.id\n });\n\n // Process the activity\n const result = await processInboxActivity(activity, domain);\n \n if (result.success) {\n console.log(\"Activity processed successfully:\", result.message);\n return c.text(\"\", 202);\n } else {\n console.error(\"Activity processing failed:\", result.message);\n return c.text(\"Error processing activity\", 400);\n }\n } catch (error) {\n console.error(\"ActivityPub inbox error:\", error);\n return c.text(\"Error processing activity\", 400);\n }\n});\n\n// ActivityPub outbox (for serving activities)\napp.get(\"/outbox\", async c => {\n try {\n await ensureDbInitialized();\n const baseUrl = getBaseUrl(c);\n\n // Support pagination parameters\n const page = parseInt(c.req.query(\"page\") || \"0\");\n const limit = 20;\n\n // Get recent posts to create activities\n const posts = await getRecentPosts(50); // Get more posts for pagination\n const totalItems = posts.length;\n\n // If no page parameter is provided, return the collection summary\n if (!c.req.query(\"page\")) {\n const outbox = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/outbox`,\n totalItems: totalItems,\n first: totalItems > 0 ? `${baseUrl}/outbox?page=1` : undefined,\n last: totalItems > 0 ? `${baseUrl}/outbox?page=${Math.ceil(totalItems / limit)}` : undefined\n };\n\n return c.json(outbox, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return paginated results\n const offset = (page - 1) * limit;\n const paginatedPosts = posts.slice(offset, offset + limit);\n const hasNext = offset + limit < posts.length;\n const hasPrev = page > 1;\n\n const activities = paginatedPosts.map(post => {\n // Create better content for ActivityPub\n const contentHtml = post.content_type === 'html' \n ? post.content \n : `

${post.content.replace(/\\n/g, '
')}

`;\n \n // Create a proper summary/preview\n const textContent = post.content.replace(/<[^>]*>/g, '');\n const summary = textContent.length > 200 \n ? textContent.substring(0, 200) + '...' \n : textContent;\n\n return {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"Create\",\n id: `${baseUrl}/post/${post.slug}#create`,\n actor: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n object: {\n type: \"Note\",\n id: `${baseUrl}/post/${post.slug}`,\n attributedTo: `${baseUrl}/actor`,\n published: new Date(post.published_at).toISOString(),\n url: `${baseUrl}/post/${post.slug}`,\n to: [\"https://www.w3.org/ns/activitystreams#Public\"],\n cc: [`${baseUrl}/followers`],\n // Use the post title as the summary/name\n name: post.title,\n summary: summary,\n // Full content with proper HTML\n content: `

${post.title}

${contentHtml}`,\n // Add source for better compatibility\n source: {\n content: post.content,\n mediaType: post.content_type === 'html' ? 'text/html' : 'text/plain'\n },\n // Add tags for better discoverability\n tag: [],\n // Add attachment info if needed\n attachment: [],\n // Indicate this is sensitive content if needed\n sensitive: false\n }\n };\n });\n\n const outboxPage = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollectionPage\",\n id: `${baseUrl}/outbox?page=${page}`,\n partOf: `${baseUrl}/outbox`,\n totalItems: totalItems,\n next: hasNext ? `${baseUrl}/outbox?page=${page + 1}` : undefined,\n prev: hasPrev ? `${baseUrl}/outbox?page=${page - 1}` : undefined,\n orderedItems: activities\n };\n\n return c.json(outboxPage, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub outbox error:\", error);\n return c.json({ error: \"Failed to generate outbox\" }, 500);\n }\n});\n\n// ActivityPub followers collection\napp.get(\"/followers\", async c => {\n try {\n await ensureDbInitialized();\n const baseUrl = getBaseUrl(c);\n\n // Support pagination parameters\n const page = parseInt(c.req.query(\"page\") || \"1\");\n const limit = parseInt(c.req.query(\"limit\") || \"20\");\n const offset = (page - 1) * limit;\n\n const followers = await getActiveFollowers();\n const followerCount = await getFollowerCount();\n\n // If no page parameter is provided, return the collection summary\n if (!c.req.query(\"page\")) {\n const followersCollection = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/followers`,\n totalItems: followerCount,\n first: followerCount > 0 ? `${baseUrl}/followers?page=1` : undefined,\n // Include a sample of followers in the main collection\n orderedItems: followers.slice(0, Math.min(20, followers.length)).map(follower => ({\n id: follower.actor_id,\n type: \"Person\",\n preferredUsername: follower.actor_username || \"unknown\",\n name: follower.actor_display_name || follower.actor_username || \"Unknown User\",\n icon: follower.actor_icon_url ? {\n type: \"Image\",\n url: follower.actor_icon_url\n } : undefined,\n url: follower.actor_id,\n // Include domain info for display\n summary: follower.actor_domain ? `User from ${follower.actor_domain}` : undefined,\n // Include follow date\n published: follower.followed_at\n }))\n };\n\n return c.json(followersCollection, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n }\n\n // Return paginated results\n const paginatedFollowers = followers.slice(offset, offset + limit);\n const hasNext = offset + limit < followers.length;\n const hasPrev = page > 1;\n\n const followersPage = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollectionPage\",\n id: `${baseUrl}/followers?page=${page}`,\n partOf: `${baseUrl}/followers`,\n totalItems: followerCount,\n next: hasNext ? `${baseUrl}/followers?page=${page + 1}` : undefined,\n prev: hasPrev ? `${baseUrl}/followers?page=${page - 1}` : undefined,\n orderedItems: paginatedFollowers.map(follower => ({\n id: follower.actor_id,\n type: \"Person\",\n preferredUsername: follower.actor_username || \"unknown\",\n name: follower.actor_display_name || follower.actor_username || \"Unknown User\",\n icon: follower.actor_icon_url ? {\n type: \"Image\",\n url: follower.actor_icon_url\n } : undefined,\n url: follower.actor_id,\n summary: follower.actor_domain ? `User from ${follower.actor_domain}` : undefined,\n published: follower.followed_at,\n // Include last activity for debugging\n lastActivity: follower.last_activity_at\n }))\n };\n\n return c.json(followersPage, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub followers error:\", error);\n return c.json({ error: \"Failed to generate followers collection\" }, 500);\n }\n});\n\n// ActivityPub following collection (placeholder)\napp.get(\"/following\", async c => {\n try {\n const baseUrl = getBaseUrl(c);\n\n const following = {\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n type: \"OrderedCollection\",\n id: `${baseUrl}/following`,\n totalItems: 0,\n orderedItems: [],\n };\n\n return c.json(following, 200, {\n \"Content-Type\": \"application/activity+json\",\n });\n } catch (error) {\n console.error(\"ActivityPub following error:\", error);\n return c.json({ error: \"Failed to generate following collection\" }, 500);\n }\n});\n\n// WebFinger endpoint for ActivityPub discovery\napp.get(\"/.well-known/webfinger\", async c => {\n try {\n const resource = c.req.query(\"resource\");\n\n if (!resource) {\n return c.json({ error: \"Missing resource parameter\" }, 400);\n }\n\n if (!isValidWebFingerResource(resource)) {\n return c.json({ error: \"Invalid resource format\" }, 400);\n }\n\n const baseUrl = getBaseUrl(c);\n const domain = new URL(baseUrl).hostname;\n console.log('WebFinger request:', { resource, domain, baseUrl });\n const webfingerResponse = generateWebFingerResponse(resource, domain);\n\n if (!webfingerResponse) {\n return c.json({ error: \"Resource not found\" }, 404);\n }\n\n return c.json(webfingerResponse, 200, {\n \"Content-Type\": \"application/jrd+json; charset=utf-8\",\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n });\n } catch (error) {\n console.error(\"WebFinger error:\", error);\n return c.json({ error: \"Internal server error\" }, 500);\n }\n});\n\n// Email verification endpoint\napp.get(\"/verify-email\", async c => {\n const startTime = Date.now();\n console.log('🔐 === EMAIL VERIFICATION START ===');\n \n try {\n await ensureDbInitialized();\n const token = c.req.query(\"token\");\n\n console.log('📧 Verification request:', {\n hasToken: !!token,\n tokenLength: token?.length || 0,\n tokenPreview: token ? token.substring(0, 10) + '...' : null,\n userAgent: c.req.header('user-agent'),\n referer: c.req.header('referer')\n });\n\n if (!token) {\n console.error('❌ Missing verification token');\n return c.html(generateVerificationErrorHTML(\"Missing verification token\"), 400);\n }\n\n console.log('🔍 Looking up verification record...');\n // Get verification record\n const verification = await getEmailVerificationByToken(token);\n if (!verification) {\n console.error('❌ Verification record not found:', {\n token: token.substring(0, 10) + '...'\n });\n return c.html(generateVerificationErrorHTML(\"Invalid or expired verification token\"), 404);\n }\n\n console.log('✅ Verification record found:', {\n id: verification.id,\n email: verification.email,\n draftPostId: verification.draft_post_id,\n expiresAt: verification.expires_at,\n verifiedAt: verification.verified_at,\n createdAt: verification.created_at\n });\n\n // Check if already verified\n if (verification.verified_at) {\n console.log('⚠️ Post already verified:', {\n verifiedAt: verification.verified_at\n });\n return c.html(generateVerificationSuccessHTML(\"This post has already been verified and published!\", true));\n }\n\n // Check if expired\n const now = new Date();\n const expiresAt = new Date(verification.expires_at);\n if (expiresAt < now) {\n console.error('❌ Verification token expired:', {\n expiresAt: verification.expires_at,\n currentTime: now.toISOString(),\n expiredBy: Math.round((now.getTime() - expiresAt.getTime()) / (1000 * 60)) + ' minutes'\n });\n return c.html(generateVerificationErrorHTML(\"Verification token has expired\"), 410);\n }\n\n console.log('✅ Token is valid, proceeding with verification...');\n\n try {\n console.log('📝 Marking email as verified...');\n // Mark as verified and publish the post\n await markEmailVerified(token);\n console.log('✅ Email marked as verified');\n\n console.log('📤 Publishing draft post...');\n const post = await publishDraftPost(token);\n console.log('✅ Draft post published successfully:', {\n id: post.id,\n title: post.title,\n slug: post.slug\n });\n\n // Notify external services\n console.log('📡 Notifying external services...');\n const serviceResults = await Promise.allSettled([\n notifyWebSubSubscribers().then(() => ({ service: 'WebSub', success: true })).catch(err => ({ service: 'WebSub', success: false, error: err.message })),\n publishToActivityPub(post).then(() => ({ service: 'ActivityPub', success: true })).catch(err => ({ service: 'ActivityPub', success: false, error: err.message })),\n publishToATProtocol(post).then(() => ({ service: 'AT Protocol', success: true })).catch(err => ({ service: 'AT Protocol', success: false, error: err.message }))\n ]);\n\n // Log service notification results\n serviceResults.forEach((result, index) => {\n if (result.status === 'fulfilled') {\n const serviceResult = result.value;\n if (serviceResult.success) {\n console.log(`✅ ${serviceResult.service} notification successful`);\n } else {\n console.error(`❌ ${serviceResult.service} notification failed:`, serviceResult.error);\n }\n } else {\n console.error(`💥 Service notification crashed:`, result.reason);\n }\n });\n\n const successfulServices = serviceResults.filter(r => r.status === 'fulfilled' && r.value.success).length;\n const totalServices = serviceResults.length;\n console.log('📊 Service notification summary:', {\n successful: successfulServices,\n total: totalServices,\n successRate: `${Math.round((successfulServices / totalServices) * 100)}%`\n });\n\n console.log(`🎉 Post published successfully: ${post.title} (${post.slug})`);\n \n const baseUrl = getBaseUrl(c);\n const postUrl = `${baseUrl}/post/${post.slug}`;\n \n const processingTime = Date.now() - startTime;\n console.log('✅ === EMAIL VERIFICATION COMPLETED ===', {\n processingTimeMs: processingTime,\n postUrl: postUrl\n });\n \n return c.html(generateVerificationSuccessHTML(\n `Your post \"${post.title}\" has been verified and published successfully!`,\n false,\n postUrl\n ));\n } catch (publishError) {\n const processingTime = Date.now() - startTime;\n console.error('💥 Error publishing post:', {\n error: publishError.message,\n stack: publishError.stack,\n processingTimeMs: processingTime,\n token: token.substring(0, 10) + '...'\n });\n return c.html(generateVerificationErrorHTML(\"Failed to publish post. Please try again.\"), 500);\n }\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error('💥 Email verification error:', {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime\n });\n return c.html(generateVerificationErrorHTML(\"An error occurred during verification\"), 500);\n } finally {\n console.log('🔐 === EMAIL VERIFICATION END ===');\n }\n});\n\n// Health check\napp.get(\"/health\", c => {\n return c.json({ status: \"ok\", timestamp: new Date().toISOString() });\n});\n\nexport default app.fetch;",[],[154,283],[154],{"_104":294,"_95":295,"_155":296,"_157":-5,"_158":140,"_159":297,"_161":162,"_106":298,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":299,"_98":308},"2fb46b32-5dca-11f0-8fd0-0224a6c84d84","frontend","f252d7da-427d-4f5e-a88f-f1f5d86c4e5d",14,["D",1752178341352],[300],{"_104":301,"_95":302,"_155":303,"_157":296,"_158":140,"_159":304,"_161":162,"_106":305,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":306,"_98":307},"52dd71bc-5dca-11f0-a816-0224a6c84d84","components","bcb5bf8b-dc43-422f-9fcb-c035f750b8cd",17,["D",1752178400340],[],[295,302],[295],{"_104":310,"_95":311,"_155":312,"_157":-5,"_158":140,"_159":248,"_161":162,"_106":313,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":314,"_98":333},"eea83494-5dc8-11f0-bd13-0224a6c84d84","shared","f28d295b-cc10-4b23-abed-efaa005ca60d",["D",1752177802723],[315,324],{"_104":316,"_95":317,"_155":318,"_157":312,"_158":140,"_159":319,"_161":22,"_106":320,"_100":248,"_164":184,"_166":321,"_167":22,"_168":-5,"_169":322,"_98":323},"12f5ab2e-5e41-11f0-bd42-0224a6c84d84","types.ts","eea82daa-5dc8-11f0-bd13-0224a6c84d84",103,["D",1752229403238],"// Shared types for the blog platform\n\nexport interface BlogPost {\n id: number;\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n published_at: string;\n created_at: string;\n updated_at: string;\n}\n\nexport interface CreatePostData {\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n}\n\nexport interface DraftPost {\n id: number;\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n verification_token: string;\n expires_at: string;\n created_at: string;\n}\n\nexport interface CreateDraftPostData {\n title: string;\n slug: string;\n content: string;\n content_type: 'html' | 'text';\n author_email: string;\n author_name?: string;\n verification_token: string;\n expires_at: string;\n}\n\nexport interface EmailVerification {\n id: number;\n email: string;\n token: string;\n draft_post_id: number;\n expires_at: string;\n verified_at?: string;\n created_at: string;\n}\n\nexport interface RSSItem {\n title: string;\n link: string;\n description: string;\n pubDate: string;\n author: string;\n guid: string;\n}\n\nexport interface ActivityPubObject {\n '@context': string | string[];\n type: string;\n id: string;\n attributedTo: string;\n content: string;\n published: string;\n to: string[];\n cc?: string[];\n}\n\nexport interface ATProtoPost {\n text: string;\n createdAt: string;\n facets?: any[];\n embed?: any;\n}",[],[311,317],{"_104":325,"_95":326,"_155":327,"_157":312,"_158":140,"_159":328,"_161":22,"_106":329,"_100":32,"_164":184,"_166":330,"_167":22,"_168":-5,"_169":331,"_98":332},"f669dc96-5dc8-11f0-961b-0224a6c84d84","utils.ts","f669dd54-5dc8-11f0-961b-0224a6c84d84",3,["D",1752177815739],"// Shared utility functions\n\n/**\n * Create a URL-friendly slug from a title\n */\nexport function slugify(text: string): string {\n return text\n .toLowerCase()\n .trim()\n .replace(/[^\\w\\s-]/g, '') // Remove special characters\n .replace(/[\\s_-]+/g, '-') // Replace spaces and underscores with hyphens\n .replace(/^-+|-+$/g, ''); // Remove leading/trailing hyphens\n}\n\n/**\n * Extract author name from email address\n */\nexport function extractAuthorName(email: string): string {\n const localPart = email.split('@')[0];\n return localPart\n .replace(/[._-]/g, ' ')\n .replace(/\\b\\w/g, l => l.toUpperCase())\n .trim();\n}\n\n/**\n * Detect if content is HTML\n */\nexport function isHTML(content: string): boolean {\n const htmlRegex = /<[^>]*>/;\n return htmlRegex.test(content);\n}\n\n/**\n * Convert plain text to basic HTML\n */\nexport function textToHTML(text: string): string {\n return text\n .replace(/&/g, '&')\n .replace(//g, '>')\n .replace(/\\n\\n/g, '

