[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_673":674,"_675":676},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_17":18,"_53":-7,"_256":-5,"_19":257,"_258":259,"_260":261,"_262":263,"_264":265,"_21":266,"_267":-5,"_268":-5,"_269":30,"_270":271,"_272":24,"_273":-5,"_274":-5,"_275":276},"routes/_app.x.$handle.$name.branch.$branch.history_.$",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":26,"_27":28,"_29":30,"_31":-5},"handle","pikachu","name","Quickstart-Full-Stack","branchName","main","path","backend","project",{"_47":202,"_13":14,"_51":203,"_204":-5,"_205":30,"_206":207,"_208":207,"_209":210,"_211":212,"_31":82,"_213":214,"_215":24,"_216":-5,"_217":-5,"_218":26,"_55":56,"_219":220,"_221":222,"_223":224,"_225":-5,"_226":227,"_228":227,"_229":230,"_231":230,"_232":230,"_233":227,"_234":227,"_66":235,"_236":237,"_238":239,"_240":30},"file",{"_76":199,"_13":18,"_79":200,"_81":30,"_201":-5},"isDirectory",true,"page",1,"history",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46],"hasNext",false,"userId",{"_47":189,"_49":50,"_51":190,"_53":191,"_55":56,"_57":192,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":193,"_21":194,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":195},{"_47":182,"_49":50,"_51":183,"_53":184,"_55":56,"_57":175,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":185,"_21":186,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":187},{"_47":175,"_49":50,"_51":176,"_53":177,"_55":56,"_57":168,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":178,"_21":179,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":180},{"_47":168,"_49":50,"_51":169,"_53":170,"_55":56,"_57":160,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":171,"_21":172,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":173},{"_47":160,"_49":50,"_51":161,"_53":162,"_55":56,"_57":150,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":163,"_21":164,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":165},{"_47":150,"_49":50,"_51":151,"_53":152,"_55":56,"_57":153,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":154,"_21":155,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":156},{"_47":142,"_49":50,"_51":143,"_53":144,"_55":56,"_57":145,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":146,"_21":147,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":148},{"_47":135,"_49":50,"_51":136,"_53":137,"_55":56,"_57":127,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":138,"_21":139,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":140},{"_47":127,"_49":50,"_51":128,"_53":129,"_55":56,"_57":130,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":131,"_21":132,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":133},{"_47":119,"_49":50,"_51":120,"_53":121,"_55":56,"_57":122,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":123,"_21":124,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":125},{"_47":112,"_49":50,"_51":113,"_53":114,"_55":56,"_57":104,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":115,"_21":116,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":117},{"_47":104,"_49":50,"_51":105,"_53":106,"_55":56,"_57":107,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":108,"_21":109,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":110},{"_47":95,"_49":50,"_51":96,"_53":97,"_55":56,"_57":85,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":98,"_21":99,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":100},{"_47":85,"_49":50,"_51":86,"_53":87,"_55":56,"_57":88,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":89,"_21":90,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":91},{"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_21":68,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":74},"id","8676cb4a-4951-11f1-b6e3-42b51c65c3df","branchId","5a0a7ac8-4895-11f1-80ec-42b51c65c3df","createdAt",["D",1778074992189],"version",37,"orgId","019df771-9af8-7238-99a4-541e39355038","parentId","866fb2c4-4951-11f1-9e49-42b51c65c3df","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","clientLabel","user",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":77,"_13":78,"_79":80,"_81":30},"pull","merge","revert","multiple","commits",[75],{"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_21":68,"_69":-5,"_70":-5,"_71":-5},"fileId","aa15db36-48c5-11f1-8bd1-42b51c65c3df","storage.ts","fileType","script","deleted","173e7424-8658-428f-a3bc-ae4faeaabd1c","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/22c8ba37-42c8-4af4-8daf-8cdd2f5f1800/square512?exp=1789538399&sig=21cdba23f818845c8391e88088eb5ea9255dbc43e05efe79e25bd70ab9ddb43a","86827ec2-4951-11f1-a193-42b51c65c3df",["D",1778074992202],39,"867ca880-4951-11f1-bc82-42b51c65c3df",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":93,"_13":94,"_79":80,"_81":30},[92],{"_47":85,"_49":50,"_51":86,"_53":87,"_55":56,"_57":88,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":89,"_21":90,"_69":-5,"_70":-5,"_71":-5},"aada9642-48c5-11f1-b1d7-42b51c65c3df","shared.ts","86918eb2-4951-11f1-a16a-42b51c65c3df",["D",1778074992215],40,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":102,"_13":103,"_79":80,"_81":30},[101],{"_47":95,"_49":50,"_51":96,"_53":97,"_55":56,"_57":85,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":98,"_21":99,"_69":-5,"_70":-5,"_71":-5},"aad2cfa2-48c5-11f1-bfb8-42b51c65c3df","db.ts","7c250b8e-496f-11f1-a313-42b51c65c3df",["D",1778087859791],48,"7c1e9f88-496f-11f1-b4b9-42b51c65c3df",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":77,"_13":78,"_79":80,"_81":30},[111],{"_47":104,"_49":50,"_51":105,"_53":106,"_55":56,"_57":107,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":108,"_21":109,"_69":-5,"_70":-5,"_71":-5},"7c30beca-496f-11f1-8274-42b51c65c3df",["D",1778087859781],49,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":93,"_13":94,"_79":80,"_81":30},[118],{"_47":112,"_49":50,"_51":113,"_53":114,"_55":56,"_57":104,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":115,"_21":116,"_69":-5,"_70":-5,"_71":-5},"7c60f31a-496f-11f1-8274-42b51c65c3df",["D",1778087860187],51,"7c35b876-496f-11f1-8f5c-42b51c65c3df",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":102,"_13":103,"_79":80,"_81":30},[126],{"_47":119,"_49":50,"_51":120,"_53":121,"_55":56,"_57":122,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":123,"_21":124,"_69":-5,"_70":-5,"_71":-5},"a8e8bf86-4b17-11f1-bccd-ee650bb23af1",["D",1778270041498],56,"a8e28288-4b17-11f1-9fc9-ee650bb23af1",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":93,"_13":94,"_79":80,"_81":30},[134],{"_47":127,"_49":50,"_51":128,"_53":129,"_55":56,"_57":130,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":131,"_21":132,"_69":-5,"_70":-5,"_71":-5},"a8f2b4aa-4b17-11f1-b625-ee650bb23af1",["D",1778270041461],57,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":77,"_13":78,"_79":80,"_81":30},[141],{"_47":135,"_49":50,"_51":136,"_53":137,"_55":56,"_57":127,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":138,"_21":139,"_69":-5,"_70":-5,"_71":-5},"a91c5eb8-4b17-11f1-bff1-ee650bb23af1",["D",1778270041839],59,"a8fa37c0-4b17-11f1-9c61-ee650bb23af1",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":102,"_13":103,"_79":80,"_81":30},[149],{"_47":142,"_49":50,"_51":143,"_53":144,"_55":56,"_57":145,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":146,"_21":147,"_69":-5,"_70":-5,"_71":-5},"412a903a-4b18-11f1-af71-ee650bb23af1",["D",1778270296963],64,"a99c0dd4-4b17-11f1-8616-ee650bb23af1",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":158,"_13":159,"_79":80,"_81":30},[157],{"_47":150,"_49":50,"_51":151,"_53":152,"_55":56,"_57":153,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":154,"_21":155,"_69":-5,"_70":-5,"_71":-5},"41291502-4b18-11f1-af71-ee650bb23af1","new-file-1283.ts","460929d6-4b18-11f1-9de4-ee650bb23af1",["D",1778270305110],65,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":158,"_13":159,"_79":167,"_81":30},[166],{"_47":160,"_49":50,"_51":161,"_53":162,"_55":56,"_57":150,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":163,"_21":164,"_69":-5,"_70":-5,"_71":-5},"http","4615ba16-4b18-11f1-bbf0-ee650bb23af1",["D",1778270305113],66,