\");\n assertStringIncludes(xml, \"<link>\");\n assertStringIncludes(xml, \"<description>\");\n assertStringIncludes(xml, \"<language>en</language>\");\n assertStringIncludes(xml, \"<atom:link href=\");\n assertStringIncludes(xml, 'rel=\"self\"');\n assertStringIncludes(xml, 'type=\"application/rss+xml\"');\n } catch (error) {\n // Expected to fail without real PDS - skip test\n console.log(\"Skipping RSS integration test (requires real PDS):\", error);\n }\n});\n\nDeno.test(\"RSS feed - XML escaping works correctly\", () => {\n // Test the escapeXml function by importing it\n // We'll test the output indirectly through the feed generation\n\n const testCases = [\n { input: \"Test & Company\", expected: \"Test & Company\" },\n { input: \"<script>alert('xss')</script>\", expected: \"<script>\" },\n { input: 'Quote \"test\"', expected: \"Quote "test"\" },\n { input: \"Apostrophe's test\", expected: \"Apostrophe's test\" },\n ];\n\n // Since escapeXml is not exported, we verify it works through actual usage\n // This is a placeholder for unit testing the helper function\n console.log(\"XML escaping test cases:\", testCases);\n});\n\nDeno.test(\"RSS feed - RFC 822 date format\", () => {\n // Test date formatting\n const testDate = \"2025-11-01T12:00:00.000Z\";\n const date = new Date(testDate);\n const rfc822 = date.toUTCString();\n\n // Should match RFC 822 format: \"Fri, 01 Nov 2025 12:00:00 GMT\"\n assertStringIncludes(rfc822, \"Nov 2025\");\n assertStringIncludes(rfc822, \"GMT\");\n});\n",[],[217,261,305],{"_102":313,"_95":314,"_154":315,"_156":262,"_157":139,"_158":316,"_160":161,"_104":317,"_99":219,"_163":236,"_165":318,"_166":22,"_167":-5,"_168":319,"_98":320},"0fa62520-d074-11f0-b1ff-42dde27851f2","rss.ts","9d40c400-b71d-11f0-94a4-0224a6c84d84",434,["D",1764785734571],"import type { App } from \"jsr:@fresh/core@^2.2.0\";\n\n// Fresh App with any state type (we don't use Fresh's state management)\ntype FreshApp = App<any>;\nimport { decodeTagsFromUrl } from \"../../shared/utils.ts\";\n\nconst BOOKMARK_COLLECTION = \"community.lexicon.bookmarks.bookmark\";\n\n/**\n * Escapes special XML characters to prevent invalid XML\n */\nfunction escapeXml(unsafe: string): string {\n return unsafe\n .replace(/&/g, \"&\")\n .replace(/</g, \"<\")\n .replace(/>/g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\n/**\n * Formats a date string to RFC 822 format required by RSS\n */\nfunction toRFC822Date(isoDate: string): string {\n const date = new Date(isoDate);\n return date.toUTCString();\n}\n\n/**\n * Register RSS routes on the Fresh app\n */\nexport function registerRssRoutes(app: FreshApp): FreshApp {\n /**\n * Generates RSS 2.0 XML feed for a bookmark collection\n */\n app = app.get(\"/share/:did/:encodedTags/rss\", async (ctx) => {\n try {\n const did = ctx.params.did;\n const encodedTags = ctx.params.encodedTags;\n\n // Decode tags from URL\n const tags = decodeTagsFromUrl(encodedTags);\n\n if (!tags || tags.length === 0) {\n return new Response(\"Invalid tags\", { status: 400 });\n }\n\n // Resolve DID to PDS endpoint\n const didDoc = await fetch(\n `https://plc.directory/${did}`,\n ).then((r) => r.json());\n\n const pdsEndpoint = didDoc.service?.find((s: any) =>\n s.type === \"AtprotoPersonalDataServer\"\n )?.serviceEndpoint;\n\n if (!pdsEndpoint) {\n return new Response(\"PDS not found\", { status: 404 });\n }\n\n // Get handle from DID document\n const handle = didDoc.alsoKnownAs?.[0]?.replace(\"at://\", \"\") || did;\n\n // Fetch bookmarks from PDS\n const bookmarksResponse = await fetch(\n `${pdsEndpoint}/xrpc/com.atproto.repo.listRecords?