')\n .replace(/\\n/g, '
')\n .replace(/^/, '

')\n .replace(/$/, '

');\n}\n\n/**\n * Truncate HTML content for descriptions\n */\nexport function truncateHTML(html: string, maxLength: number = 200): string {\n // Strip HTML tags for truncation\n const text = html.replace(/<[^>]*>/g, '');\n if (text.length <= maxLength) return text;\n \n return text.substring(0, maxLength).trim() + '...';\n}\n\n/**\n * Format date for RSS\n */\nexport function formatRSSDate(date: Date): string {\n return date.toUTCString();\n}\n\n/**\n * Format date for ActivityPub\n */\nexport function formatActivityPubDate(date: Date): string {\n return date.toISOString();\n}",[],[311,326],[311],{"_104":335,"_95":336,"_155":337,"_157":-5,"_158":140,"_159":338,"_161":162,"_106":339,"_100":32,"_164":340,"_166":341,"_167":22,"_168":-5,"_169":342,"_98":343},"6c8335ce-5e48-11f0-8e6a-0224a6c84d84","ACTIVITYPUB-TROUBLESHOOTING.md","6c833696-5e48-11f0-8e6a-0224a6c84d84",178,["D",1752232559959],"file","# ActivityPub Troubleshooting Guide\n\n## Current Status: ⚠️ Partial Implementation\n\nYour ActivityPub implementation is **working correctly** but has one critical limitation that prevents posts from appearing in Mastodon timelines.\n\n## ✅ What's Working\n\n1. **ActivityPub Discovery**: Your blog is discoverable via WebFinger (`@blog@posthero.us`)\n2. **Following**: Users can follow your blog from Mastodon\n3. **Follower Management**: The system correctly tracks followers and their inboxes\n4. **Activity Creation**: Posts are converted to proper ActivityPub Create/Note activities\n5. **Delivery Attempts**: The system attempts to deliver activities to follower inboxes\n6. **Logging**: Comprehensive logging shows exactly what's happening\n\n## ❌ What's Not Working\n\n**HTTP Signatures**: Most Mastodon servers (including the one following you) require HTTP signatures for authentication. Your current implementation sends unsigned requests, which are rejected with:\n\n```\nHTTP 401: {\"error\":\"Request not signed\"}\n```\n\n## 🔍 Current Test Results\n\nFrom your latest test delivery:\n\n```\n📊 Followers found: {\n totalFollowers: 1,\n followersWithInbox: 1,\n followersWithSharedInbox: 1\n}\n\n📮 Delivery plan: { uniqueInboxes: 1, totalDeliveries: 1 }\n\n❌ Inbox delivery failed: {\n inbox: \"https://status.kinlan.me/inbox\",\n error: 'HTTP 401: {\"error\":\"Request not signed\"}',\n followers: [ \"paul\" ]\n}\n\n🎉 ACTIVITYPUB PUBLISH COMPLETED: {\n processingTimeMs: 395,\n totalInboxes: 1,\n successfulDeliveries: 0,\n failedDeliveries: 1,\n deliveryRate: \"0%\"\n}\n```\n\n## 🛠️ Solutions\n\n### Option 1: Implement HTTP Signatures (Recommended)\n\nHTTP signatures require:\n1. **RSA Key Pair**: Generate and store securely\n2. **Signature Creation**: Sign requests with private key\n3. **Public Key Distribution**: Serve public key in actor document\n\nThis is the proper long-term solution but requires careful cryptographic implementation.\n\n### Option 2: Find Mastodon Servers That Accept Unsigned Requests\n\nSome smaller Mastodon instances may accept unsigned requests for testing purposes.\n\n### Option 3: Use Alternative ActivityPub Servers\n\nSome ActivityPub implementations are more lenient with unsigned requests.\n\n## 🧪 Testing Your Implementation\n\nUse the test endpoint to verify delivery:\n\n```bash\n# Check current followers and posts\ncurl \"https://your-val.web.val.run/test-activitypub-delivery?action=info\"\n\n# Test delivery to current followers\ncurl \"https://your-val.web.val.run/test-activitypub-delivery?action=test-delivery\"\n```\n\n## 📝 Next Steps\n\n1. **Immediate**: Your ActivityPub setup is correct - the issue is authentication\n2. **Short-term**: Consider implementing HTTP signatures for full compatibility\n3. **Alternative**: Test with other ActivityPub servers that may be more lenient\n\n## 🔧 Implementation Notes\n\nThe current code includes:\n- ✅ Proper ActivityPub activity structure\n- ✅ Correct inbox discovery and delivery logic\n- ✅ SHA-256 digest creation for request bodies\n- ✅ Comprehensive error handling and logging\n- ❌ HTTP signature creation (disabled due to complexity)\n\n## 📚 Resources\n\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [HTTP Signatures Specification](https://tools.ietf.org/html/draft-cavage-http-signatures)\n- [Mastodon ActivityPub Implementation](https://docs.joinmastodon.org/spec/activitypub/)\n\n---\n\n**Summary**: Your ActivityPub implementation is architecturally sound and would work perfectly with HTTP signatures. The 401 errors are expected behavior from security-conscious Mastodon servers.",[],[336],{"_104":345,"_95":346,"_155":347,"_157":-5,"_158":140,"_159":348,"_161":22,"_106":349,"_100":248,"_164":340,"_166":350,"_167":22,"_168":-5,"_169":351,"_98":352},"cb7f5174-5e49-11f0-9bdb-0224a6c84d84","ACTIVITYPUB.md","2cfed392-5dd8-11f0-b97b-0224a6c84d84",187,["D",1752233148814],"# ActivityPub Implementation Guide\n\nThis document explains the ActivityPub and WebFinger implementation in the Email Blog platform.\n\n## 🌐 Overview\n\nActivityPub is a decentralized social networking protocol that allows your blog to be discovered and followed from Mastodon, Pleroma, and other federated social networks. WebFinger is the discovery mechanism that allows users to find your blog using familiar `@username@domain.com` syntax.\n\n## ✅ Implemented Features\n\n### WebFinger Discovery\n- **Endpoint**: `/.well-known/webfinger`\n- **Formats Supported**:\n - `acct:blog@your-domain.com`\n - `https://your-domain.com/actor`\n- **Response**: JSON Resource Descriptor (JRD) format\n- **CORS**: Enabled for cross-origin requests\n\n### ActivityPub Actor\n- **Endpoint**: `/actor`\n- **Type**: Person\n- **Username**: `blog`\n- **Content-Type**: `application/activity+json`\n\n### ActivityPub Collections\n- **Outbox** (`/outbox`): Published blog posts as ActivityPub Create activities\n- **Followers** (`/followers`): Collection of active followers (real data)\n- **Following** (`/following`): Collection of accounts being followed (placeholder)\n- **Inbox** (`/inbox`): Processes ActivityPub activities (Follow, Unfollow, Like, Announce, Create)\n\n### Activity Processing\n- **Follow Activities**: Adds followers to database, sends Accept response\n- **Unfollow Activities**: Removes followers from database\n- **Like Activities**: Tracks likes per post, displays counts\n- **Announce Activities**: Tracks shares/boosts per post, displays counts\n- **Create Activities**: Tracks replies to posts, displays counts\n\n### Database Storage\n- **Followers Table**: Stores follower information (actor ID, username, domain, inbox, etc.)\n- **Activities Table**: Stores all received activities (likes, shares, replies)\n- **Activity Counts**: Real-time counting and display on post pages\n\n## 🔧 Configuration\n\n### Environment Variables\n\n```bash\n# Optional: Set a custom domain for ActivityPub\nACTIVITYPUB_DOMAIN=your-custom-domain.com\n```\n\nIf not set, the system will automatically detect the domain from the request headers.\n\n## 🚀 Usage Examples\n\n### Following from Mastodon\n\n1. **Using WebFinger format**: Search for `@blog@your-domain.com` in your Mastodon client\n2. **Using direct URL**: Paste `https://your-domain.com/actor` in the search box\n\n### Testing WebFinger\n\n```bash\n# Test with acct format\ncurl \"https://your-domain.com/.well-known/webfinger?resource=acct:blog@your-domain.com\"\n\n# Test with direct URL format \ncurl \"https://your-domain.com/.well-known/webfinger?resource=https://your-domain.com/actor\"\n```\n\n### Testing ActivityPub Endpoints\n\n```bash\n# Get actor document\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/actor\n\n# Get outbox (published posts)\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/outbox\n\n# Get followers collection\ncurl -H \"Accept: application/activity+json\" https://your-domain.com/followers\n```\n\n## 📋 WebFinger Response Format\n\n```json\n{\n \"subject\": \"acct:blog@your-domain.com\",\n \"aliases\": [\n \"https://your-domain.com/actor\",\n \"https://your-domain.com/\"\n ],\n \"properties\": {\n \"http://schema.org/name\": \"Email Blog\"\n },\n \"links\": [\n {\n \"rel\": \"http://webfinger.net/rel/profile-page\",\n \"type\": \"text/html\",\n \"href\": \"https://your-domain.com/\"\n },\n {\n \"rel\": \"self\",\n \"type\": \"application/activity+json\",\n \"href\": \"https://your-domain.com/actor\"\n },\n {\n \"rel\": \"http://ostatus.org/schema/1.0/subscribe\",\n \"template\": \"https://your-domain.com/authorize_interaction?uri={uri}\"\n }\n ]\n}\n```\n\n## 📋 ActivityPub Actor Format\n\n```json\n{\n \"@context\": [\n \"https://www.w3.org/ns/activitystreams\",\n \"https://w3id.org/security/v1\"\n ],\n \"type\": \"Person\",\n \"id\": \"https://your-domain.com/actor\",\n \"preferredUsername\": \"blog\",\n \"name\": \"Email Blog\",\n \"summary\": \"A blog powered by email publishing\",\n \"url\": \"https://your-domain.com\",\n \"inbox\": \"https://your-domain.com/inbox\",\n \"outbox\": \"https://your-domain.com/outbox\",\n \"followers\": \"https://your-domain.com/followers\",\n \"following\": \"https://your-domain.com/following\",\n \"publicKey\": {\n \"id\": \"https://your-domain.com/actor#main-key\",\n \"owner\": \"https://your-domain.com/actor\",\n \"publicKeyPem\": \"-----BEGIN PUBLIC KEY-----\\\\n...\\\\n-----END PUBLIC KEY-----\"\n }\n}\n```\n\n## 🔄 How Posts Become Activities\n\nWhen you publish a blog post via email, it automatically becomes available in the ActivityPub outbox as a Create activity:\n\n```json\n{\n \"@context\": \"https://www.w3.org/ns/activitystreams\",\n \"type\": \"Create\",\n \"id\": \"https://your-domain.com/post/my-post#create\",\n \"actor\": \"https://your-domain.com/actor\",\n \"published\": \"2024-01-01T12:00:00Z\",\n \"object\": {\n \"type\": \"Note\",\n \"id\": \"https://your-domain.com/post/my-post#note\",\n \"attributedTo\": \"https://your-domain.com/actor\",\n \"content\": \"