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":158,"_13":159,"_79":167,"_81":30},[174],{"_47":168,"_49":50,"_51":169,"_53":170,"_55":56,"_57":160,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":171,"_21":172,"_69":-5,"_70":-5,"_71":-5},"4de3fffa-4b18-11f1-bd3b-ee650bb23af1",["D",1778270318276],67,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":158,"_13":159,"_79":167,"_81":30},[181],{"_47":175,"_49":50,"_51":176,"_53":177,"_55":56,"_57":168,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":178,"_21":179,"_69":-5,"_70":-5,"_71":-5},"61af6c68-4b18-11f1-b41a-ee650bb23af1",["D",1778270351511],68,{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":158,"_13":159,"_79":167,"_81":24},[188],{"_47":182,"_49":50,"_51":183,"_53":184,"_55":56,"_57":175,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":185,"_21":186,"_69":-5,"_70":-5,"_71":-5},"4905dca2-4b21-11f1-861e-ee650bb23af1",["D",1778274175617],90,"48f8611c-4b21-11f1-81f8-ee650bb23af1",{"_47":82,"_55":56,"_11":12,"_83":84},{"_76":197,"_13":198,"_79":80,"_81":30},[196],{"_47":189,"_49":50,"_51":190,"_53":191,"_55":56,"_57":192,"_59":-5,"_60":-5,"_61":-5,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":193,"_21":194,"_69":-5,"_70":-5,"_71":-5},"49048168-4b21-11f1-861e-ee650bb23af1","openai-test.ts","8630361c-4951-11f1-a193-42b51c65c3df","directory","deletedAtVersion","5a09ae54-4895-11f1-80ec-42b51c65c3df",["D",1777994172310],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","An elegant template for an elegant single-person full stack app.","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/3ed9401e-3850-4a69-dec2-1bdd924c0900/square512?exp=1789538399&sig=8ded5b974bfebef9817e2fbdffe4de4e1704e0d4cab9518c811db2594c0af107","pinnedFileId","e1c705aa-4b18-11f1-b4ae-ee650bb23af1","pinPreview","pinMigrated","screenshotVersion","likeCount","tursoName","5a09ae54489511f180ec42b51c65c3df","tursoHostname","5a09ae54489511f180ec42b51c65c3df-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789511441255],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_255":84},"org",{"_11":12,"_250":251,"_83":84,"_31":82,"_252":253,"_254":30},"branch",{"_53":241,"_13":16,"_47":50,"_242":202,"_243":-5,"_244":-5,"_245":-5,"_246":-5,"_247":-5,"_248":14,"_249":12},"isOwned",384,"projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Minion","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_47":202,"_13":14,"_51":668,"_204":-5,"_205":30,"_206":207,"_208":207,"_209":210,"_211":212,"_31":82,"_213":214,"_215":24,"_216":-5,"_217":-5,"_218":26,"_55":56,"_219":220,"_221":222,"_223":669,"_225":-5,"_226":227,"_228":227,"_229":230,"_231":230,"_232":230,"_233":227,"_234":227,"_66":670,"_236":671,"_238":672,"_240":30},"tree",[351,359,381,384,385,386,387,388,389],"files",[351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389],"counts",{"_341":279,"_342":26,"_343":26,"_344":345,"_346":347},"contents",[285,286,287,288,289,290,291],{"_47":277,"_49":50,"_76":199,"_13":18,"_278":-5,"_79":200,"_53":279,"_57":-5,"_51":280,"_281":282,"_283":-5,"_17":284},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},"86303568-4951-11f1-a193-42b51c65c3df","content",0,["D",1778074991756],"branchVersion",35,"label",[18],{"_47":334,"_13":335,"_76":336,"_57":199,"_49":50,"_281":337,"_294":24,"_51":338,"_53":279,"_79":80,"_278":339,"_81":30,"_283":-5,"_17":340},{"_47":327,"_13":328,"_76":329,"_57":199,"_49":50,"_281":330,"_294":24,"_51":331,"_53":324,"_79":80,"_278":332,"_81":30,"_283":-5,"_17":333},{"_47":319,"_13":320,"_76":321,"_57":199,"_49":50,"_281":322,"_294":24,"_51":323,"_53":324,"_79":80,"_278":325,"_81":30,"_283":-5,"_17":326},{"_47":313,"_13":103,"_76":102,"_57":199,"_49":50,"_281":314,"_294":24,"_51":315,"_53":316,"_79":80,"_278":317,"_81":30,"_283":-5,"_17":318},{"_47":305,"_13":306,"_76":307,"_57":199,"_49":50,"_281":308,"_294":24,"_51":309,"_53":310,"_79":80,"_278":311,"_81":30,"_283":-5,"_17":312},{"_47":299,"_13":94,"_76":93,"_57":199,"_49":50,"_281":300,"_294":24,"_51":301,"_53":302,"_79":80,"_278":303,"_81":30,"_283":-5,"_17":304},{"_47":292,"_13":78,"_76":77,"_57":199,"_49":50,"_281":293,"_294":24,"_51":295,"_53":296,"_79":80,"_278":297,"_81":30,"_283":-5,"_17":298},"ff6bf267-ea06-4164-8641-522efd0773df",338,"latest",["D",1788140101937],11,"// storage.ts — Blob storage helpers (account-scoped; namespace keys with PREFIX)\n// Docs: https://docs.val.town/reference/std/blob\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\n/** Key prefix to namespace blob keys — blob is account-scoped (shared across all your vals), so prefix is required to avoid collisions. */\nconst PREFIX = \"val-town-quickstart/\";\n\n// ── Read / Write ─────────────────────────────────────────────────────────────\n\n/** Store a JSON-serialisable value under a namespaced key. */\nexport async function saveJSON(key: string, value: unknown): Promise {\n await blob.setJSON(`${PREFIX}${key}`, value);\n}\n\n/** Retrieve a previously stored JSON value, or null if the key doesn't exist. */\nexport async function loadJSON(key: string): Promise {\n const data = await blob.getJSON(`${PREFIX}${key}`);\n return data !== undefined ? (data as T) : null;\n}\n\n// ── List / Delete ────────────────────────────────────────────────────────────\n\n/** List blob keys under our namespace, optionally scoped to a sub-prefix (e.g. a username). */\nexport async function listKeys(subPrefix = \"\"): Promise {\n const keys = await blob.list(`${PREFIX}${subPrefix}`);\n return keys.map((k: { key: string }) => k.key.replace(PREFIX, \"\"));\n}\n\n/** Delete a namespaced blob. */\nexport async function remove(key: string): Promise {\n await blob.delete(`${PREFIX}${key}`);\n}\n",[18,78],"08a01baa-5c10-4f01-98a9-ea9589afac6c",346,["D",1788140102083],9,"// shared.ts — Constants, types, utils. No external dependencies.\n\n// ── Env ───────────────────────────────────────────────────────────────────────\n// Deno.env.set() is a no-op on Val Town — set vars in the UI sidebar only.\n\nexport function env(key: string, fallback = \"\"): string {\n return Deno.env.get(key) ?? fallback;\n}\n\n// ── Constants ─────────────────────────────────────────────────────────────────\n\nexport const APP_NAME = env(\"APP_NAME\", \"Val Town Quickstart\");\n// Powers \"view source\"/Fork links — Val Town's code browser and the inbound\n// email address both need the owner's username, which the platform has no\n// runtime API for, so it's a plain optional env var.\nexport const VAL_TOWN_USERNAME = env(\"VAL_TOWN_USERNAME\");\n// All demo data (Reminders, the Email inbox) is public and wiped on this\n// rolling window — see backend/db.ts's pruneOld* functions and cron.ts.\nexport const DEMO_DATA_RETENTION_HOURS = 24;\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n// Matches the platform's inbound Email trigger interface.\n\nexport interface Email {\n from: string;\n to: string[];\n cc?: string | string[];\n bcc?: string | string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\n// ── Pure formatting helpers ───────────────────────────────────────────────────\n\n/** Val Town email-trigger addresses are `.@valtown.email`, lowercase, hyphenated. */\nexport function emailSlug(name: string): string {\n return name.toLowerCase().replace(/[^a-z0-9]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n}\n\n/** This App's inbound demo address, or null when VAL_TOWN_USERNAME isn't set (see README). */\nexport function inboundEmailAddress(): string | null {\n if (!VAL_TOWN_USERNAME) return null;\n return `${VAL_TOWN_USERNAME}.${emailSlug(APP_NAME)}@valtown.email`;\n}\n\n/** Redact an email address for public display: `jo***@example.com`. */\nexport function maskEmail(address: string): string {\n const [local, domain] = address.split(\"@\");\n if (!domain) return \"***\";\n const visible = local.slice(0, 2);\n return `${visible}${\"*\".repeat(Math.max(local.length - visible.length, 3))}@${domain}`;\n}\n",[18,94],"79a7c1ac-adb4-4a22-b1a2-6f18265cb2de","handlers.ts","080cdc9e-5023-11f1-915b-ee650bb23af1",340,["D",1788140102348],2,"// handlers.ts — API route handler implementations.\n// Each handler receives a RouteCxt and returns a Response.