` +\n new URLSearchParams({\n repo: did,\n collection: BOOKMARK_COLLECTION,\n limit: \"100\",\n }),\n );\n\n if (!bookmarksResponse.ok) {\n return new Response(\"Failed to fetch bookmarks\", { status: 500 });\n }\n\n const bookmarksData = await bookmarksResponse.json();\n\n // Filter bookmarks by tags\n const filteredBookmarks = bookmarksData.records\n .filter((record: any) => {\n const recordTags = record.value?.tags || [];\n return tags.every((tag) => recordTags.includes(tag));\n })\n .map((record: any) => ({\n uri: record.uri,\n cid: record.cid,\n subject: record.value.subject,\n createdAt: record.value.createdAt,\n tags: record.value.tags || [],\n title: record.value.$enriched?.title,\n description: record.value.$enriched?.description,\n favicon: record.value.$enriched?.favicon,\n }))\n .sort((a: any, b: any) =>\n new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime()\n );\n\n // Generate RSS feed metadata\n const tagsDisplay = tags.join(\", \");\n const channelTitle = `${handle}'s ${tagsDisplay} bookmarks`;\n const channelDescription =\n `Bookmarks tagged with ${tagsDisplay} by ${handle}`;\n const channelLink = `https://kipclip.com/share/${did}/${encodedTags}`;\n const feedUrl = `https://kipclip.com/share/${did}/${encodedTags}/rss`;\n\n // Build RSS XML\n const items = filteredBookmarks.map((bookmark: any) => {\n const title = escapeXml(bookmark.title || bookmark.subject);\n const description = escapeXml(\n bookmark.description || \"No description available\",\n );\n const link = escapeXml(bookmark.subject);\n const pubDate = toRFC822Date(bookmark.createdAt);\n const guid = escapeXml(bookmark.uri);\n\n return ` <item>\n <title>${title}

\n \n \n\n",[],[444,637],{"_102":646,"_95":647,"_154":648,"_156":445,"_157":139,"_158":649,"_160":161,"_104":650,"_99":452,"_163":236,"_165":651,"_166":22,"_167":652,"_168":653,"_98":654},"e4d13fa4-ab5e-11f0-b793-0224a6c84d84","index.tsx","e04d3ea8-a85a-11f0-b7ed-0224a6c84d84",136,["D",1760708450218],"/** @jsxImportSource https://esm.sh/react */\nimport { createRoot } from \"https://esm.sh/react-dom/client\";\nimport { App } from \"./components/App.tsx\";\nimport { AppProvider } from \"./context/AppContext.tsx\";\n\n// Only run in browser environment\nif (typeof document !== \"undefined\") {\n const root = createRoot(document.getElementById(\"root\")!);\n root.render(\n \n \n ,\n );\n}\n","kipclip",[],[444,647],{"_102":656,"_95":657,"_154":658,"_156":445,"_157":139,"_158":659,"_160":161,"_104":660,"_99":159,"_163":177,"_165":661,"_166":22,"_167":-5,"_168":662,"_98":663},"ee825f34-caf7-11f0-bc09-42dde27851f2","style.css","e06383a2-a85a-11f0-ad5b-0224a6c84d84",370,["D",1764182665561],"/* kipclip styles - matching the cute chicken mascot aesthetic */\n\n:root {\n --cream: #f5f1e8;\n --coral: #e66456;\n --teal: #5b8a8f;\n --orange: #f4a261;\n --dark-gray: #2d3748;\n --light-gray: #e2e8f0;\n --sidebar-bg: #f7f9fa;\n}\n\n* {\n margin: 0;\n padding: 0;\n box-sizing: border-box;\n}\n\nbody {\n font-family:\n -apple-system, BlinkMacSystemFont, \"Segoe UI\", Roboto, \"Helvetica Neue\",\n Arial, sans-serif;\n background: linear-gradient(135deg, var(--cream) 0%, #e8f4f5 100%);\n color: var(--dark-gray);\n min-height: 100vh;\n}\n\n#root {\n min-height: 100vh;\n}\n\n/* Utility classes to complement Tailwind */\n.btn-primary {\n background-color: var(--coral);\n color: white;\n padding: 0.75rem 1.5rem;\n border-radius: 0.5rem;\n border: none;\n font-weight: 600;\n cursor: pointer;\n transition: all 0.2s;\n}\n\n.btn-primary:hover {\n background-color: #d45546;\n transform: translateY(-1px);\n}\n\n.btn-secondary {\n background-color: var(--teal);\n color: white;\n padding: 0.75rem 1.5rem;\n border-radius: 0.5rem;\n border: none;\n font-weight: 600;\n cursor: pointer;\n transition: all 0.2s;\n}\n\n.btn-secondary:hover {\n background-color: #4a7a7f;\n transform: translateY(-1px);\n}\n\n.card {\n background: white;\n border-radius: 1rem;\n box-shadow: 0 4px 6px rgba(0, 0, 0, 0.07);\n padding: 1.5rem;\n transition: all 0.2s;\n}\n\n.card:hover {\n box-shadow: 0 