My Post Title

Post content...

\",\n \"published\": \"2024-01-01T12:00:00Z\",\n \"url\": \"https://your-domain.com/post/my-post\",\n \"to\": [\"https://www.w3.org/ns/activitystreams#Public\"]\n }\n}\n```\n\n## 🚧 Current Status\n\n✅ **Fully Implemented Features:**\n1. **HTTP Signatures**: Cryptographic signatures for authentication ✅\n2. **Follow Processing**: The inbox processes Follow/Unfollow activities ✅\n3. **Push Notifications**: New posts are automatically pushed to followers ✅\n4. **Real Collections**: Followers/following collections contain real data ✅\n5. **Public Key Management**: Persistent RSA keys for signing ✅\n\n⚠️ **Setup Required:**\n- Generate RSA key pair for HTTP signatures (see setup instructions below)\n\n## 🛠️ HTTP Signatures Setup\n\nFor proper ActivityPub federation, you need to set up persistent RSA keys for HTTP signatures:\n\n### 1. Generate RSA Key Pair\n\nVisit your `/generate-keys.ts` val to generate a new RSA key pair. This will provide you with:\n- `ACTIVITYPUB_PUBLIC_KEY` - Public key in PEM format\n- `ACTIVITYPUB_PRIVATE_KEY` - Private key in PEM format\n\n### 2. Set Environment Variables\n\nAdd these to your Val Town environment variables:\n\n```bash\nACTIVITYPUB_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA...\n-----END PUBLIC KEY-----\n\nACTIVITYPUB_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----\n```\n\n### 3. Security Notes\n\n🔒 **IMPORTANT:**\n- Keep the private key secret and secure\n- Do not share the private key in public repositories\n- Once set, do not change these keys unless necessary\n- Changing keys will break federation with existing followers\n\n### 4. Verification\n\nAfter setting the keys:\n1. Restart your val\n2. Check the logs for \"✅ RSA key pair loaded from environment variables\"\n3. Test federation by following your blog from Mastodon\n\n## 🚧 Fallback Behavior\n\nIf no persistent keys are set, the system will:\n- Generate temporary keys on startup\n- Log a warning about using temporary keys\n- Still function, but keys will change on restart\n- May cause federation issues with some servers\n\n## 🧪 Testing\n\nUse the `/test-activitypub.ts` endpoint to verify all ActivityPub endpoints are working correctly.\n\n## 📚 References\n\n- [ActivityPub Specification](https://www.w3.org/TR/activitypub/)\n- [WebFinger Specification](https://tools.ietf.org/html/rfc7033)\n- [ActivityStreams Vocabulary](https://www.w3.org/TR/activitystreams-vocabulary/)\n- [Mastodon API Documentation](https://docs.joinmastodon.org/spec/activitypub/)\n\n---\n\nYour blog is now discoverable and followable from the fediverse! 🎉",[],[346],{"_104":354,"_95":355,"_155":356,"_157":-5,"_158":140,"_159":357,"_161":22,"_106":358,"_100":359,"_164":340,"_166":360,"_167":22,"_168":-5,"_169":361,"_98":362},"bd74adae-5e49-11f0-9136-0224a6c84d84","README.md","e96c1ab8-5dc8-11f0-bf16-0224a6c84d84",186,["D",1752233125257],27,"# Email Blog Platform\n\nA modern blog platform inspired by Posterous that allows publishing posts via email.\n\n## 🚀 Status: READY TO USE\n\nYour email blog platform is fully functional! Send an email to start publishing.\n\n## ✨ Features\n\n- **📧 Email-to-Publish**: Send an email to publish posts instantly\n- **🔒 Email Security**: Allowlist and verification system to prevent unauthorized posts\n- **🎨 Multi-format Support**: HTML and plain text posts\n- **📡 RSS Feed**: Full RSS 2.0 support for syndication\n- **🌐 WebSub**: Real-time feed updates via WebSub protocol (configured)\n- **🐘 ActivityPub**: Full federated social networking with followers, likes, and shares ✅\n- **🦋 AT Protocol**: Bluesky integration for cross-platform syndication (configured)\n- **🔗 SEO Friendly**: Clean URLs with slugified titles\n- **📱 Responsive Design**: Mobile-first responsive interface with TailwindCSS\n- **⚡ Fast**: Built on Val Town with SQLite storage and static HTML generation\n- **🚀 No JavaScript**: Pure HTML/CSS frontend for maximum performance\n\n## 🏗️ Architecture\n\n### Backend (`/backend/`)\n- `index.ts` - Main Hono server with HTML generation and API routes ✅\n- `database/` - SQLite schema and query functions ✅\n- `services/` - External service integrations ✅\n\n### Email Handler (`/email.ts`)\n- Email trigger handler with security verification ✅\n- Allowlist checking and draft post creation ✅\n- Automated verification email sending ✅\n\n### Static HTML Generation\n- Server-side HTML rendering with TailwindCSS ✅\n- No client-side JavaScript dependencies ✅\n- Fast loading and SEO optimized ✅\n\n## 🎯 Quick Start\n\n1. **Configure Security**: Set `ALLOWED_EMAIL_ADDRESSES` environment variable (see Security section)\n2. **Send Email**: Send email from an allowed address to your Val Town email address\n3. **Verify Email**: Click the verification link sent to your email\n4. **View Blog**: Visit your backend HTTP val URL after verification\n5. **RSS Feed**: Access `/rss` for syndication\n6. **Individual Posts**: Visit `/post/[slug]`\n\n## 🔧 Configuration\n\nSee [SETUP.md](./SETUP.md) for detailed setup instructions and [ACTIVITYPUB.md](./ACTIVITYPUB.md) for ActivityPub federation details.\n\n### Environment Variables (Required for Security)\n\n- `ALLOWED_EMAIL_ADDRESSES` - Comma-separated list of allowed email addresses (required)\n- `BASE_URL` - Your blog's base URL (e.g., https://myblog.com or just myblog.com) - **Required for custom domains and ActivityPub federation**\n\n### Environment Variables (Optional)\n\n- `WEBSUB_HUB_URL` - WebSub hub URL\n- `ACTIVITYPUB_DOMAIN` - Domain for ActivityPub federation (deprecated - use BASE_URL instead)\n- `ATPROTO_HANDLE` - AT Protocol handle\n- `ATPROTO_PASSWORD` - AT Protocol app password\n\n### Environment Variables (Required for ActivityPub HTTP Signatures)\n\nFor proper ActivityPub federation with HTTP signatures (recommended for production):\n\n- `ACTIVITYPUB_PUBLIC_KEY` - RSA public key in PEM format\n- `ACTIVITYPUB_PRIVATE_KEY` - RSA private key in PEM format\n\n**To generate these keys:**\n1. Visit `/generate-keys.ts` (your key generator val)\n2. Copy the generated keys to your environment variables\n3. Restart your val\n\nWithout these keys, the system will generate temporary keys that change on restart, which may cause federation issues.\n\n### Custom Domain Setup\n\nTo use a custom domain with ActivityPub federation:\n\n1. **Set up your custom domain** in Val Town (see Val Town documentation)\n2. **Set the BASE_URL environment variable** to your custom domain:\n - `BASE_URL=https://yourdomain.com` (with protocol)\n - OR `BASE_URL=yourdomain.com` (protocol will be assumed as https)\n3. **Test ActivityPub discovery** by visiting `https://yourdomain.com/.well-known/webfinger?resource=acct:blog@yourdomain.com`\n\nWithout BASE_URL set, the system will use the default Val Town URL for ActivityPub federation.\n\n## 📊 API Endpoints\n\n- `GET /` - Main blog interface (with ActivityPub Link header)\n- `GET /post/:slug` - Individual post page (supports content negotiation for ActivityPub)\n- `GET /rss` - RSS 2.0 feed\n- `GET /api/posts` - JSON API for posts\n- `GET /api/posts/:slug` - JSON API for single post\n- `GET /websub` - WebSub subscription endpoint\n- `GET /.well-known/webfinger` - WebFinger discovery for ActivityPub ✅\n- `GET /actor` - ActivityPub actor document with rich metadata ✅\n- `GET /outbox` - ActivityPub outbox (paginated published activities) ✅\n- `GET /outbox?page=N` - Paginated outbox pages ✅\n- `GET /followers` - ActivityPub followers collection (with pagination support) ✅\n- `GET /followers-list` - Human-readable followers page ✅\n- `GET /api/followers` - JSON API for followers list ✅\n- `GET /following` - ActivityPub following collection ✅\n- `POST /inbox` - ActivityPub inbox (processes Follow, Like, Announce, Undo) ✅\n- `GET /api/posts/:slug/activities` - Get activity counts (likes, shares, replies) ✅\n- `GET /verify-email` - Email verification endpoint ✅\n- `GET /health` - Health check\n\n## 🔒 Security Features\n\n### Email Allowlist\nOnly emails from pre-configured addresses can publish posts. Configure via environment variable:\n\n```\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n### Email Verification\nTo prevent spoofing, all emails go through a verification process:\n\n1. **Email Received**: Email is stored as a draft (not published)\n2. **Verification Sent**: Automated verification email sent to sender\n3. **User Clicks Link**: Sender clicks verification link in email\n4. **Post Published**: After verification, post is published and syndicated\n\n### Security Benefits\n- **Anti-spoofing**: Prevents unauthorized users from publishing posts\n- **Email confirmation**: Ensures the sender actually sent the email\n- **Time-limited**: Verification links expire after 24 hours\n- **Automatic cleanup**: Expired drafts are automatically removed\n\n## 🧪 Testing\n\nUse `/test-publish.ts` to create sample posts for testing.\n\n## 📝 Usage Example\n\nSend an email like this:\n\n```\nTo: your-email-val@val.town\nFrom: allowed-user@example.com (must be in ALLOWED_EMAIL_ADDRESSES)\nSubject: My Amazing Blog Post\nBody:

Hello World!

This post was published via email!

\n```\n\nThe process will be:\n1. Email received and stored as draft\n2. Verification email sent to `allowed-user@example.com`\n3. User clicks verification link\n4. Post published with:\n - Title: \"My Amazing Blog Post\"\n - Slug: \"my-amazing-blog-post\"\n - Content: Rendered HTML\n - Author: Extracted from email address\n\n## 🎨 Customization\n\n- Edit HTML generation functions in `/backend/index.ts`\n- Modify CSS styles in the `getCustomCSS()` function\n- Update branding in HTML templates\n- Configure federation services via environment variables\n\n## 🔄 Syndication\n\nPosts are automatically syndicated to:\n- RSS feed (always enabled)\n- WebSub subscribers (if configured)\n- ActivityPub followers (with full interaction support) ✅\n- AT Protocol/Bluesky (if configured)\n\n### ActivityPub Federation\n\nYour blog is now fully federated with ActivityPub! Users can:\n\n- **Follow** your blog from Mastodon, Pleroma, and other ActivityPub platforms\n- **Like** your blog posts (shows ❤️ count on posts)\n- **Share/Boost** your posts (shows 🔄 count on posts)\n- **Reply** to your posts (shows 💬 count on posts)\n- **Preview posts** directly in Mastodon timeline with proper formatting\n\n**Discovery formats:**\n- **WebFinger**: `@blog@your-domain.com`\n- **Direct actor URL**: `https://your-domain.com/actor`\n\n**Configuration for custom domains:**\n- Set `BASE_URL=https://your-custom-domain.com` in your environment variables\n- This ensures all ActivityPub URLs use your custom domain instead of the default Val Town URL\n\n**Enhanced ActivityPub Features:**\n- ✅ **Paginated Outbox**: Posts are served with proper pagination for better performance\n- ✅ **Rich Post Previews**: Posts display with titles, summaries, and full content in Mastodon\n- ✅ **Content Negotiation**: Individual posts serve both HTML and ActivityPub JSON based on Accept headers\n- ✅ **Profile Metadata**: Actor profile includes avatar, header image, and custom fields\n- ✅ **Link Discovery**: Proper HTTP Link headers for ActivityPub discovery\n- ✅ **Post Permalinks**: Each post has its own ActivityPub Note endpoint\n\n**Real-time interaction tracking:**\n- All likes, shares, and replies are stored and displayed on individual post pages\n- Follower count is maintained and accurate\n- Full ActivityPub inbox processing for Follow/Unfollow activities\n\nExample: If your blog is at `myblog.com` (with `BASE_URL=https://myblog.com`), users can follow `@blog@myblog.com` from their Mastodon client and see your posts with rich previews in their timeline!\n\n---\n\n**Ready to blog via email? Send your first post now!** 📧✨",[],[355],{"_104":364,"_95":365,"_155":366,"_157":-5,"_158":140,"_159":367,"_161":162,"_106":368,"_100":32,"_164":340,"_166":369,"_167":22,"_168":-5,"_169":370,"_98":371},"de55c72c-5e41-11f0-b084-0224a6c84d84","SECURITY.md","de55c808-5e41-11f0-b084-0224a6c84d84",121,["D",1752229744445],"# Email Blog Security Configuration\n\n## Overview\n\nThe email blog platform includes robust security features to prevent unauthorized posting and email spoofing. This guide explains how to configure and use these security features.\n\n## Required Configuration\n\n### 1. Set Allowed Email Addresses\n\nConfigure the `ALLOWED_EMAIL_ADDRESSES` environment variable with a comma-separated list of email addresses that are allowed to publish posts:\n\n```bash\nALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com,admin@myblog.com\n```\n\n**Important Notes:**\n- Email addresses are case-insensitive\n- Whitespace around commas is automatically trimmed\n- If this variable is not set, **no emails will be allowed**\n- Only exact email matches are allowed (no wildcards or domains)\n\n### 2. Set Base URL (Optional)\n\nSet your blog's base URL for verification links:\n\n```bash\nBASE_URL=https://your-blog.web.val.run\n```\n\nIf not set, the system will auto-detect the URL from incoming requests.\n\n## How Email Security Works\n\n### Step 1: Email Allowlist Check\nWhen an email is received:\n1. The sender's email address is checked against `ALLOWED_EMAIL_ADDRESSES`\n2. If not allowed, the email is ignored (logged but not processed)\n3. If allowed, the process continues to verification\n\n### Step 2: Draft Creation\nFor allowed emails:\n1. Post content is extracted from the email\n2. A draft post is created (not published yet)\n3. A unique verification token is generated\n4. The draft expires after 24 hours if not verified\n\n### Step 3: Verification Email\n1. An automated verification email is sent to the original sender\n2. The email contains a secure verification link\n3. The link expires after 24 hours for security\n\n### Step 4: Verification and Publishing\nWhen the sender clicks the verification link:\n1. The token is validated and checked for expiration\n2. The email verification is marked as complete\n3. The draft post is converted to a published post\n4. External services are notified (RSS, ActivityPub, etc.)\n5. The draft and verification records are cleaned up\n\n## Security Benefits\n\n### Anti-Spoofing Protection\n- **Email confirmation required**: Even if someone spoofs your email address, they can't access your email to click the verification link\n- **Time-limited tokens**: Verification links expire after 24 hours\n- **One-time use**: Each verification token can only be used once\n\n### Access Control\n- **Allowlist-based**: Only pre-approved email addresses can publish\n- **No wildcards**: Exact email matching prevents subdomain attacks\n- **Easy management**: Add/remove allowed emails via environment variable\n\n### Automatic Cleanup\n- **Expired drafts**: Unverified drafts are automatically deleted after 24 hours\n- **Token cleanup**: Used and expired verification tokens are removed\n- **Database efficiency**: Regular cleanup prevents database bloat\n\n## Email Templates\n\n### Verification Email Template\nThe system sends a professional verification email with:\n- Clear subject line indicating verification needed\n- HTML and plain text versions\n- Secure verification link\n- Expiration warning (24 hours)\n- Instructions for non-senders to ignore\n\n### Example Verification Email\n```\nSubject: Verify your blog post: My Amazing Blog Post\n\nHello,\n\nWe received a blog post submission with the title \"My Amazing Blog Post\" from this email address.\n\nTo confirm that you sent this post and publish it to the blog, please click the verification link below:\n\n[Verify and Publish Post]\n\nImportant: This verification link will expire in 24 hours for security reasons.\n\nIf you did not send this blog post, please ignore this email.\n```\n\n## Troubleshooting\n\n### Email Not Processing\n1. **Check allowlist**: Ensure sender email is in `ALLOWED_EMAIL_ADDRESSES`\n2. **Check logs**: Look for \"Email from X is not in the allowed list\" messages\n3. **Verify format**: Ensure environment variable is properly formatted\n\n### Verification Link Issues\n1. **Check expiration**: Links expire after 24 hours\n2. **Check BASE_URL**: Ensure it's set correctly or auto-detection is working\n3. **One-time use**: Each link can only be used once\n\n### Posts Not Publishing\n1. **Click verification link**: Posts remain as drafts until verified\n2. **Check email delivery**: Ensure verification emails aren't in spam\n3. **Check token validity**: Tokens expire after 24 hours\n\n## Best Practices\n\n### Email Management\n- Use dedicated email addresses for blog posting\n- Keep the allowlist minimal (only trusted users)\n- Regularly review who has posting access\n\n### Security Monitoring\n- Monitor logs for unauthorized posting attempts\n- Review verification patterns for unusual activity\n- Keep environment variables secure\n\n### Backup Strategy\n- Regular database backups include draft posts\n- Consider notification systems for failed verifications\n- Document your allowed email addresses\n\n## API Endpoints\n\n### Verification Endpoint\n- **URL**: `GET /verify-email?token=`\n- **Purpose**: Handles email verification and post publishing\n- **Responses**:\n - `200`: Successful verification and publishing\n - `400`: Missing or invalid token\n - `404`: Token not found\n - `410`: Token expired\n - `500`: Server error during publishing\n\n### Security Headers\nAll verification pages include:\n- Proper HTML escaping to prevent XSS\n- Responsive design for mobile verification\n- Clear success/error messaging\n- Links back to the main blog\n\n## Migration from Unsecured Version\n\nIf upgrading from a version without security:\n\n1. **Set environment variables** before receiving new emails\n2. **Existing posts** remain published (not affected)\n3. **New emails** will require verification from the first email received\n4. **Test thoroughly** with a test email before going live\n\n---\n\n**Security is enabled by default. Configure `ALLOWED_EMAIL_ADDRESSES` to start receiving posts!**",[],[365],{"_104":373,"_95":374,"_155":375,"_157":-5,"_158":140,"_159":101,"_161":162,"_106":376,"_100":120,"_164":340,"_166":377,"_167":22,"_168":-5,"_169":378,"_98":379},"d9826e82-5e49-11f0-89b4-0224a6c84d84","SETUP.md","db9f912e-5dca-11f0-b4e8-0224a6c84d84",["D",1752233172322],"# Email Blog Platform Setup Guide\n\n## Quick Start\n\nYour email blog platform is now ready to use! Here's how to get started:\n\n### 1. Email Publishing\n\nTo publish a blog post, simply send an email to your Val Town email address:\n\n- **Subject**: Becomes the post title\n- **Body**: Becomes the post content (HTML preferred, plain text will be converted)\n- **From**: Becomes the author information\n\nExample email:\n```\nTo: your-email-val@val.town\nSubject: My First Blog Post\nBody:

Hello World!