\n\nimport {\n createReminder,\n deleteReminder,\n getCronRuns,\n getRecentVisits,\n getVisitCount,\n listRecentEmails,\n listReminders,\n listUsers,\n pruneOldVisits,\n setReminderDone,\n setUserAdmin,\n} from \"./db.ts\";\nimport { jsonError, jsonOk, type RouteCxt } from \"./api-utils.ts\";\nimport { APP_NAME } from \"./shared.ts\";\nimport { listKeys, loadJSON, saveJSON } from \"./storage.ts\";\n\n// ── Core ──────────────────────────────────────────────────────────────────────\n\nexport function healthCheck(): Response {\n return jsonOk({\n name: APP_NAME,\n timestamp: new Date().toISOString(),\n runtime: `Deno ${Deno.version?.deno ?? \"unknown\"}`,\n });\n}\n\nexport function me(cxt: RouteCxt): Response {\n return jsonOk({\n user: cxt.uc.user,\n isAdmin: cxt.uc.isAdmin,\n isSuperAdmin: cxt.uc.isSuperAdmin,\n });\n}\n\n// ── SQLite demos ──────────────────────────────────────────────────────────────\n\nexport async function visits(): Promise {\n try {\n const total = await getVisitCount();\n const recent = await getRecentVisits(20);\n return jsonOk({ total, recent });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\nexport async function pruneVisits(): Promise {\n try {\n await pruneOldVisits(30);\n return jsonOk({ pruned: \"visits older than 30 days\" });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\nexport async function cronRuns(): Promise {\n try {\n const runs = await getCronRuns(30);\n return jsonOk({ runs });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\n// ── Reminders — the flagship shared \"tiny app\" demo ───────────────────────────\n// Public read; sign-in required to write (see index.http.ts's route table).\n\nexport async function remindersList(): Promise {\n try {\n const reminders = await listReminders();\n return jsonOk({ reminders });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\nexport async function remindersCreate(cxt: RouteCxt): Promise {\n try {\n const body = await cxt.req.json() as { title?: string; note?: string; dueDate?: string };\n const title = (body.title ?? \"\").trim();\n if (!title) return jsonError(\"title required\");\n await createReminder(\n title,\n body.note?.trim() || null,\n body.dueDate?.trim() || null,\n cxt.uc.user!.username,\n );\n return jsonOk({ reminders: await listReminders() });\n } catch {\n return jsonError(\"Failed to create reminder\", 500);\n }\n}\n\nexport async function remindersSetDone(cxt: RouteCxt): Promise {\n try {\n const body = await cxt.req.json() as { id?: number; done?: boolean };\n if (typeof body.id !== \"number\") return jsonError(\"id required\");\n if (typeof body.done !== \"boolean\") return jsonError(\"done must be boolean\");\n const updated = await setReminderDone(body.id, body.done);\n if (!updated) return jsonError(\"Reminder not found\", 404);\n return jsonOk({ reminders: await listReminders() });\n } catch {\n return jsonError(\"Failed to update reminder\", 500);\n }\n}\n\nexport async function remindersDelete(cxt: RouteCxt): Promise {\n try {\n const body = await cxt.req.json() as { id?: number };\n if (typeof body.id !== \"number\") return jsonError(\"id required\");\n const deleted = await deleteReminder(body.id);\n if (!deleted) return jsonError(\"Reminder not found\", 404);\n return jsonOk({ reminders: await listReminders() });\n } catch {\n return jsonError(\"Failed to delete reminder\", 500);\n }\n}\n\n// ── Inbound email inbox — the AI spam/summary triage demo ─────────────────────\n// Public read-only; written by email.ts's inbound handler.\n\nexport async function emailsList(): Promise {\n try {\n const emails = await listRecentEmails();\n return jsonOk({ emails });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\n// ── Blob demos ────────────────────────────────────────────────────────────────\n// Any signed-in user may read/write — keys are namespaced per-user so\n// concurrent demo visitors don't collide.\n\nfunction blobKeyPrefix(cxt: RouteCxt): string {\n return `${cxt.uc.user!.username}/`;\n}\n\nexport function blobKeys(cxt: RouteCxt): Response | Promise {\n return listKeys(blobKeyPrefix(cxt))\n .then((keys) => jsonOk({ keys }))\n .catch(() => jsonError(\"Blob unavailable (off-platform?)\", 503));\n}\n\nexport async function blobWrite(cxt: RouteCxt): Promise {\n try {\n const { key, value } = await cxt.req.json() as { key: string; value: unknown };\n if (!key) return jsonError(\"key required\");\n await saveJSON(`${blobKeyPrefix(cxt)}${key}`, value);\n return jsonOk({ key });\n } catch {\n return jsonError(\"Blob write failed\", 500);\n }\n}\n\nexport async function blobRead(cxt: RouteCxt): Promise {\n try {\n const key = cxt.url.searchParams.get(\"key\") ?? \"\";\n if (!key) return jsonError(\"key required\");\n const value = await loadJSON(`${blobKeyPrefix(cxt)}${key}`);\n return jsonOk({ key, value });\n } catch {\n return jsonError(\"Blob read failed\", 500);\n }\n}\n\n// ── Admin (super-admin only) ──────────────────────────────────────────────────\n\nexport async function adminListUsers(): Promise {\n try {\n const users = await listUsers();\n return jsonOk({ users });\n } catch {\n return jsonError(\"SQLite unavailable (off-platform?)\", 503);\n }\n}\n\nexport async function adminSetAdmin(cxt: RouteCxt): Promise {\n try {\n const body = await cxt.req.json() as { username: string; isAdmin: boolean };\n const username = (body.username ?? \"\").trim();\n if (!username) return jsonError(\"username required\");\n if (typeof body.isAdmin !== \"boolean\") return jsonError(\"isAdmin must be boolean\");\n const updated = await setUserAdmin(username, body.isAdmin);\n if (!updated) return jsonError(\"User not found\", 404);\n return jsonOk({ username, isAdmin: body.isAdmin });\n } catch {\n return jsonError(\"Failed to update admin status\", 500);\n }\n}\n",[18,306],"13e917a6-48a2-4036-8e6e-cc9fdd7d8442",341,["D",1788140102565],17,"// db.ts — SQLite helpers for this App's isolated database.\n// Each val (App) gets its own SQLite — no shared namespace with other vals.\n// Docs: https://docs.val.town/reference/std/sqlite/\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { DEMO_DATA_RETENTION_HOURS } from \"./shared.ts\";\n\n// ── Schema Migration ──────────────────────────────────────────────────────────\n// Lazily run on first DB call, not at import time. This prevents crashes\n// when running locally (off Val Town) where the SQLite API isn't available.\n\nlet migration: Promise | null = null;\n\n/** Share one migration across concurrent calls and reset it after failure. */\nasync function migrate(): Promise {\n migration ??= runMigration();\n await migration;\n}\n\nasync function runMigration(): Promise {\n return await sqlite.batch([\n `CREATE TABLE IF NOT EXISTS visits (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n path TEXT NOT NULL,\n ts TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS cron_runs (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n task TEXT NOT NULL,\n note TEXT,\n ts TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS users (\n username TEXT PRIMARY KEY,\n email TEXT,\n first_login TEXT NOT NULL DEFAULT (datetime('now')),\n last_login TEXT NOT NULL DEFAULT (datetime('now')),\n is_admin INTEGER NOT NULL DEFAULT 0\n )`,\n `CREATE TABLE IF NOT EXISTS reminders (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n title TEXT NOT NULL,\n note TEXT,\n due_date TEXT,\n done INTEGER NOT NULL DEFAULT 0,\n created_by TEXT NOT NULL,\n created_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n `CREATE TABLE IF NOT EXISTS inbound_emails (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n from_addr TEXT NOT NULL,\n subject TEXT,\n is_spam INTEGER NOT NULL DEFAULT 0,\n summary TEXT,\n received_at TEXT NOT NULL DEFAULT (datetime('now'))\n )`,\n ]).then(() => undefined).catch((error) => {\n migration = null;\n throw error;\n });\n}\n\n// ── Visits ────────────────────────────────────────────────────────────────────\n\n/** Record a page visit. */\nexport async function recordVisit(path: string): Promise {\n await migrate();\n await sqlite.execute({\n sql: `INSERT INTO visits (path) VALUES (?)