6px 12px rgba(0, 0, 0, 0.1);\n}\n\n/* Loading spinner */\n.spinner {\n border: 3px solid var(--light-gray);\n border-top-color: var(--coral);\n border-radius: 50%;\n width: 40px;\n height: 40px;\n animation: spin 0.8s linear infinite;\n}\n\n@keyframes spin {\n to {\n transform: rotate(360deg);\n }\n}\n\n/* Smooth page transitions */\n.fade-in {\n animation: fadeIn 0.3s ease-in;\n}\n\n@keyframes fadeIn {\n from {\n opacity: 0;\n transform: translateY(10px);\n }\n to {\n opacity: 1;\n transform: translateY(0);\n }\n}\n\n/* Actor typeahead autocomplete - kipclip themed */\nactor-typeahead {\n --color-background: #ffffff;\n --color-border: var(--light-gray);\n --color-shadow: #000000;\n --color-hover: #fff1f1;\n --color-avatar-fallback: #fecaca;\n --radius: 8px;\n --padding-menu: 4px;\n}\n",[],[444,657],[444],{"_102":666,"_95":667,"_154":668,"_156":-5,"_157":139,"_158":669,"_160":161,"_104":670,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":671,"_98":696},"a9b530f4-ab2e-11f0-b702-0224a6c84d84","lexicons","a9b531b2-ab2e-11f0-b702-0224a6c84d84",69,["D",1760687735246],[672],{"_102":673,"_95":674,"_154":675,"_156":668,"_157":139,"_158":676,"_160":161,"_104":677,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":678,"_98":695},"a9d54394-ab2e-11f0-a35b-0224a6c84d84","com","a9d54452-ab2e-11f0-a35b-0224a6c84d84",70,["D",1760687735451],[679],{"_102":680,"_95":652,"_154":681,"_156":675,"_157":139,"_158":682,"_160":161,"_104":683,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":684,"_98":694},"aa0245ba-ab2e-11f0-b702-0224a6c84d84","aa024682-ab2e-11f0-b702-0224a6c84d84",71,["D",1760687735747],[685],{"_102":686,"_95":687,"_154":688,"_156":681,"_157":139,"_158":689,"_160":161,"_104":690,"_99":32,"_163":177,"_165":691,"_166":22,"_167":-5,"_168":692,"_98":693},"aa40522e-ab2e-11f0-a7e6-0224a6c84d84","tag.json","aa4052f6-ab2e-11f0-a7e6-0224a6c84d84",75,["D",1760687736158],"{\n \"lexicon\": 1,\n \"id\": \"com.kipclip.tag\",\n \"description\": \"A user-defined tag for organizing bookmarks\",\n \"defs\": {\n \"main\": {\n \"type\": \"record\",\n \"key\": \"tid\",\n \"record\": {\n \"type\": \"object\",\n \"required\": [\"value\", \"createdAt\"],\n \"properties\": {\n \"value\": {\n \"type\": \"string\",\n \"maxLength\": 64,\n \"description\": \"The tag text\"\n },\n \"createdAt\": {\n \"type\": \"datetime\",\n \"description\": \"Timestamp when tag was created\"\n }\n }\n }\n }\n }\n}\n",[],[667,674,652,687],[667,674,652],[667,674],[667],{"_102":698,"_95":699,"_154":700,"_156":-5,"_157":139,"_158":701,"_160":161,"_104":702,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":703,"_98":721},"53404a52-ac22-11f0-bd6f-0224a6c84d84","resources","53404b06-ac22-11f0-bd6f-0224a6c84d84",154,["D",1760792387394],[704],{"_102":705,"_95":706,"_154":707,"_156":700,"_157":139,"_158":708,"_160":161,"_104":709,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":710,"_98":720},"5368296e-ac22-11f0-b943-0224a6c84d84","favicons","53682a18-ac22-11f0-b943-0224a6c84d84",155,["D",1760792387644],[711],{"_102":712,"_95":713,"_154":714,"_156":707,"_157":139,"_158":715,"_160":161,"_104":716,"_99":32,"_163":177,"_165":717,"_166":22,"_167":-5,"_168":718,"_98":719},"53a5632e-ac22-11f0-b6d5-0224a6c84d84","site.webmanifest","53a563e2-ac22-11f0-b6d5-0224a6c84d84",158,["D",1760792387894],"{\"name\":\"\",\"short_name\":\"\",\"icons\":[{\"src\":\"/android-chrome-192x192.png\",\"sizes\":\"192x192\",\"type\":\"image/png\"},{\"src\":\"/android-chrome-512x512.png\",\"sizes\":\"512x512\",\"type\":\"image/png\"}],\"theme_color\":\"#ffffff\",\"background_color\":\"#ffffff\",\"display\":\"standalone\"}",[],[699,706,713],[699,706],[699],{"_102":723,"_95":724,"_154":725,"_156":-5,"_157":139,"_158":726,"_160":161,"_104":727,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_168":728,"_98":747},"dfb54256-a85a-11f0-ba27-0224a6c84d84","shared","dfb5430a-a85a-11f0-ba27-0224a6c84d84",4,["D",1760376870215],[729,738],{"_102":730,"_95":731,"_154":732,"_156":725,"_157":139,"_158":733,"_160":161,"_104":734,"_99":226,"_163":236,"_165":735,"_166":22,"_167":-5,"_168":736,"_98":737},"ce0e0f9c-cbc3-11f0-bc60-42dde27851f2","types.ts","e0b98c8e-a85a-11f0-9ff6-0224a6c84d84",380,["D",1764270228449],"// Shared