This is my first post published via email!

\n```\n\n### 2. Accessing Your Blog\n\n- **Main Blog**: Visit your backend HTTP val URL\n- **Individual Posts**: `/post/[slug]` (auto-generated from title)\n- **RSS Feed**: `/rss`\n- **API**: `/api/posts` for JSON data\n\n### 3. Current Features\n\n✅ **Core Features**\n- Email-to-publish functionality\n- HTML and plain text support\n- Automatic slug generation\n- SQLite database storage\n- RSS 2.0 feed\n- Responsive web interface\n- SEO-friendly URLs\n- Social media meta tags\n\n✅ **Technical Features**\n- Static HTML generation (no client-side JavaScript)\n- Hono backend API\n- TailwindCSS styling\n- Error handling and logging\n- Fast loading and SEO optimized\n\n### 4. Federation & Syndication Setup\n\nThe platform includes foundation code for:\n\n#### WebSub (PubSubHubbub)\n- Set `WEBSUB_HUB_URL` environment variable\n- Endpoint: `/websub` for subscription management\n- Automatically notifies subscribers of new posts\n\n#### ActivityPub (Mastodon, etc.)\n- Set `BASE_URL` environment variable to your domain\n- **For production use**: Generate RSA keys for HTTP signatures\n 1. Visit `/generate-keys.ts` to generate keys\n 2. Set `ACTIVITYPUB_PUBLIC_KEY` and `ACTIVITYPUB_PRIVATE_KEY` environment variables\n 3. Restart your val\n- Actor endpoint: `/actor`\n- Inbox endpoint: `/inbox`\n- Full federation support with followers, likes, and shares\n\n#### AT Protocol (Bluesky)\n- Set `ATPROTO_HANDLE` and `ATPROTO_PASSWORD` environment variables\n- Automatically cross-posts to Bluesky when publishing\n\n### 5. Environment Variables\n\nOptional configuration:\n\n```bash\n# Base URL for your blog (required for custom domains and ActivityPub)\nBASE_URL=https://your-domain.com\n\n# WebSub Hub URL (e.g., https://pubsubhubbub.appspot.com/)\nWEBSUB_HUB_URL=your-hub-url\n\n# AT Protocol (Bluesky) credentials\nATPROTO_HANDLE=your-handle.bsky.social\nATPROTO_PASSWORD=your-app-password\n\n# ActivityPub HTTP Signatures (recommended for production)\nACTIVITYPUB_PUBLIC_KEY=-----BEGIN PUBLIC KEY-----...\nACTIVITYPUB_PRIVATE_KEY=-----BEGIN PRIVATE KEY-----...\n```\n\n**To generate ActivityPub keys:**\n1. Visit `/generate-keys.ts` in your browser\n2. Copy the generated keys to your environment variables\n3. Restart your val for changes to take effect\n\n### 6. Customization\n\n#### Styling\n- Edit CSS in the `getCustomCSS()` function in `/backend/index.ts`\n- Uses TailwindCSS classes throughout\n- Modify HTML generation functions for layout changes\n\n#### Branding\n- Update blog title and description in HTML generation functions\n- Change favicon in HTML templates\n- Modify footer text in `generateBlogHTML()` and `generatePostHTML()`\n\n#### Database Schema\n- Posts are stored in SQLite table `blog_posts_v1`\n- To modify schema, create new table name (e.g., `blog_posts_v2`)\n\n### 7. Testing\n\nUse the `/test-publish.ts` val to create sample posts for testing.\n\n### 8. Monitoring\n\n- Check Val Town logs for email processing\n- Use `/health` endpoint for status checks\n- Monitor `/api/posts` for data integrity\n\n## Architecture Overview\n\n```\nEmail → email.ts (Email Trigger)\n ↓\n Database (SQLite)\n ↓\n backend/index.ts (HTTP API + HTML Generation)\n ↓\n Static HTML (TailwindCSS)\n```\n\n## Next Steps\n\n1. **Set up email forwarding** to your Val Town email address\n2. **Configure environment variables** for federation features\n3. **Customize styling** and branding to match your preferences\n4. **Test email publishing** with different content types\n5. **Share your RSS feed** for syndication\n\n## Support\n\n- Check Val Town logs for debugging\n- Use the `/health` endpoint to verify system status\n- Test individual components using the API endpoints\n\nYour email blog platform is ready to use! Send your first email to start publishing.",[],[374],{"_104":381,"_95":382,"_155":383,"_157":-5,"_158":140,"_159":384,"_161":22,"_106":385,"_100":276,"_164":288,"_166":386,"_167":22,"_168":-5,"_169":387,"_98":388},"bc1480e4-5e42-11f0-aa0d-0224a6c84d84","debug-config.ts","b97156fa-5e42-11f0-9c52-0224a6c84d84",129,["D",1752230116472],"// Debug configuration tool - HTTP endpoint to check email security settings\nimport { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { isEmailAllowed } from \"./backend/services/email-security.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n const testEmail = c.req.query(\"email\");\n \n // Get environment variables\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n const baseUrl = Deno.env.get('BASE_URL');\n \n // Parse allowed emails\n let allowedList: string[] = [];\n if (allowedEmails) {\n allowedList = allowedEmails\n .split(',')\n .map(email => email.trim().toLowerCase())\n .filter(email => email.length > 0);\n }\n \n // Test email if provided\n let emailTestResult = null;\n if (testEmail) {\n emailTestResult = {\n testEmail: testEmail,\n normalizedEmail: testEmail.trim().toLowerCase(),\n isAllowed: isEmailAllowed(testEmail),\n matchesAny: allowedList.includes(testEmail.trim().toLowerCase())\n };\n }\n \n const html = `\n\n\n\n \n \n Email Blog Debug Configuration\n \n\n\n

📧 Email Blog Debug Configuration

\n \n

🔧 Environment Variables

\n ALLOWED_EMAIL_ADDRESSES:\n

\n ${allowedEmails || 'NOT SET'}\n

\n ${!allowedEmails ? '

⚠️ This must be set for emails to be processed!

' : ''}\n

\n BASE_URL:\n

\n ${baseUrl || 'NOT SET (will auto-detect)'}\n

\n\n \n

📋 Parsed Configuration

\n Allowed Email Count: ${allowedList.length}\n

\n Allowed Emails (normalized):\n

✅ ${email}
❌ No emails configured

\n\n \n

🧪 Test Email Address

\n \n \n ${emailTestResult ? `\n

\n ${emailTestResult.isAllowed ? '✅ Email ALLOWED' : '❌ Email BLOCKED'}\n

Original: ${emailTestResult.testEmail}

Normalized: ${emailTestResult.normalizedEmail}

Matches allowlist: ${emailTestResult.matchesAny ? 'Yes' : 'No'}

\n ` : ''}\n

\n\n \n

📝 Setup Instructions

1. Set Environment Variable:

\n ALLOWED_EMAIL_ADDRESSES=user1@example.com,user2@example.com\n

\n \n

2. Send Test Email:

Send from an allowed email address
Subject becomes the post title
Body becomes the post content
You'll receive a verification email

\n \n

3. Check Logs:

Use the requests tool to see detailed logs of email processing.