`,\n args: [path],\n });\n}\n\n/** Get total visit count. */\nexport async function getVisitCount(): Promise {\n await migrate();\n const { rows } = await sqlite.execute(\n `SELECT COUNT(*) as count FROM visits`,\n );\n // Row supports [key: number] indexing — no cast required.\n return Number(rows[0][0]);\n}\n\n/** Get the N most recent visits. */\nexport async function getRecentVisits(\n limit = 20,\n): Promise> {\n await migrate();\n const { rows } = await sqlite.execute({\n sql: `SELECT id, path, ts FROM visits ORDER BY ts DESC LIMIT ?`,\n args: [limit],\n });\n // Row is ArrayLike with [key: number]: Value — index directly, no cast.\n return rows.map((r) => ({\n id: Number(r[0]),\n path: String(r[1]),\n ts: String(r[2]),\n }));\n}\n\n/** Delete visits older than `days` days. Idempotent — safe to call repeatedly. */\nexport async function pruneOldVisits(days = 30): Promise {\n await migrate();\n const interval = `-${Math.floor(Math.abs(days))} days`;\n await sqlite.execute({\n sql: `DELETE FROM visits WHERE ts < datetime('now', ?)`,\n args: [interval],\n });\n}\n\n// ── Cron runs ─────────────────────────────────────────────────────────────────\n\n/** Append a cron run log entry. Called by cron.ts tasks. */\nexport async function logCronRun(task: string, note?: string): Promise {\n await migrate();\n await sqlite.execute({\n sql: `INSERT INTO cron_runs (task, note) VALUES (?, ?)`,\n args: [task, note ?? null],\n });\n}\n\n/** Get the N most recent cron run entries across all tasks. */\nexport async function getCronRuns(\n limit = 30,\n): Promise<\n Array<{ id: number; task: string; note: string | null; ts: string }>\n> {\n await migrate();\n const { rows } = await sqlite.execute({\n sql: `SELECT id, task, note, ts FROM cron_runs ORDER BY ts DESC LIMIT ?`,\n args: [limit],\n });\n // Row is ArrayLike with [key: number]: Value — index directly, no cast.\n return rows.map((r) => ({\n id: Number(r[0]),\n task: String(r[1]),\n note: r[2] != null ? String(r[2]) : null,\n ts: String(r[3]),\n }));\n}\n\n// ── Users ─────────────────────────────────────────────────────────────────────\n\nexport interface UserRow {\n username: string;\n email: string | null;\n first_login: string;\n last_login: string;\n is_admin: boolean;\n}\n\n/** Upsert user on login — sets first_login on create, updates last_login always. */\nexport async function upsertUser(\n username: string,\n email?: string | null,\n): Promise {\n await migrate();\n await sqlite.execute({\n sql: `INSERT INTO users (username, email)\n VALUES (?, ?)\n ON CONFLICT(username) DO UPDATE SET\n last_login = datetime('now'),\n email = COALESCE(excluded.email, users.email)`,\n args: [username, email ?? null],\n });\n}\n\n/** Get a single user by username. */\nexport async function getUser(username: string): Promise {\n await migrate();\n const { rows } = await sqlite.execute({\n sql: `SELECT username, email, first_login, last_login, is_admin FROM users WHERE username = ?`,\n args: [username],\n });\n if (!rows.length) return null;\n return rowToUser(rows[0]);\n}\n\n/** List all registered users (most recent login first). */\nexport async function listUsers(): Promise {\n await migrate();\n const { rows } = await sqlite.execute(\n `SELECT username, email, first_login, last_login, is_admin FROM users ORDER BY last_login DESC`,\n );\n return rows.map(rowToUser);\n}\n\n/** Set is_admin flag for a user. Only super-admins should call this. */\nexport async function setUserAdmin(\n username: string,\n isAdmin: boolean,\n): Promise {\n await migrate();\n const { rowsAffected } = await sqlite.execute({\n sql: `UPDATE users SET is_admin = ? WHERE username = ?`,\n args: [isAdmin ? 1 : 0, username],\n });\n return rowsAffected > 0;\n}\n\nfunction rowToUser(r: ArrayLike): UserRow {\n return {\n username: String(r[0]),\n email: r[1] != null ? String(r[1]) : null,\n first_login: String(r[2]),\n last_login: String(r[3]),\n is_admin: Number(r[4]) === 1,\n };\n}\n\n// ── Reminders — the flagship shared \"tiny app\" demo ───────────────────────────\n// Public read, sign-in-required write (see backend/auth.ts's getAuthedUc).\n// Demo data — filtered at read time AND physically pruned by cron.ts's pulse\n// so the \"wiped every 24 hours\" promise holds even between cron ticks.\n\nexport interface Reminder {\n id: number;\n title: string;\n note: string | null;\n dueDate: string | null;\n done: boolean;\n createdBy: string;\n createdAt: string;\n}\n\nexport async function createReminder(\n title: string,\n note: string | null,\n dueDate: string | null,\n createdBy: string,\n): Promise {\n await migrate();\n await sqlite.execute({\n sql: `INSERT INTO reminders (title, note, due_date, created_by) VALUES (?, ?, ?, ?)`,\n args: [title, note, dueDate, createdBy],\n });\n}\n\n/** List reminders created within the retention window — oldest expired rows never surface. */\nexport async function listReminders(\n hours = DEMO_DATA_RETENTION_HOURS,\n): Promise {\n await migrate();\n const { rows } = await sqlite.execute({\n sql: `SELECT id, title, note, due_date, done, created_by, created_at\n FROM reminders\n WHERE created_at > datetime('now', ?)\n ORDER BY done ASC, (due_date IS NULL), due_date ASC, created_at DESC`,\n args: [`-${hours} hours`],\n });\n return rows.map(rowToReminder);\n}\n\nexport async function setReminderDone(id: number, done: boolean): Promise {\n await migrate();\n const { rowsAffected } = await sqlite.execute({\n sql: `UPDATE reminders SET done = ? WHERE id = ?`,\n args: [done ? 1 : 0, id],\n });\n return rowsAffected > 0;\n}\n\nexport async function deleteReminder(id: number): Promise {\n await migrate();\n const { rowsAffected } = await sqlite.execute({\n sql: `DELETE FROM reminders WHERE id = ?`,\n args: [id],\n });\n return rowsAffected > 0;\n}\n\n/** Physically delete reminders past the retention window. Idempotent. */\nexport async function pruneOldReminders(hours = DEMO_DATA_RETENTION_HOURS): Promise {\n await migrate();\n await sqlite.execute({\n sql: `DELETE FROM reminders WHERE created_at < datetime('now', ?)`,\n args: [`-${hours} hours`],\n });\n}\n\nfunction rowToReminder(r: ArrayLike): Reminder {\n return {\n id: Number(r[0]),\n title: String(r[1]),\n note: r[2] != null ? String(r[2]) : null,\n dueDate: r[3] != null ? String(r[3]) : null,\n done: Number(r[4]) === 1,\n createdBy: String(r[5]),\n createdAt: String(r[6]),\n };\n}\n\n// ── Inbound emails — the AI spam/summary triage demo ──────────────────────────\n// Public read-only. Written by email.ts's inbound handler. Same 24h demo-data\n// retention as Reminders.\n\nexport interface InboundEmail {\n id: number;\n from: string;\n subject: string;\n isSpam: boolean;\n summary: string | null;\n receivedAt: string;\n}\n\nexport async function recordInboundEmail(\n from: string,\n subject: string,\n isSpam: boolean,\n summary: string | null,\n): Promise {\n await migrate();\n await sqlite.execute({\n sql: `INSERT INTO inbound_emails (from_addr, subject, is_spam, summary) VALUES (?, ?, ?, ?)`,\n args: [from, subject, isSpam ? 1 : 0, summary],\n });\n}\n\nexport async function listRecentEmails(\n hours = DEMO_DATA_RETENTION_HOURS,\n limit = 20,\n): Promise {\n await migrate();\n const { rows } = await sqlite.execute({\n sql: `SELECT id, from_addr, subject, is_spam, summary, received_at\n FROM inbound_emails\n WHERE received_at > datetime('now', ?)\n ORDER BY received_at DESC\n LIMIT ?`,\n args: [`-${hours} hours`, limit],\n });\n return rows.map(rowToInboundEmail);\n}\n\n/** Physically delete inbound emails past the retention window. Idempotent. */\nexport async function pruneOldEmails(hours = DEMO_DATA_RETENTION_HOURS): Promise {\n await migrate();\n await sqlite.execute({\n sql: `DELETE FROM inbound_emails WHERE received_at < datetime('now', ?)`,\n args: [`-${hours} hours`],\n });\n}\n\nfunction rowToInboundEmail(r: ArrayLike): InboundEmail {\n return {\n id: Number(r[0]),\n from: String(r[1]),\n subject: String(r[2]),\n isSpam: Number(r[3]) === 1,\n summary: r[4] != null ? String(r[4]) : null,\n receivedAt: String(r[5]),\n };\n}\n",[18,103],"53172d31-689a-47ce-8184-66b134f9728c","auth.ts","e9910464-4f02-11f1-a74a-ee650bb23af1",342,["D",1788140102664],3,"// auth.ts — Val Town OAuth user context helpers.\n// Docs: https://docs.val.town/guides/auth/#sign-in-with-val-town\n\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { getUser, upsertUser } from \"./db.ts\";\nimport { env } from \"./shared.ts\";\n\n// -----------------------------------------------------------------------------\n// types\n// -----------------------------------------------------------------------------\n\nexport interface UserProfile {\n username: string;\n id?: string;\n name?: string;\n email?: string;\n avatarUrl?: string;\n}\n\nexport interface UserCxt {\n user: UserProfile | null;\n isAuthed: boolean;\n isAdmin: boolean;\n isSuperAdmin: boolean;\n}\n\nexport class AuthError extends Error {\n constructor(message: string, readonly status: number) {\n super(message);\n this.name = \"AuthError\";\n }\n}\n\n// -----------------------------------------------------------------------------\n// middleware\n// -----------------------------------------------------------------------------\n\nexport function withValTownAuth(\n handler: (req: Request) => Response | Promise,\n): (req: Request) => Promise {\n return oauthMiddleware(handler) as (req: Request) => Promise;\n}\n\n// -----------------------------------------------------------------------------\n// user context\n// -----------------------------------------------------------------------------\n\n/** Resolve user context. Tracks login in DB when user is authenticated. */\nexport async function getUc(\n req: Request,\n trackLogin = false,\n): Promise {\n const session = await getOAuthUserData(req);\n const user = normalizeUser(session?.user);\n\n if (!user) return { user: null, isAuthed: false, isAdmin: false, isSuperAdmin: false };\n\n const isSuperAdmin = superAdmins().has(norm(user.username));\n\n // Track login in DB (best-effort — don't break request on SQLite failure)\n let isDbAdmin = false;\n try {\n if (trackLogin) await upsertUser(user.username, user.email);\n const dbUser = await getUser(user.username);\n isDbAdmin = dbUser?.is_admin ?? false;\n } catch { /* off-platform or DB unavailable */ }\n\n return { user, isAuthed: true, isAdmin: isDbAdmin || isSuperAdmin, isSuperAdmin };\n}\n\n/** Like getUc but always tracks login. Used for page loads. */\nexport async function getUcWithTracking(req: Request): Promise {\n return getUc(req, true);\n}\n\n/** Require an authenticated user — any signed-in Val Town account, no admin role needed. */\nexport async function getAuthedUc(req: Request): Promise {\n const uc = await getUc(req, false);\n if (!uc.user) throw new AuthError(\"Sign in with Val Town\", 401);\n return uc;\n}\n\n/** Require authenticated admin (DB admin or super-admin). */\nexport async function getAdminUc(req: Request): Promise {\n const uc = await getUc(req, false);\n if (!uc.user) throw new AuthError(\"Sign in with Val Town\", 401);\n if (!uc.isAdmin) throw new AuthError(\"Admin access required\", 403);\n return uc;\n}\n\n/** Require super-admin (env var only). */\nexport async function getSuperAdminUc(req: Request): Promise {\n const uc = await getUc(req, false);\n if (!uc.user) throw new AuthError(\"Sign in with Val Town\", 401);\n if (!uc.isSuperAdmin) throw new AuthError(\"Super-admin access required\", 403);\n return uc;\n}\n\nexport function isAuthError(error: unknown): error is AuthError {\n return error instanceof AuthError;\n}\n\n// -----------------------------------------------------------------------------\n// helpers\n// -----------------------------------------------------------------------------\n\nfunction superAdmins(): Set {\n return new Set(\n env(\"AUTH_SUPER_ADMINS\")\n .split(\",\")\n .map((user) => norm(user))\n .filter(Boolean),\n );\n}\n\nfunction normalizeUser(raw: unknown): UserProfile | null {\n if (!isRecord(raw)) return null;\n\n const username = str(raw.username) ?? str(raw.handle);\n if (!username) return null;\n\n return {\n username,\n id: str(raw.id),\n name: str(raw.name),\n email: str(raw.email),\n avatarUrl: str(raw.avatarUrl) ?? str(raw.avatar_url),\n };\n}\n\nfunction isRecord(value: unknown): value is Record {\n return typeof value === \"object\" && value !== null;\n}\n\nfunction str(value: unknown): string | undefined {\n if (typeof value === \"string\" && value.length > 0) return value;\n if (typeof value === \"number\") return String(value);\n return undefined;\n}\n\nfunction norm(value: string): string {\n return value.trim().toLowerCase();\n}\n",[18,320],"bce3c782-5d13-48f7-99ea-2e2607b7c5ea","api-utils.ts","491d0f08-4b21-11f1-8ab3-ee650bb23af1",304,["D",1788122839107],"// api-utils.ts — JSON response helpers + route type primitives.\n\nimport type { UserCxt } from \"./auth.ts\";\n\n// ── Response helpers ──────────────────────────────────────────────────────────\n\nexport type JsonObject = Record;\n\nexport function jsonError(message: string, status = 400): Response {\n return Response.json({ ok: false, error: message }, { status });\n}\n\nexport function jsonOk(data: JsonObject = {}): Response {\n return Response.json({ ok: true, ...data });\n}\n\n// ── Route types ───────────────────────────────────────────────────────────────\n\nexport interface RouteCxt {\n req: Request;\n url: URL;\n uc: UserCxt;\n}\n\nexport type ApiHandler = (cxt: RouteCxt) => Response | Promise;\nexport type UcResolver = (req: Request) => Promise;\n\nexport interface ApiRoute {\n resolveUc: UcResolver;\n handle: ApiHandler;\n}\n\n/** Convenience: pair a resolver + handler into an ApiRoute. */\nexport function route(resolveUc: UcResolver, handle: ApiHandler): ApiRoute {\n return { resolveUc, handle };\n}\n",[18,328],"6c2861a3-691f-4ea3-874c-cf9a2ef140c0","ai.ts","2e78081e-a4dc-11f1-8716-1607ee4eb77e",327,["D",1788140100442],"// ai.ts — Email spam/summary triage using Val Town's free-tier OpenAI proxy.\n// No API key needed, no signup: https://docs.val.town/reference/std/openai/\n\nimport { ValTownOpenAI } from \"https://esm.town/v/std/openai/main.ts\";\n\nexport interface EmailTriage {\n isSpam: boolean;\n summary: string | null;\n}\n\n// Free-tier model — see docs.val.town/reference/std/openai (no key required).\nconst MODEL = \"gpt-5.4-nano\";\n\nconst TRIAGE_SCHEMA = {\n type: \"json_schema\",\n name: \"email_triage\",\n schema: {\n type: \"object\",\n properties: {\n isSpam: { type: \"boolean\" },\n summary: { type: [\"string\", \"null\"] },\n },\n required: [\"isSpam\", \"summary\"],\n additionalProperties: false,\n },\n} as const;\n\n/** Classify an inbound demo email as spam, and summarise it in one line when it isn't. */\nexport async function triageEmail(subject: string, body: string): Promise {\n const openai = new ValTownOpenAI({});\n const response = await openai.responses.create({\n model: MODEL,\n instructions:\n \"You triage inbound test emails for a public Val Town demo inbox. Classify spam \" +\n \"(marketing blasts, phishing, scams) vs a genuine test message. When it is NOT spam, \" +\n \"write a punchy one-sentence summary (<=140 chars) of what it says. When it IS spam, \" +\n \"summary must be null.\",\n input: `Subject: ${subject || \"(none)\"}\\n\\n${(body || \"(empty)\").slice(0, 4000)}`,\n text: { format: TRIAGE_SCHEMA },\n });\n return parseTriage(response.output_text);\n}\n\n/** Pure JSON parser — isolated so the response contract is unit-testable without a network call. */\nexport function parseTriage(raw: string): EmailTriage {\n try {\n const parsed = JSON.parse(raw);\n const isSpam = Boolean(parsed.isSpam);\n return {\n isSpam,\n summary: !isSpam && typeof parsed.summary === \"string\" ? parsed.summary.slice(0, 200) : null,\n };\n } catch {\n return { isSpam: false, summary: null };\n }\n}\n",[18,335],"pulls","branches","forks","envVars",{"_348":26,"_350":279},"connections",{"_348":279,"_349":279},"count","unfilledCount","emptyCount",{"_47":277,"_13":18,"_76":199,"_57":-5,"_49":50,"_281":282,"_294":24,"_51":665,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":666,"_17":667},{"_47":334,"_13":335,"_76":336,"_57":199,"_49":50,"_281":337,"_294":24,"_51":662,"_53":279,"_79":80,"_278":339,"_81":30,"_283":-5,"_397":663,"_17":664},{"_47":327,"_13":328,"_76":329,"_57":199,"_49":50,"_281":330,"_294":24,"_51":659,"_53":324,"_79":80,"_278":332,"_81":30,"_283":-5,"_397":660,"_17":661},{"_47":319,"_13":320,"_76":321,"_57":199,"_49":50,"_281":322,"_294":24,"_51":656,"_53":324,"_79":80,"_278":325,"_81":30,"_283":-5,"_397":657,"_17":658},{"_47":313,"_13":103,"_76":102,"_57":199,"_49":50,"_281":314,"_294":24,"_51":653,"_53":316,"_79":80,"_278":317,"_81":30,"_283":-5,"_397":654,"_17":655},{"_47":305,"_13":306,"_76":307,"_57":199,"_49":50,"_281":308,"_294":24,"_51":650,"_53":310,"_79":80,"_278":311,"_81":30,"_283":-5,"_397":651,"_17":652},{"_47":299,"_13":94,"_76":93,"_57":199,"_49":50,"_281":300,"_294":24,"_51":647,"_53":302,"_79":80,"_278":303,"_81":30,"_283":-5,"_397":648,"_17":649},{"_47":292,"_13":78,"_76":77,"_57":199,"_49":50,"_281":293,"_294":24,"_51":644,"_53":296,"_79":80,"_278":297,"_81":30,"_283":-5,"_397":645,"_17":646},{"_47":639,"_13":476,"_76":470,"_57":-5,"_49":50,"_281":640,"_294":24,"_51":641,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":642,"_17":643},{"_47":634,"_13":617,"_76":611,"_57":470,"_49":50,"_281":635,"_294":24,"_51":636,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":637,"_17":638},{"_47":626,"_13":627,"_76":628,"_57":611,"_49":50,"_281":629,"_294":24,"_51":630,"_53":500,"_79":80,"_278":631,"_81":30,"_283":-5,"_397":632,"_17":633},{"_47":618,"_13":619,"_76":620,"_57":611,"_49":50,"_281":621,"_294":24,"_51":622,"_53":594,"_79":80,"_278":623,"_81":30,"_283":-5,"_397":624,"_17":625},{"_47":608,"_13":609,"_76":610,"_57":611,"_49":50,"_281":612,"_294":24,"_51":613,"_53":279,"_79":80,"_278":614,"_81":30,"_283":-5,"_397":615,"_17":616},{"_47":603,"_13":504,"_76":497,"_57":470,"_49":50,"_281":604,"_294":24,"_51":605,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":606,"_17":607},{"_47":598,"_13":572,"_76":565,"_57":497,"_49":50,"_281":599,"_294":24,"_51":600,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":601,"_17":602},{"_47":589,"_13":590,"_76":591,"_57":565,"_49":50,"_281":592,"_294":24,"_51":593,"_53":594,"_79":80,"_278":595,"_81":30,"_283":-5,"_397":596,"_17":597},{"_47":581,"_13":582,"_76":583,"_57":565,"_49":50,"_281":584,"_294":24,"_51":585,"_53":519,"_79":80,"_278":586,"_81":30,"_283":-5,"_397":587,"_17":588},{"_47":573,"_13":574,"_76":575,"_57":565,"_49":50,"_281":576,"_294":24,"_51":577,"_53":568,"_79":80,"_278":578,"_81":30,"_283":-5,"_397":579,"_17":580},{"_47":562,"_13":563,"_76":564,"_57":565,"_49":50,"_281":566,"_294":24,"_51":567,"_53":568,"_79":80,"_278":569,"_81":30,"_283":-5,"_397":570,"_17":571},{"_47":557,"_13":523,"_76":516,"_57":497,"_49":50,"_281":558,"_294":24,"_51":559,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":560,"_17":561},{"_47":549,"_13":550,"_76":551,"_57":516,"_49":50,"_281":552,"_294":24,"_51":553,"_53":310,"_79":80,"_278":554,"_81":30,"_283":-5,"_397":555,"_17":556},{"_47":540,"_13":541,"_76":542,"_57":516,"_49":50,"_281":543,"_294":24,"_51":544,"_53":545,"_79":80,"_278":546,"_81":30,"_283":-5,"_397":547,"_17":548},{"_47":532,"_13":533,"_76":534,"_57":516,"_49":50,"_281":535,"_294":24,"_51":536,"_53":296,"_79":80,"_278":537,"_81":30,"_283":-5,"_397":538,"_17":539},{"_47":524,"_13":525,"_76":526,"_57":516,"_49":50,"_281":527,"_294":24,"_51":528,"_53":310,"_79":80,"_278":529,"_81":30,"_283":-5,"_397":530,"_17":531},{"_47":513,"_13":514,"_76":515,"_57":516,"_49":50,"_281":517,"_294":24,"_51":518,"_53":519,"_79":80,"_278":520,"_81":30,"_283":-5,"_397":521,"_17":522},{"_47":505,"_13":506,"_76":507,"_57":497,"_49":50,"_281":241,"_294":24,"_51":508,"_53":509,"_79":80,"_278":510,"_81":30,"_283":-5,"_397":511,"_17":512},{"_47":494,"_13":495,"_76":496,"_57":497,"_49":50,"_281":498,"_294":24,"_51":499,"_53":500,"_79":80,"_278":501,"_81":30,"_283":-5,"_397":502,"_17":503},{"_47":485,"_13":486,"_76":487,"_57":470,"_49":50,"_281":488,"_294":24,"_51":489,"_53":490,"_79":80,"_278":491,"_81":30,"_283":-5,"_397":492,"_17":493},{"_47":477,"_13":478,"_76":479,"_57":470,"_49":50,"_281":480,"_294":24,"_51":481,"_53":440,"_79":80,"_278":482,"_81":30,"_283":-5,"_397":483,"_17":484},{"_47":467,"_13":468,"_76":469,"_57":470,"_49":50,"_281":471,"_294":24,"_51":472,"_53":26,"_79":80,"_278":473,"_81":30,"_283":-5,"_397":474,"_17":475},{"_47":462,"_13":453,"_76":447,"_57":-5,"_49":50,"_281":463,"_294":24,"_51":464,"_53":279,"_79":200,"_278":-5,"_81":30,"_283":-5,"_397":465,"_17":466},{"_47":454,"_13":455,"_76":456,"_57":447,"_49":50,"_281":457,"_294":24,"_51":458,"_53":279,"_79":80,"_278":459,"_81":30,"_283":-5,"_397":460,"_17":461},{"_47":444,"_13":445,"_76":446,"_57":447,"_49":50,"_281":448,"_294":24,"_51":449,"_53":279,"_79":80,"_278":450,"_81":30,"_283":-5,"_397":451,"_17":452},{"_47":435,"_13":436,"_76":437,"_57":-5,"_49":50,"_281":438,"_294":24,"_51":439,"_53":440,"_79":21,"_278":441,"_81":30,"_283":-5,"_397":442,"_17":443},{"_47":426,"_13":427,"_76":428,"_57":-5,"_49":50,"_281":429,"_294":24,"_51":430,"_53":395,"_79":431,"_278":432,"_81":30,"_283":-5,"_397":433,"_17":434},{"_47":418,"_13":419,"_76":420,"_57":-5,"_49":50,"_281":421,"_294":24,"_51":422,"_53":324,"_79":21,"_278":423,"_81":30,"_283":-5,"_397":424,"_17":425},{"_47":409,"_13":410,"_76":411,"_57":-5,"_49":50,"_281":412,"_294":24,"_51":413,"_53":296,"_79":414,"_278":415,"_81":30,"_283":-5,"_397":416,"_17":417},{"_47":400,"_13":401,"_76":214,"_57":-5,"_49":50,"_281":402,"_294":24,"_51":403,"_53":404,"_79":167,"_278":405,"_81":30,"_283":406,"_397":407,"_17":408},{"_47":390,"_13":391,"_76":392,"_57":-5,"_49":50,"_281":393,"_294":24,"_51":394,"_53":395,"_79":21,"_278":396,"_81":30,"_283":-5,"_397":398,"_17":399},"490a09b0-2a98-4fc5-a448-02058c3a5820","val.yml","aa729402-48c5-11f1-87ca-42b51c65c3df",337,["D",1788140101761],10,"name: \"Val-Town-Quickstart\"\npublic: true\n# Each file here is a service. Services share one isolated SQLite DB.\n# index.http.ts → HTTP service (SPA + API routes)\n# cron.ts → Cron service (scheduled tasks)\n# email.ts → Email service (inbound trigger + outbound helpers)\nfiles:\n index.http.ts: http\n cron.ts: interval\n email.ts: email\n# Env vars this App reads. Set them in the Val Town UI sidebar — never in code.\n# required: App will not work without it | optional: has a safe default\nenv:\n APP_NAME: optional # display/logging name (vtx new sets the code fallback)\n VAL_TOWN_USERNAME: optional # your Val Town username — powers \"view source\"/Fork links (see README)\n DAILY_HOUR_UTC: optional # 0-23 UTC hour for the daily cron task (default: \"2\")\n AUTH_SUPER_ADMINS: optional # comma-separated Val Town usernames — these users are super-admins\n","children",[],[391],"bb0a8ae5-55f3-45b9-86b6-c6e1c53666b6","index.http.ts",367,["D",1788210559007],19,"// index.http.ts — HTTP entry point: per-route SSR page serving + API route\n// table. Handlers live in backend/handlers.ts; this file is pure wiring.\n// Docs: https://docs.val.town/vals/http\n\nimport { recordVisit } from \"./backend/db.ts\";\nimport { type ApiRoute, jsonError, route } from \"./backend/api-utils.ts\";\nimport {\n getAdminUc,\n getAuthedUc,\n getSuperAdminUc,\n getUc,\n getUcWithTracking,\n isAuthError,\n type UserCxt,\n withValTownAuth,\n} from \"./backend/auth.ts\";\nimport {\n adminListUsers,\n adminSetAdmin,\n blobKeys,\n blobRead,\n blobWrite,\n cronRuns,\n emailsList,\n healthCheck,\n me,\n pruneVisits,\n remindersCreate,\n remindersDelete,\n remindersList,\n remindersSetDone,\n visits,\n} from \"./backend/handlers.ts\";\nimport { APP_NAME, VAL_TOWN_USERNAME } from \"./backend/shared.ts\";\nimport { renderApp } from \"./frontend/app.tsx\";\nimport type { ThemeMode, UserInfo } from \"./frontend/types.ts\";\n\n// Valid page slugs — anything else falls back to \"home\".\n// Keep in sync with PAGES in frontend/app.tsx.