\n\n\n `;\n \n return c.html(html);\n});\n\nexport default app.fetch;",[],[382],{"_104":390,"_95":99,"_155":391,"_157":-5,"_158":140,"_159":392,"_161":22,"_106":393,"_100":228,"_164":394,"_166":395,"_167":22,"_168":396,"_169":397,"_98":398},"d26c7ca6-5e43-11f0-b549-0224a6c84d84","1168efdc-5dc9-11f0-b87a-0224a6c84d84",137,["D",1752230583454],"email","import { createDraftPost, generateUniqueSlug, createEmailVerification, cleanupExpiredDrafts } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML } from \"./shared/utils.ts\";\nimport { CreateDraftPostData } from \"./shared/types.ts\";\nimport { isEmailAllowed, generateVerificationToken, sendVerificationEmail, getVerificationExpiration } from \"./backend/services/email-security.ts\";\n\n// Helper function to extract email address from display name format\nfunction extractEmailAddress(emailString: string): string {\n // Handle formats like \"Display Name \" or just \"email@domain.com\"\n const match = emailString.match(/<([^>]+)>/);\n if (match) {\n return match[1].trim();\n }\n return emailString.trim();\n}\n\n// Helper function to extract display name from email string\nfunction extractDisplayName(emailString: string): string | null {\n // Handle formats like \"Display Name \"\n const match = emailString.match(/^([^<]+)<[^>]+>$/);\n if (match) {\n return match[1].trim();\n }\n return null;\n}\n\ninterface Email {\n from: string;\n to: string[];\n subject: string;\n text?: string;\n html?: string;\n headers: Record;\n}\n\nexport default async function(email: Email) {\n const startTime = Date.now();\n console.log('=== EMAIL PROCESSING START ===');\n \n try {\n // Log full email details\n console.log('📧 Email received:', {\n from: email.from,\n to: email.to,\n subject: email.subject,\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlLength: email.html?.length || 0,\n textLength: email.text?.length || 0,\n headers: Object.keys(email.headers || {}),\n timestamp: new Date().toISOString()\n });\n\n // Log environment configuration\n const allowedEmails = Deno.env.get('ALLOWED_EMAIL_ADDRESSES');\n console.log('🔧 Environment check:', {\n hasAllowedEmails: !!allowedEmails,\n allowedEmailsLength: allowedEmails?.length || 0,\n baseUrl: Deno.env.get('BASE_URL') || 'auto-detect'\n });\n\n console.log('🗄️ Initializing database...');\n await initializeDatabase();\n console.log('✅ Database initialized');\n\n console.log('🧹 Cleaning up expired drafts...');\n await cleanupExpiredDrafts();\n console.log('✅ Cleanup completed');\n\n // Check if sender email is allowed\n const senderEmail = email.from;\n console.log('🔒 Checking email allowlist:', {\n senderEmail: senderEmail,\n normalizedSender: senderEmail.trim().toLowerCase()\n });\n\n if (!isEmailAllowed(senderEmail)) {\n console.error('❌ SECURITY: Email not allowed!', {\n senderEmail: senderEmail,\n allowedEmails: allowedEmails,\n reason: 'Email address not in ALLOWED_EMAIL_ADDRESSES environment variable'\n });\n return;\n }\n console.log('✅ Email address is allowed');\n\n // Extract post data from email\n const title = email.subject.trim();\n console.log('📝 Processing email content:', {\n originalSubject: email.subject,\n trimmedTitle: title,\n titleLength: title.length\n });\n\n if (!title) {\n console.error('❌ Email subject is empty, cannot create post');\n return;\n }\n\n // Prefer HTML content over plain text\n let content = email.html || email.text || '';\n console.log('📄 Content analysis:', {\n hasHtml: !!email.html,\n hasText: !!email.text,\n htmlPreview: email.html ? email.html.substring(0, 100) + '...' : null,\n textPreview: email.text ? email.text.substring(0, 100) + '...' : null,\n finalContentLength: content.length\n });\n\n if (!content.trim()) {\n console.error('❌ Email body is empty, cannot create post');\n return;\n }\n\n // Determine content type and process content\n let contentType: 'html' | 'text';\n if (email.html && isHTML(email.html)) {\n contentType = 'html';\n content = email.html;\n console.log('📋 Content type: HTML (using email.html)');\n } else if (email.text) {\n contentType = 'html'; // Convert text to HTML for consistent rendering\n content = textToHTML(email.text);\n console.log('📋 Content type: Text converted to HTML (using email.text)');\n } else {\n contentType = 'html';\n content = textToHTML(content);\n console.log('📋 Content type: Fallback text converted to HTML');\n }\n\n // Generate slug\n console.log('🔗 Generating slug...');\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n console.log('✅ Slug generated:', {\n baseSlug: baseSlug,\n finalSlug: slug\n });\n\n // Extract author info - use the actual email address, not the display name\n const authorEmail = extractEmailAddress(email.from);\n const displayName = extractDisplayName(email.from);\n const authorName = displayName || extractAuthorName(authorEmail);\n console.log('👤 Author info:', {\n originalFrom: email.from,\n authorEmail: authorEmail,\n displayName: displayName,\n authorName: authorName\n });\n\n // Generate verification token and expiration\n console.log('🔐 Generating verification token...');\n const verificationToken = generateVerificationToken();\n const expiresAt = getVerificationExpiration();\n console.log('✅ Verification token generated:', {\n tokenLength: verificationToken.length,\n expiresAt: expiresAt,\n expiresInHours: Math.round((new Date(expiresAt).getTime() - Date.now()) / (1000 * 60 * 60))\n });\n\n // Create draft post data\n const draftData: CreateDraftPostData = {\n title,\n slug,\n content,\n content_type: contentType,\n author_email: authorEmail,\n author_name: authorName,\n verification_token: verificationToken,\n expires_at: expiresAt\n };\n\n console.log('💾 Creating draft post in database...');\n const draftPost = await createDraftPost(draftData);\n console.log('✅ Draft post created:', { \n id: draftPost.id, \n title: draftPost.title, \n slug: draftPost.slug,\n verificationToken: draftPost.verification_token\n });\n\n console.log('📝 Creating email verification record...');\n await createEmailVerification(authorEmail, verificationToken, draftPost.id, expiresAt);\n console.log('✅ Email verification record created');\n\n console.log('📧 Sending verification email...');\n try {\n await sendVerificationEmail(authorEmail, verificationToken, title);\n console.log('✅ Verification email sent successfully');\n } catch (emailError) {\n console.error('❌ Failed to send verification email:', {\n error: emailError.message,\n stack: emailError.stack,\n recipientEmail: authorEmail,\n verificationToken: verificationToken\n });\n throw emailError;\n }\n\n const processingTime = Date.now() - startTime;\n console.log('🎉 EMAIL PROCESSING COMPLETED SUCCESSFULLY:', {\n processingTimeMs: processingTime,\n draftPostId: draftPost.id,\n verificationToken: verificationToken,\n recipientEmail: authorEmail\n });\n\n } catch (error) {\n const processingTime = Date.now() - startTime;\n console.error('💥 EMAIL PROCESSING FAILED:', {\n error: error.message,\n stack: error.stack,\n processingTimeMs: processingTime,\n emailFrom: email?.from,\n emailSubject: email?.subject\n });\n throw error;\n } finally {\n console.log('=== EMAIL PROCESSING END ===');\n }\n}","kinlan-postherous",[],[99],{"_104":400,"_95":401,"_155":402,"_157":-5,"_158":140,"_159":403,"_161":22,"_106":404,"_100":276,"_164":288,"_166":405,"_167":22,"_168":-5,"_169":406,"_98":407},"b48894f8-5e49-11f0-8fca-0224a6c84d84","generate-keys.ts","b15d7442-5e49-11f0-bb77-0224a6c84d84",185,["D",1752233110285],"/**\n * RSA Key Pair Generator for ActivityPub HTTP Signatures\n * \n * This script generates an RSA key pair for use with ActivityPub HTTP signatures.\n * Run this script to generate the keys, then set them as environment variables.\n * \n * Usage:\n * 1. Run this script to generate keys\n * 2. Copy the output keys to your environment variables:\n * - ACTIVITYPUB_PUBLIC_KEY\n * - ACTIVITYPUB_PRIVATE_KEY\n */\n\nexport default async function generateKeys() {\n try {\n console.log('🔐 Generating RSA key pair for ActivityPub HTTP signatures...');\n \n // Generate RSA key pair using Web Crypto API\n const keyPair = await crypto.subtle.generateKey(\n {\n name: \"RSASSA-PKCS1-v1_5\",\n modulusLength: 2048,\n publicExponent: new Uint8Array([1, 0, 1]),\n hash: \"SHA-256\",\n },\n true, // extractable\n [\"sign\", \"verify\"]\n );\n\n // Export public key to PEM format\n const publicKeyBuffer = await crypto.subtle.exportKey(\"spki\", keyPair.publicKey);\n const publicKeyBase64 = btoa(String.fromCharCode(...new Uint8Array(publicKeyBuffer)));\n const publicKeyPem = `-----BEGIN PUBLIC KEY-----\\n${publicKeyBase64.match(/.{1,64}/g)?.join('\\n')}\\n-----END PUBLIC KEY-----`;\n\n // Export private key to PEM format\n const privateKeyBuffer = await crypto.subtle.exportKey(\"pkcs8\", keyPair.privateKey);\n const privateKeyBase64 = btoa(String.fromCharCode(...new Uint8Array(privateKeyBuffer)));\n const privateKeyPem = `-----BEGIN PRIVATE KEY-----\\n${privateKeyBase64.match(/.{1,64}/g)?.join('\\n')}\\n-----END PRIVATE KEY-----`;\n\n console.log('✅ RSA key pair generated successfully!');\n console.log('');\n console.log('📋 Copy these environment variables to your Val Town settings:');\n console.log('');\n console.log('ACTIVITYPUB_PUBLIC_KEY:');\n console.log(publicKeyPem);\n console.log('');\n console.log('ACTIVITYPUB_PRIVATE_KEY:');\n console.log(privateKeyPem);\n console.log('');\n console.log('🔒 IMPORTANT SECURITY NOTES:');\n console.log('- Keep the private key secret and secure');\n console.log('- Do not share the private key in public repositories');\n console.log('- These keys will be used to sign ActivityPub requests');\n console.log('- Once set, do not change these keys unless necessary');\n console.log('- Changing keys will break federation with existing followers');\n console.log('');\n console.log('📝 How to set environment variables in Val Town:');\n console.log('1. Go to your Val Town dashboard');\n console.log('2. Click on your val');\n console.log('3. Click \"Settings\" or the gear icon');\n console.log('4. Add the environment variables above');\n console.log('5. Save and restart your val');\n console.log('');\n console.log('🎉 After setting these keys, your ActivityPub federation will be fully functional!');\n\n return new Response(`\n\n\n\n ActivityPub Key Generator\n \n\n\n

🔐 ActivityPub RSA Key Pair Generated

\n \n

\n ✅ Success! Your RSA key pair has been generated successfully.\n

\n\n

📋 Environment Variables

Copy these to your Val Town environment variables:

\n \n

ACTIVITYPUB_PUBLIC_KEY:

${publicKeyPem}

\n \n \n

ACTIVITYPUB_PRIVATE_KEY:

${privateKeyPem}

\n \n

\n\n

🔒 IMPORTANT SECURITY NOTES:

Keep the private key secret and secure
Do not share the private key in public repositories
These keys will be used to sign ActivityPub requests
Once set, do not change these keys unless necessary
Changing keys will break federation with existing followers

\n\n

📝 How to set environment variables in Val Town:

Go to your Val Town dashboard
Click on your val
Click \"Settings\" or the gear icon
Add the environment variables above
Save and restart your val

\n\n

\n 🎉 After setting these keys, your ActivityPub federation will be fully functional!\n

\n\n \n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n });\n\n } catch (error) {\n console.error('❌ Failed to generate RSA key pair:', error);\n return new Response(`\n\n\n\n Key Generation Error\n \n\n\n

❌ Key Generation Failed

\n Error: ${error.message}\n

Please try again or check the console for more details.