\nconst PAGES = new Set([\n \"home\",\n \"reminders\",\n \"docs\",\n \"http\",\n \"sqlite\",\n \"cron\",\n \"email\",\n \"blob\",\n \"admin\",\n \"ui\",\n]);\nconst MODES = new Set([\"light\", \"dark\", \"system\"]);\nconst THEME_COOKIE = \"theme\";\n\n// -----------------------------------------------------------------------------\n// entry\n// -----------------------------------------------------------------------------\n\nasync function handler(req: Request): Promise {\n const url = new URL(req.url);\n if (url.pathname.startsWith(\"/api/\")) return await routeApi(req, url);\n if (url.pathname === \"/theme\") return setThemeAndRedirect(url);\n return await servePage(req, url);\n}\n\nexport default withValTownAuth(handler);\n\n// -----------------------------------------------------------------------------\n// page rendering\n// -----------------------------------------------------------------------------\n\nasync function servePage(req: Request, url: URL): Promise {\n try {\n await recordVisit(url.pathname);\n } catch { /* off-platform */ }\n\n const uc = await getUcWithTracking(req);\n const html = renderApp({\n appName: APP_NAME,\n renderedAt: new Date().toISOString(),\n mode: cookieMode(req),\n page: pathToPage(url.pathname),\n user: ucToUserInfo(uc),\n valTownUsername: VAL_TOWN_USERNAME,\n });\n return new Response(html, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\n/** GET /theme?mode=light|dark|system&page= — sets the mode cookie, redirects back. */\nfunction setThemeAndRedirect(url: URL): Response {\n const mode = url.searchParams.get(\"mode\");\n const page = pathToPage(`/${url.searchParams.get(\"page\") ?? \"\"}`);\n const headers = new Headers({ location: page === \"home\" ? \"/\" : `/${page}` });\n if (mode && (MODES as Set).has(mode)) {\n headers.append(\"set-cookie\", `${THEME_COOKIE}=${mode}; Path=/; Max-Age=31536000; SameSite=Lax`);\n }\n return new Response(null, { status: 303, headers });\n}\n\n/** Map backend UserCxt → frontend UserInfo (layer boundary). */\nfunction ucToUserInfo(uc: UserCxt): UserInfo | null {\n if (!uc.user) return null;\n return {\n username: uc.user.username,\n avatarUrl: uc.user.avatarUrl,\n isAdmin: uc.isAdmin,\n isSuperAdmin: uc.isSuperAdmin,\n };\n}\n\nfunction cookieMode(req: Request): ThemeMode {\n const cookie = req.headers.get(\"Cookie\") ?? \"\";\n const m = cookie.match(new RegExp(`(?:^|;\\\\s*)${THEME_COOKIE}=([^;]+)`));\n const value = m ? decodeURIComponent(m[1]) : \"\";\n return (MODES as Set).has(value) ? (value as ThemeMode) : \"system\";\n}\n\nfunction pathToPage(pathname: string): string {\n const seg = pathname.slice(1);\n return PAGES.has(seg) ? seg : \"home\";\n}\n\n// -----------------------------------------------------------------------------\n// API routing\n// -----------------------------------------------------------------------------\n\nconst API_ROUTES = new Map([\n [\"GET /api/health\", route(getUc, healthCheck)],\n [\"GET /api/me\", route(getUcWithTracking, me)],\n [\"GET /api/visits\", route(getUc, visits)],\n [\"POST /api/prune-visits\", route(getAdminUc, pruneVisits)],\n [\"GET /api/cron-runs\", route(getUc, cronRuns)],\n [\"GET /api/reminders\", route(getUc, remindersList)],\n [\"POST /api/reminders\", route(getAuthedUc, remindersCreate)],\n [\"POST /api/reminders/done\", route(getAuthedUc, remindersSetDone)],\n [\"POST /api/reminders/delete\", route(getAuthedUc, remindersDelete)],\n [\"GET /api/emails\", route(getUc, emailsList)],\n [\"GET /api/blob-keys\", route(getAuthedUc, blobKeys)],\n [\"POST /api/blob-write\", route(getAuthedUc, blobWrite)],\n [\"GET /api/blob-read\", route(getAuthedUc, blobRead)],\n [\"GET /api/admin/users\", route(getSuperAdminUc, adminListUsers)],\n [\"POST /api/admin/set-admin\", route(getSuperAdminUc, adminSetAdmin)],\n]);\n\nasync function routeApi(req: Request, url: URL): Promise {\n const apiRoute = API_ROUTES.get(`${req.method} ${url.pathname}`);\n if (!apiRoute) return jsonError(`Not found: ${url.pathname}`, 404);\n\n try {\n const uc = await apiRoute.resolveUc(req);\n return await apiRoute.handle({ req, url, uc });\n } catch (error) {\n if (isAuthError(error)) return jsonError(error.message, error.status);\n throw error;\n }\n}\n","d-template",[],[401],"6da22813-bc26-432e-8840-2d89796753cd","email.ts","aa7742d6-48c5-11f1-831b-42b51c65c3df",339,["D",1788140102069],"email","// email.ts — Email service: inbound handler + outbound helpers.\n// Address shape: .@valtown.email\n\nimport { email as sendEmail } from \"https://esm.town/v/std/email\";\nimport { APP_NAME, type Email } from \"./backend/shared.ts\";\nimport { triageEmail } from \"./backend/ai.ts\";\nimport { recordInboundEmail } from \"./backend/db.ts\";\n\n// -----------------------------------------------------------------------------\n// inbound\n// -----------------------------------------------------------------------------\n\nexport default async function emailHandler(inbound: Email): Promise {\n console.log(\n `📧 [${APP_NAME}] From: ${inbound.from} Subject: ${inbound.subject ?? \"(none)\"}`,\n );\n console.log(` Body: ${inbound.text?.slice(0, 200) ?? \"(empty)\"}...`);\n\n for (const file of inbound.attachments) {\n console.log(` 📎 ${file.name} (${file.type}, ${file.size}b)`);\n // await blob.set(`emails/${file.name}`, await file.arrayBuffer());\n }\n\n // AI triage feeds the live \"Email Inbox\" demo (frontend/pages/page-mail.tsx) —\n // best-effort: a triage/DB hiccup should never fail the inbound trigger.\n try {\n const subject = inbound.subject ?? \"\";\n const { isSpam, summary } = await triageEmail(subject, inbound.text ?? \"\");\n await recordInboundEmail(inbound.from, subject, isSpam, summary);\n } catch (error) {\n console.error(` ⚠️ triage/record failed: ${error}`);\n }\n\n // await sendNotification(`Re: ${inbound.subject}`, \"Got your message!\");\n}\n\n// -----------------------------------------------------------------------------\n// outbound\n// -----------------------------------------------------------------------------\n// Free plan: sends to yourself only. Pro: send to anyone + cc/bcc.\n\nexport async function sendNotification(\n subject: string,\n body: string,\n options?: { to?: string; html?: string },\n): Promise {\n await sendEmail({\n subject,\n text: body,\n ...(options?.to && { to: options.to }),\n ...(options?.html && { html: options.html }),\n });\n console.log(`📤 [${APP_NAME}] Sent: \"${subject}\"`);\n}\n\n/** `attachment.content` must be base64-encoded (use `btoa()`). */\nexport async function sendWithAttachment(\n subject: string,\n body: string,\n attachment: { content: string; filename: string; type?: string },\n): Promise {\n await sendEmail({\n subject,\n text: body,\n attachments: [{\n content: attachment.content,\n filename: attachment.filename,\n type: attachment.type ?? \"application/octet-stream\",\n disposition: \"attachment\",\n }],\n });\n console.log(\n `📤 [${APP_NAME}] Sent with attachment: \"${attachment.filename}\"`,\n );\n}\n",[],[410],"e9ede3b4-4f02-11f1-8b31-ee650bb23af1","deno.json","86adc21c-4951-11f1-b797-42b51c65c3df",225,["D",1778700935796],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"fmt\": {\n \"lineWidth\": 100\n },\n \"lint\": {\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\",\n \"no-external-import\",\n \"no-import-prefix\"\n ]\n }\n },\n \"node_modules_dir\": false,\n \"unstable\": [\"temporal\", \"worker-options\", \"sloppy-imports\", \"node-globals\"]\n}\n",[],[419],"0a74464d-228b-4071-9a89-a17e86f0c8ff","cron.ts","aa651980-48c5-11f1-bfb8-42b51c65c3df",344,["D",1788140103018],"interval","// cron.ts — Cron service: pulse (every run) + daily (UTC-hour window).\n// Schedule is set in the Val Town UI via a cron expression. Free tier: ≥ 15 min.\n// Tasks are intentionally idempotent. Val Town fires each tick once; concurrent\n// cold-starts are rare but possible on Pro — design tasks to tolerate it.\n\nimport { APP_NAME, DEMO_DATA_RETENTION_HOURS, env } from \"./backend/shared.ts\";\nimport { logCronRun, pruneOldEmails, pruneOldReminders, pruneOldVisits } from \"./backend/db.ts\";\n\nexport default async function (\n interval: { lastRunAt: Date | undefined },\n): Promise {\n const now = new Date();\n await pulse(now);\n await daily(now, interval.lastRunAt);\n}\n\n// ── Pulse — runs on every cron tick ───────────────────────────────────────────\n// Good for health-checks, polling an external feed, draining a work queue.\n// Set the Val Town cron to your desired cadence (UI → val → Cron → expression).\n\nasync function pulse(now: Date): Promise {\n console.log(`⚡ [${APP_NAME}] pulse ${now.toISOString()}`);\n await logCronRun(\"pulse\", `hello at ${now.toISOString()}`);\n // Demo data (Reminders, Email inbox) is wiped on a rolling window — see\n // backend/shared.ts's DEMO_DATA_RETENTION_HOURS and the README's demo notice.\n await pruneOldReminders(DEMO_DATA_RETENTION_HOURS);\n await pruneOldEmails(DEMO_DATA_RETENTION_HOURS);\n // TODO: replace with your own high-frequency task\n // await fetch(\"https://api.example.com/feed\");\n}\n\n// ── Daily — runs once per day in a UTC-hour window ────────────────────────────\n// Uses Val Town's lastRunAt to run only on the first tick inside the target hour.\n// Env: DAILY_HOUR_UTC — which UTC hour to run (0-23, default \"2\").\n\nasync function daily(now: Date, lastRunAt: Date | undefined): Promise {\n const targetHour = Number(env(\"DAILY_HOUR_UTC\", \"2\"));\n if (!shouldRunDaily(now, lastRunAt, targetHour)) return;\n\n console.log(`🔧 [${APP_NAME}] daily ${now.toISOString()}`);\n await pruneOldVisits(30);\n await logCronRun(\"daily\", `pruned visits older than 30 days`);\n console.log(`✅ [${APP_NAME}] daily done`);\n}\n\nfunction shouldRunDaily(\n now: Date,\n lastRunAt: Date | undefined,\n targetHour: number,\n): boolean {\n if (now.getUTCHours() !== targetHour) return false;\n const target = new Date(Date.UTC(\n now.getUTCFullYear(),\n now.getUTCMonth(),\n now.getUTCDate(),\n targetHour,\n ));\n return !lastRunAt || lastRunAt < target;\n}\n",[],[427],"3d8b63af-625e-401b-a675-b02284a05ddf","README.md","aabf7b64-48c5-11f1-9920-42b51c65c3df",347,["D",1788140102864],12,"# Val Town Quickstart\n\nA live, forkable full-stack Val Town starter — disguised as a working app. Sign in, add a reminder\nto the shared list, email its inbox and watch AI triage it as spam or not. Then fork it and swap in\nyour own idea. Sized for a solo project or a family's shared tools (<10 people), not an enterprise\nplatform.\n\n**Try it live, then fork:** open this App, click **Fork this App** on the home page. `vtx new` (see\nbelow) is for the CLI-first workflow inside this monorepo; forking on val.town works standalone too.\n\nAll demo data (the shared Reminders list, the AI email inbox) is public and is **permanently deleted\n24 hours after creation** — see `backend/db.ts`'s `pruneOld*` functions and `cron.ts`. Don't put\nanything sensitive in it.\n\nThe UI is built on [Astryx](https://astryx.atmeta.com), Meta's open-source React + StyleX design\nsystem. See [`_specs/astryx-template.md`](../../_specs/astryx-template.md) for the migration\nhistory, version pins, and the Deno SSR workarounds.\n\n`_template` is excluded from main-branch deployment because its directory starts with `_`.\n\nSince every Val Town HTTP val is browsable source, the deployed copy of this App is readable at\n`https://www.val.town/x///code/` — e.g.\n`https://www.val.town/x/pikachu/Val-Town-Quickstart/code/backend/auth.ts`. In-app \"view source\" and\n\"Fork\" links use this same pattern (see `VAL_TOWN_USERNAME` below).\n\n---\n\n## What it demos\n\n| Page | What you'll see |\n| ------------ | -------------------------------------------------------------------------------------------------------- |\n| `/` (Home) | Demo-first landing: fork CTA, live-demo cards, then the building blocks |\n| `/reminders` | **Flagship demo.** Shared list any signed-in user can add to / check off / delete |\n| `/email` | **AI demo.** Your App's real inbound address; a free GPT-mini model triages spam and summarises the rest |\n| `/anatomy` | Block diagram of Val Town's infra layer, this App's routing, and its core stack |\n| `/http` | HTTP routes and live request demos |\n| `/sqlite` | Visit log and admin controls |\n| `/cron` | Scheduled task history — this is what wipes demo data every 24h |\n| `/blob` | Sign-in-gated Blob read/write/list demo, keys namespaced per user |\n| `/ui` | Astryx theming explainer + component showcase |\n\n## Create Your Own Fork\n\n**On val.town:** open the deployed App → **Fork this App** on the home page → rename → done.\n\n**Inside this monorepo**, from any directory after sourcing the uApps shell plugin:\n\n```bash\nvtx new my-app\ncd vals/my-app\nvtx status\nvtx push --dry-run\nvtx push\nvtx url\n```\n\n`vtx new` copies the template, replaces the application name and account-scoped Blob prefix, writes\nthe new `val.yml` name, and links the new remote val. Existing destinations are refused.\n\n## Application Shape\n\nThe HTTP entry wraps the app in Val Town OAuth, routes `/api/*` through typed auth boundaries, and\nrenders the selected SSR page for every other path.\n\nAPI routes:\n\n| Method | Path | Access |\n| ------ | ----------------------- | ---------------------- |\n| `GET` | `/api/health` | Public |\n| `GET` | `/api/me` | Public session context |\n| `GET` | `/api/visits` | Public |\n| `POST` | `/api/prune-visits` | Admin |\n| `GET` | `/api/cron-runs` | Public |\n| `GET` | `/api/reminders` | Public read |\n| `POST` | `/api/reminders` | Signed-in |\n| `POST` | `/api/reminders/done` | Signed-in |\n| `POST` | `/api/reminders/delete` | Signed-in |\n| `GET` | `/api/emails` | Public read |\n| `GET` | `/api/blob-keys` | Signed-in, per-user |\n| `POST` | `/api/blob-write` | Signed-in, per-user |\n| `GET` | `/api/blob-read` | Signed-in, per-user |\n| `GET` | `/api/admin/users` | Super-admin |\n| `POST` | `/api/admin/set-admin` | Super-admin |\n\n\"Signed-in\" means any authenticated Val Town user — see `backend/auth.ts`'s `getAuthedUc` — not just\nadmins. This App is deliberately open: it's a shared demo, not a private tool.\n\n## Runtime Configuration\n\nSet these in the created val's Val Town environment UI, never in Git or GitHub Actions:\n\n| Variable | Kind | Purpose |\n| ------------------- | -------- | -------------------------------------------------------------------------------------- |\n| `APP_NAME` | Optional | Display name override |\n| `VAL_TOWN_USERNAME` | Optional | Your Val Town username — powers \"view source\"/Fork links and the inbound email address |\n| `DAILY_HOUR_UTC` | Optional | Daily task hour, `0`–`23` UTC |\n| `AUTH_SUPER_ADMINS` | Optional | Comma-separated Val Town usernames |\n\nNo API key is needed for the AI email triage — `backend/ai.ts` uses Val Town's free-tier\n`ValTownOpenAI` proxy.\n\nThe repository-level `VAL_TOWN_API_KEY` secret is only for CI deployment. See the root\n[`README.md`](../../README.md#cicd).\n\n## Trigger Contract\n\n`val.yml.files` declares the intended remote types:\n\n```yaml\nfiles:\n index.http.ts: http\n cron.ts: interval\n email.ts: email\n```\n\nRun `vtx types` after linking. Use `vtx apply-types` only when deliberately repairing remote trigger\nmetadata.\n\n## Architecture\n\n- `index.http.ts` — HTTP composition root: per-route SSR page serving, `GET /theme` (zero-JS mode\n switch), and the API route table.\n- `backend/auth.ts` — OAuth context and role enforcement (`getUc`/`getAuthedUc`/`getAdminUc`/\n `getSuperAdminUc`). Auth types use `Cxt` (e.g. `UserCxt`, `RouteCxt`) — the more common short form\n for \"context\" — not `Ctx`.\n- `backend/handlers.ts` — focused API handlers, including Reminders CRUD and the email inbox list.\n- `backend/db.ts` — retryable migration, visits, Cron runs, users, Reminders, and the inbound email\n log — the latter two carry a 24h retention window baked into every query.\n- `backend/ai.ts` — spam/summary triage via Val Town's free `ValTownOpenAI` proxy, using Structured\n Outputs so the response is guaranteed valid JSON.\n- `backend/storage.ts` — val-namespaced account Blob access, with per-user key sub-prefixing.\n- `frontend/app.tsx` — React SSR composition root; dispatches one page per request via a `PAGES` map\n (no client-side router — navigation is real ``).\n- `frontend/astryx/` — pinned Astryx component barrel (`components.ts`), the RAF/CAF SSR shim\n (`ssr-shims.ts`), and the side-nav/theme-form shell (`shell.tsx`).\n- `frontend/pages/` — one file per route, composed from Astryx components. `home.tsx` leads with the\n live demos and a Fork CTA; `page-anatomy.tsx` is the code deep-dive for visitors who want it.\n- `frontend/pages/kit.tsx` — shared page pieces: `SourceLink`/`SourceLinkList` (\"view source\") and\n `ForkButton` — both degrade gracefully when `VAL_TOWN_USERNAME` is unset.\n- `frontend/client.ts` — non-hydrated demo API wiring only (no router, no theme JS — both are\n server-driven). Dynamic table rows (Reminders, the email inbox) are cloned from a hidden, real\n Astryx-rendered `

History · backend