\n\n\n `, {\n headers: {\n 'Content-Type': 'text/html',\n },\n status: 500,\n });\n }\n}",[],[401],{"_104":409,"_95":410,"_155":411,"_157":-5,"_158":140,"_159":412,"_161":22,"_106":413,"_100":276,"_164":288,"_166":414,"_167":22,"_168":-5,"_169":415,"_98":416},"dd41db36-5e47-11f0-a3ef-0224a6c84d84","test-activitypub-delivery.ts","da555da8-5e47-11f0-8db6-0224a6c84d84",174,["D",1752232319616],"import { getActiveFollowers, getRecentPosts } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { publishToActivityPub } from \"./backend/services/activitypub.ts\";\n\nexport default async function(req: Request) {\n const url = new URL(req.url);\n const action = url.searchParams.get('action') || 'info';\n \n try {\n await initializeDatabase();\n \n if (action === 'info') {\n // Show current followers and recent posts\n const followers = await getActiveFollowers();\n const posts = await getRecentPosts(5);\n \n return new Response(JSON.stringify({\n followers: {\n count: followers.length,\n list: followers.map(f => ({\n actorId: f.actor_id,\n username: f.actor_username,\n domain: f.actor_domain,\n inbox: f.actor_inbox,\n sharedInbox: f.actor_shared_inbox,\n followedAt: f.followed_at\n }))\n },\n recentPosts: posts.map(p => ({\n id: p.id,\n title: p.title,\n slug: p.slug,\n publishedAt: p.published_at\n }))\n }, null, 2), {\n headers: { 'Content-Type': 'application/json' }\n });\n }\n \n if (action === 'test-delivery') {\n // Test delivery with the most recent post\n const posts = await getRecentPosts(1);\n if (posts.length === 0) {\n return new Response(JSON.stringify({\n error: 'No posts found to test delivery'\n }), {\n status: 404,\n headers: { 'Content-Type': 'application/json' }\n });\n }\n \n const post = posts[0];\n console.log('🧪 Testing ActivityPub delivery for post:', post.title);\n \n try {\n await publishToActivityPub(post);\n return new Response(JSON.stringify({\n success: true,\n message: `Test delivery completed for post: ${post.title}`,\n postSlug: post.slug\n }), {\n headers: { 'Content-Type': 'application/json' }\n });\n } catch (error) {\n return new Response(JSON.stringify({\n success: false,\n error: error.message,\n postTitle: post.title\n }), {\n status: 500,\n headers: { 'Content-Type': 'application/json' }\n });\n }\n }\n \n return new Response(JSON.stringify({\n availableActions: [\n 'info - Show followers and recent posts',\n 'test-delivery - Test ActivityPub delivery with most recent post'\n ],\n usage: 'Add ?action=info or ?action=test-delivery to the URL'\n }), {\n headers: { 'Content-Type': 'application/json' }\n });\n \n } catch (error) {\n return new Response(JSON.stringify({\n error: error.message,\n stack: error.stack\n }), {\n status: 500,\n headers: { 'Content-Type': 'application/json' }\n });\n }\n}",[],[410],{"_104":418,"_95":419,"_155":420,"_157":-5,"_158":140,"_159":421,"_161":22,"_106":422,"_100":276,"_164":288,"_166":423,"_167":22,"_168":-5,"_169":424,"_98":425},"8b7debc2-5dda-11f0-bab4-0224a6c84d84","test-activitypub-inbox.ts","875c0f7e-5dda-11f0-9812-0224a6c84d84",84,["D",1752185367288],"/**\n * Test script for ActivityPub inbox functionality\n * \n * This script simulates various ActivityPub activities to test the inbox processing.\n */\n\nconst BASE_URL = 'https://paulkinlan--260c95825dca11f0b2ad0224a6c84d84.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubInbox() {\n console.log('🧪 Testing ActivityPub inbox functionality...\\n');\n \n // Test Follow activity\n const followActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: {\n id: 'https://mastodon.social/users/testuser',\n type: 'Person',\n preferredUsername: 'testuser',\n name: 'Test User',\n inbox: 'https://mastodon.social/users/testuser/inbox',\n icon: {\n type: 'Image',\n url: 'https://mastodon.social/avatars/testuser.jpg'\n },\n endpoints: {\n sharedInbox: 'https://mastodon.social/inbox'\n }\n },\n object: `${BASE_URL}/actor`,\n published: new Date().toISOString()\n };\n\n console.log('📤 Testing Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(followActivity)\n });\n\n if (response.ok) {\n console.log('✅ Follow activity processed successfully');\n \n // Check if follower was added\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n \n if (followersData.totalItems > 0) {\n console.log(` New follower: ${followersData.orderedItems[0]}`);\n }\n } else {\n console.log(`❌ Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Follow activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Like activity\n const likeActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#likes/456',\n type: 'Like',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`, // Assuming there's a post with slug 'test'\n published: new Date().toISOString()\n };\n\n console.log('❤️ Testing Like activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(likeActivity)\n });\n\n if (response.ok) {\n console.log('✅ Like activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Like activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Like activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Announce (share) activity\n const announceActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#announces/789',\n type: 'Announce',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/post/test`,\n published: new Date().toISOString(),\n to: ['https://www.w3.org/ns/activitystreams#Public']\n };\n\n console.log('🔄 Testing Announce (share) activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(announceActivity)\n });\n\n if (response.ok) {\n console.log('✅ Announce activity processed successfully');\n \n // Check activity counts for the post\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Likes: ${activityData.activityCounts.likes}`);\n console.log(` Shares: ${activityData.activityCounts.shares}`);\n console.log(` Replies: ${activityData.activityCounts.replies}`);\n }\n } else {\n console.log(`❌ Announce activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Announce activity error: ${error.message}`);\n }\n\n console.log('');\n\n // Test Undo Follow activity\n const undoFollowActivity = {\n '@context': 'https://www.w3.org/ns/activitystreams',\n id: 'https://mastodon.social/users/testuser#undo/123',\n type: 'Undo',\n actor: 'https://mastodon.social/users/testuser',\n object: {\n id: 'https://mastodon.social/users/testuser#follows/123',\n type: 'Follow',\n actor: 'https://mastodon.social/users/testuser',\n object: `${BASE_URL}/actor`\n },\n published: new Date().toISOString()\n };\n\n console.log('↩️ Testing Undo Follow activity...');\n try {\n const response = await fetch(`${BASE_URL}/inbox`, {\n method: 'POST',\n headers: {\n 'Content-Type': 'application/activity+json'\n },\n body: JSON.stringify(undoFollowActivity)\n });\n\n if (response.ok) {\n console.log('✅ Undo Follow activity processed successfully');\n \n // Check if follower was removed\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Followers count: ${followersData.totalItems}`);\n } else {\n console.log(`❌ Undo Follow activity failed: ${response.status}`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n }\n } catch (error) {\n console.log(`❌ Undo Follow activity error: ${error.message}`);\n }\n\n console.log('\\n🎉 ActivityPub inbox testing complete!');\n console.log('\\n📊 Final Status:');\n \n // Get final followers count\n try {\n const followersResponse = await fetch(`${BASE_URL}/followers`);\n const followersData = await followersResponse.json();\n console.log(` Total followers: ${followersData.totalItems}`);\n } catch (error) {\n console.log(` Could not fetch followers: ${error.message}`);\n }\n\n // Get final activity counts for test post\n try {\n const activityResponse = await fetch(`${BASE_URL}/api/posts/test/activities`);\n if (activityResponse.ok) {\n const activityData = await activityResponse.json();\n console.log(` Test post activities - Likes: ${activityData.activityCounts.likes}, Shares: ${activityData.activityCounts.shares}, Replies: ${activityData.activityCounts.replies}`);\n }\n } catch (error) {\n console.log(` Could not fetch activity counts: ${error.message}`);\n }\n}\n\nexport default async function() {\n await testActivityPubInbox();\n return new Response('ActivityPub inbox test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n}",[],[419],{"_104":427,"_95":428,"_155":429,"_157":-5,"_158":140,"_159":430,"_161":22,"_106":431,"_100":276,"_164":288,"_166":432,"_167":22,"_168":-5,"_169":433,"_98":434},"0f4ecd02-5dd8-11f0-9361-0224a6c84d84","test-activitypub.ts","0927eefe-5dd8-11f0-a245-0224a6c84d84",66,["D",1752184299952],"/**\n * Test script to verify ActivityPub and WebFinger implementation\n * \n * This script tests all the ActivityPub endpoints to ensure they're working correctly.\n */\n\nconst BASE_URL = 'https://your-val-name.web.val.run'; // Replace with your actual domain\n\nasync function testActivityPubEndpoints() {\n console.log('🧪 Testing ActivityPub and WebFinger endpoints...\\n');\n \n const tests = [\n {\n name: 'WebFinger - acct format',\n url: `${BASE_URL}/.well-known/webfinger?resource=acct:blog@your-domain.com`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'WebFinger - direct URL format',\n url: `${BASE_URL}/.well-known/webfinger?resource=${BASE_URL}/actor`,\n expectedContentType: 'application/jrd+json'\n },\n {\n name: 'ActivityPub Actor',\n url: `${BASE_URL}/actor`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Outbox',\n url: `${BASE_URL}/outbox`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Followers',\n url: `${BASE_URL}/followers`,\n expectedContentType: 'application/activity+json'\n },\n {\n name: 'ActivityPub Following',\n url: `${BASE_URL}/following`,\n expectedContentType: 'application/activity+json'\n }\n ];\n \n for (const test of tests) {\n try {\n console.log(`Testing: ${test.name}`);\n const response = await fetch(test.url);\n \n if (response.ok) {\n const contentType = response.headers.get('content-type');\n const data = await response.json();\n \n console.log(`✅ ${test.name}: OK (${response.status})`);\n console.log(` Content-Type: ${contentType}`);\n \n if (test.name.includes('WebFinger')) {\n console.log(` Subject: ${data.subject}`);\n console.log(` Links: ${data.links?.length || 0} found`);\n } else if (test.name.includes('Actor')) {\n console.log(` Type: ${data.type}`);\n console.log(` Username: ${data.preferredUsername}`);\n console.log(` Name: ${data.name}`);\n } else if (test.name.includes('Outbox')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n } else if (test.name.includes('Followers') || test.name.includes('Following')) {\n console.log(` Type: ${data.type}`);\n console.log(` Total Items: ${data.totalItems}`);\n }\n \n console.log('');\n } else {\n console.log(`❌ ${test.name}: Failed (${response.status})`);\n const errorText = await response.text();\n console.log(` Error: ${errorText}`);\n console.log('');\n }\n } catch (error) {\n console.log(`❌ ${test.name}: Error`);\n console.log(` ${error.message}`);\n console.log('');\n }\n }\n \n console.log('🎉 ActivityPub testing complete!');\n console.log('\\n📝 Next steps:');\n console.log('1. Replace BASE_URL with your actual domain');\n console.log('2. Test WebFinger with your actual domain in the resource parameter');\n console.log('3. Try following your blog from a Mastodon instance using @blog@your-domain.com');\n}\n\nexport default async function() {\n await testActivityPubEndpoints();\n return new Response('ActivityPub test completed. Check console for results.', {\n headers: { 'Content-Type': 'text/plain' }\n });\n}",[],[428],{"_104":436,"_95":437,"_155":438,"_157":-5,"_158":140,"_159":439,"_161":22,"_106":440,"_100":276,"_164":288,"_166":441,"_167":22,"_168":-5,"_169":442,"_98":443},"a190b8d2-5dca-11f0-a4b8-0224a6c84d84","test-publish.ts","9f538f54-5dca-11f0-a2a2-0224a6c84d84",26,["D",1752178532376],"// Test endpoint to simulate email publishing\nimport { createPost, generateUniqueSlug } from \"./backend/database/queries.ts\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { slugify, extractAuthorName, isHTML, textToHTML } from \"./shared/utils.ts\";\nimport { CreatePostData } from \"./shared/types.ts\";\n\nexport default async function(req: Request) {\n try {\n // Initialize database\n await initializeDatabase();\n\n // Create a test post\n const title = \"Welcome to Email Blog!\";\n const content = `

Hello World!

This is a test post created to demonstrate the email blog platform.

Features include:

📧 Email-to-publish functionality
📡 RSS feed support
🌐 Clean, responsive design
🔗 SEO-friendly URLs

Send an email to start publishing your own posts!

`;\n \n const authorEmail = \"demo@example.com\";\n const authorName = \"Demo User\";\n \n // Generate slug\n const baseSlug = slugify(title);\n const slug = await generateUniqueSlug(baseSlug);\n \n // Create post data\n const postData: CreatePostData = {\n title,\n slug,\n content,\n content_type: 'html',\n author_email: authorEmail,\n author_name: authorName\n };\n\n // Save post to database\n const post = await createPost(postData);\n \n return new Response(JSON.stringify({\n success: true,\n message: \"Test post created successfully!\",\n post: {\n id: post.id,\n title: post.title,\n slug: post.slug,\n author: post.author_name,\n published_at: post.published_at\n }\n }), {\n headers: { \"Content-Type\": \"application/json\" }\n });\n \n } catch (error) {\n console.error('Error creating test post:', error);\n return new Response(JSON.stringify({\n success: false,\n error: error.message\n }), {\n status: 500,\n headers: { \"Content-Type\": \"application/json\" }\n });\n }\n}",[],[437],{"_104":445,"_95":446,"_155":447,"_157":-5,"_158":140,"_159":448,"_161":22,"_106":449,"_100":276,"_164":288,"_166":450,"_167":22,"_168":-5,"_169":451,"_98":452},"e797ef0c-5e43-11f0-8022-0224a6c84d84","test-verification.ts","e4cf61e2-5e43-11f0-b76c-0224a6c84d84",139,["D",1752230618971],"// Test verification flow - HTTP endpoint to test the verification system\nimport { Hono } from \"https://esm.sh/hono@3.11.7\";\nimport { initializeDatabase } from \"./backend/database/schema.ts\";\nimport { createDraftPost, createEmailVerification, getDraftPostByToken, getEmailVerificationByToken } from \"./backend/database/queries.ts\";\nimport { generateVerificationToken, getVerificationExpiration } from \"./backend/services/email-security.ts\";\nimport { CreateDraftPostData } from \"./shared/types.ts\";\n\nconst app = new Hono();\n\napp.get(\"/\", async (c) => {\n try {\n await initializeDatabase();\n \n // Create a test draft post\n const verificationToken = generateVerificationToken();\n const expiresAt = getVerificationExpiration();\n \n const draftData: CreateDraftPostData = {\n title: \"Test Verification Post\",\n slug: \"test-verification-post-\" + Date.now(),\n content: \"

This is a test post to verify the verification system works.

\",\n content_type: \"html\",\n author_email: \"test@example.com\",\n author_name: \"Test User\",\n verification_token: verificationToken,\n expires_at: expiresAt\n };\n \n const draft = await createDraftPost(draftData);\n await createEmailVerification(\"test@example.com\", verificationToken, draft.id, expiresAt);\n \n // Test retrieval\n const retrievedDraft = await getDraftPostByToken(verificationToken);\n const retrievedVerification = await getEmailVerificationByToken(verificationToken);\n \n const baseUrl = c.req.header(\"host\") ? `https://${c.req.header(\"host\")}` : \"http://localhost\";\n const verificationUrl = `${baseUrl.replace('test-verification', 'backend/index')}/verify-email?token=${verificationToken}`;\n \n const html = `\n\n\n\n \n \n Verification Test\n \n\n\n

🧪 Verification System Test

\n \n

✅ Test Results

\n Draft Post Created: ${draft ? '✅ Success' : '❌ Failed'}\n ${draft ? `

ID: ${draft.id}, Title: ${draft.title}

` : ''}\n

\n Verification Record Created: ${retrievedVerification ? '✅ Success' : '❌ Failed'}\n ${retrievedVerification ? `

ID: ${retrievedVerification.id}, Email: ${retrievedVerification.email}

` : ''}\n

\n Draft Retrieval: ${retrievedDraft ? '✅ Success' : '❌ Failed'}\n

\n\n \n

🔗 Test Verification Link

Click the link below to test the verification process:

\n \n 🔐 Test Verification Link\n \n

\n ${verificationUrl}\n

\n\n \n

🔍 Debug Information

Token: ${verificationToken.substring(0, 20)}...

Expires: ${expiresAt}

Draft ID: ${draft?.id}

Verification ID: ${retrievedVerification?.id}

\n\n\n `;\n \n return c.html(html);\n } catch (error) {\n return c.text(`Error: ${error.message}\\n\\nStack: ${error.stack}`, 500);\n }\n});\n\nexport default app.fetch;",[],[446],"files",[152,171,177,188,199,205,214,224,233,242,252,261,270,281,293,300,309,315,324,334,344,353,363,372,380,389,399,408,417,426,435,444],"counts",{"_457":32,"_458":276,"_459":160,"_460":183},"pulls","branches","forks","envVars","contents",[],{"_104":390,"_95":99,"_155":391,"_157":-5,"_158":140,"_159":392,"_161":22,"_106":464,"_100":228,"_164":394,"_166":395,"_167":22,"_168":396,"_98":465},["D",1752230583454],[99],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.branch.$branch.version.$version.code.$",{"_93":94,"_95":96,"_97":43,"_100":101,"_98":99,"_102":474,"_150":479,"_453":576,"_340":577,"_461":579,"_580":-5,"_581":22,"_582":-5,"_583":-5,"_584":-5,"_585":586},{"_104":105,"_95":96,"_106":475,"_108":-5,"_109":22,"_110":111,"_112":113,"_114":-5,"_14":115,"_116":-5,"_117":22,"_118":-5,"_119":120,"_16":121,"_122":123,"_124":123,"_125":126,"_127":126,"_128":126,"_129":123,"_130":123,"_23":476,"_134":477,"_137":478,"_149":22},["D",1752177490232],{"_93":94,"_132":133},{"_93":94,"_136":133},{"_100":139,"_95":43,"_104":140,"_141":105,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":96,"_148":94},[480,522,528,537,540,543,546,549,552,555,558,561,564,567,570,573],{"_104":153,"_95":154,"_155":156,"_157":-5,"_158":140,"_159":160,"_161":162,"_106":163,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":481,"_98":521},[482,491,518],{"_104":172,"_95":173,"_155":174,"_157":156,"_158":140,"_159":160,"_161":162,"_106":175,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":483,"_98":490},[484,487],{"_104":178,"_95":179,"_155":180,"_157":174,"_158":140,"_159":181,"_161":22,"_106":182,"_100":183,"_164":184,"_166":185,"_167":22,"_168":-5,"_169":485,"_98":486},[],[154,173,179],{"_104":189,"_95":190,"_155":191,"_157":174,"_158":140,"_159":192,"_161":22,"_106":193,"_100":194,"_164":184,"_166":195,"_167":22,"_168":-5,"_169":488,"_98":489},[],[154,173,190],[154,173],{"_104":200,"_95":201,"_155":202,"_157":156,"_158":140,"_159":194,"_161":162,"_106":203,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":492,"_98":517},[493,496,499,502,505,508,511,514],{"_104":206,"_95":207,"_155":208,"_157":202,"_158":140,"_159":209,"_161":22,"_106":210,"_100":32,"_164":184,"_166":211,"_167":22,"_168":-5,"_169":494,"_98":495},[],[154,201,207],{"_104":215,"_95":216,"_155":217,"_157":202,"_158":140,"_159":218,"_161":22,"_106":219,"_100":220,"_164":184,"_166":221,"_167":22,"_168":-5,"_169":497,"_98":498},[],[154,201,216],{"_104":225,"_95":226,"_155":227,"_157":202,"_158":140,"_159":228,"_161":22,"_106":229,"_100":32,"_164":184,"_166":230,"_167":22,"_168":-5,"_169":500,"_98":501},[],[154,201,226],{"_104":234,"_95":235,"_155":236,"_157":202,"_158":140,"_159":237,"_161":162,"_106":238,"_100":160,"_164":184,"_166":239,"_167":22,"_168":-5,"_169":503,"_98":504},[],[154,201,235],{"_104":243,"_95":244,"_155":245,"_157":202,"_158":140,"_159":246,"_161":22,"_106":247,"_100":248,"_164":184,"_166":249,"_167":22,"_168":-5,"_169":506,"_98":507},[],[154,201,244],{"_104":253,"_95":254,"_155":255,"_157":202,"_158":140,"_159":256,"_161":162,"_106":257,"_100":32,"_164":184,"_166":258,"_167":22,"_168":-5,"_169":509,"_98":510},[],[154,201,254],{"_104":262,"_95":263,"_155":264,"_157":202,"_158":140,"_159":265,"_161":22,"_106":266,"_100":248,"_164":184,"_166":267,"_167":22,"_168":-5,"_169":512,"_98":513},[],[154,201,263],{"_104":271,"_95":272,"_155":273,"_157":202,"_158":140,"_159":274,"_161":162,"_106":275,"_100":276,"_164":184,"_166":277,"_167":22,"_168":-5,"_169":515,"_98":516},[],[154,201,272],[154,201],{"_104":282,"_95":283,"_155":284,"_157":156,"_158":140,"_159":285,"_161":22,"_106":286,"_100":287,"_164":288,"_166":289,"_167":22,"_168":-5,"_169":519,"_98":520},[],[154,283],[154],{"_104":294,"_95":295,"_155":296,"_157":-5,"_158":140,"_159":297,"_161":162,"_106":298,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":523,"_98":527},[524],{"_104":301,"_95":302,"_155":303,"_157":296,"_158":140,"_159":304,"_161":162,"_106":305,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":525,"_98":526},[],[295,302],[295],{"_104":310,"_95":311,"_155":312,"_157":-5,"_158":140,"_159":248,"_161":162,"_106":313,"_100":32,"_164":165,"_166":-5,"_167":22,"_168":-5,"_169":529,"_98":536},[530,533],{"_104":316,"_95":317,"_155":318,"_157":312,"_158":140,"_159":319,"_161":22,"_106":320,"_100":248,"_164":184,"_166":321,"_167":22,"_168":-5,"_169":531,"_98":532},[],[311,317],{"_104":325,"_95":326,"_155":327,"_157":312,"_158":140,"_159":328,"_161":22,"_106":329,"_100":32,"_164":184,"_166":330,"_167":22,"_168":-5,"_169":534,"_98":535},[],[311,326],[311],{"_104":335,"_95":336,"_155":337,"_157":-5,"_158":140,"_159":338,"_161":162,"_106":339,"_100":32,"_164":340,"_166":341,"_167":22,"_168":-5,"_169":538,"_98":539},[],[336],{"_104":345,"_95":346,"_155":347,"_157":-5,"_158":140,"_159":348,"_161":22,"_106":349,"_100":248,"_164":340,"_166":350,"_167":22,"_168":-5,"_169":541,"_98":542},[],[346],{"_104":354,"_95":355,"_155":356,"_157":-5,"_158":140,"_159":357,"_161":22,"_106":358,"_100":359,"_164":340,"_166":360,"_167":22,"_168":-5,"_169":544,"_98":545},[],[355],{"_104":364,"_95":365,"_155":366,"_157":-5,"_158":140,"_159":367,"_161":162,"_106":368,"_100":32,"_164":340,"_166":369,"_167":22,"_168":-5,"_169":547,"_98":548},[],[365],{"_104":373,"_95":374,"_155":375,"_157":-5,"_158":140,"_159":101,"_161":162,"_106":376,"_100":120,"_164":340,"_166":377,"_167":22,"_168":-5,"_169":550,"_98":551},[],[374],{"_104":381,"_95":382,"_155":383,"_157":-5,"_158":140,"_159":384,"_161":22,"_106":385,"_100":276,"_164":288,"_166":386,"_167":22,"_168":-5,"_169":553,"_98":554},[],[382],{"_104":390,"_95":99,"_155":391,"_157":-5,"_158":140,"_159":392,"_161":22,"_106":393,"_100":228,"_164":394,"_166":395,"_167":22,"_168":396,"_169":556,"_98":557},[],[99],{"_104":400,"_95":401,"_155":402,"_157":-5,"_158":140,"_159":403,"_161":22,"_106":404,"_100":276,"_164":288,"_166":405,"_167":22,"_168":-5,"_169":559,"_98":560},[],[401],{"_104":409,"_95":410,"_155":411,"_157":-5,"_158":140,"_159":412,"_161":22,"_106":413,"_100":276,"_164":288,"_166":414,"_167":22,"_168":-5,"_169":562,"_98":563},[],[410],{"_104":418,"_95":419,"_155":420,"_157":-5,"_158":140,"_159":421,"_161":22,"_106":422,"_100":276,"_164":288,"_166":423,"_167":22,"_168":-5,"_169":565,"_98":566},[],[419],{"_104":427,"_95":428,"_155":429,"_157":-5,"_158":140,"_159":430,"_161":22,"_106":431,"_100":276,"_164":288,"_166":432,"_167":22,"_168":-5,"_169":568,"_98":569},[],[428],{"_104":436,"_95":437,"_155":438,"_157":-5,"_158":140,"_159":439,"_161":22,"_106":440,"_100":276,"_164":288,"_166":441,"_167":22,"_168":-5,"_169":571,"_98":572},[],[437],{"_104":445,"_95":446,"_155":447,"_157":-5,"_158":140,"_159":448,"_161":22,"_106":449,"_100":276,"_164":288,"_166":450,"_167":22,"_168":-5,"_169":574,"_98":575},[],[446],[480,482,484,487,491,493,496,499,502,505,508,511,514,518,522,524,528,530,533,537,540,543,546,549,552,555,558,561,564,567,570,573],{"_104":390,"_95":99,"_155":391,"_157":-5,"_158":140,"_159":392,"_161":22,"_106":464,"_100":228,"_164":394,"_166":395,"_167":22,"_168":396,"_98":578},[99],[],"upstream","showCompareCallout","pull","ahead","behind","templates",[],"actionData","errors"]