TypeScript types for kipclip\n\n// AT Protocol bookmark record type\nexport interface BookmarkRecord {\n subject: string; // URI of the bookmarked content\n createdAt: string; // ISO 8601 datetime\n tags?: string[]; // Optional tags\n}\n\n// Enriched bookmark with metadata\nexport interface EnrichedBookmark extends BookmarkRecord {\n uri: string; // AT Protocol URI for this record\n cid: string; // Content ID\n title?: string; // Extracted page title\n description?: string; // Extracted meta description (future)\n favicon?: string; // Extracted favicon URL (future)\n}\n\n// API request/response types\nexport interface AddBookmarkRequest {\n url: string;\n}\n\nexport interface AddBookmarkResponse {\n success: boolean;\n bookmark?: EnrichedBookmark;\n error?: string;\n}\n\nexport interface ListBookmarksResponse {\n bookmarks: EnrichedBookmark[];\n}\n\n// URL metadata extraction result\nexport interface UrlMetadata {\n title?: string;\n description?: string;\n favicon?: string;\n}\n\n// Session info\nexport interface SessionInfo {\n did: string;\n handle: string;\n}\n\n// AT Protocol tag record type\nexport interface TagRecord {\n value: string; // Tag text (max 64 chars)\n createdAt: string; // ISO 8601 datetime\n}\n\n// Enriched tag with metadata\nexport interface EnrichedTag extends TagRecord {\n uri: string; // AT Protocol URI for this record\n cid: string; // Content ID\n}\n\n// Tag API request/response types\nexport interface AddTagRequest {\n value: string;\n}\n\nexport interface AddTagResponse {\n success: boolean;\n tag?: EnrichedTag;\n error?: string;\n}\n\nexport interface ListTagsResponse {\n tags: EnrichedTag[];\n}\n\nexport interface UpdateTagRequest {\n value: string;\n}\n\nexport interface UpdateTagResponse {\n success: boolean;\n tag?: EnrichedTag;\n error?: string;\n}\n\nexport interface DeleteTagResponse {\n success: boolean;\n error?: string;\n}\n\n// Bookmark tag update request/response types\nexport interface UpdateBookmarkTagsRequest {\n tags: string[];\n title?: string;\n url?: string;\n description?: string;\n}\n\nexport interface UpdateBookmarkTagsResponse {\n success: boolean;\n bookmark?: EnrichedBookmark;\n error?: string;\n}\n\n// Shared bookmarks API types (public, no auth)\nexport interface SharedBookmarksResponse {\n bookmarks: EnrichedBookmark[];\n handle: string;\n tags: string[];\n error?: string;\n}\n\n// Combined initial data response (for optimized page load)\nexport interface InitialDataResponse {\n bookmarks: EnrichedBookmark[];\n tags: EnrichedTag[];\n}\n",[],[724,731],{"_102":739,"_95":740,"_154":741,"_156":725,"_157":139,"_158":742,"_160":161,"_104":743,"_99":32,"_163":236,"_165":744,"_166":22,"_167":-5,"_168":745,"_98":746},"63d62a28-b5cb-11f0-a307-0224a6c84d84","utils.ts","63d62ad2-b5cb-11f0-a307-0224a6c84d84",209,["D",1761854560631],"// Shared utility functions for kipclip\n\n/**\n * Encodes an array of tags into a URL-safe string\n * Tags are sorted for consistency, then base64 encoded\n */\nexport function encodeTagsForUrl(tags: string[]): string {\n if (tags.length === 0) {\n throw new Error(\"Cannot encode empty tags array\");\n }\n\n // Sort tags for consistent encoding regardless of order\n const sorted = [...tags].sort();\n\n // Join with a delimiter\n const joined = sorted.join(\"|\");\n\n // Encode to base64 and make URL-safe\n const base64 = btoa(joined);\n const urlSafe = base64\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=/g, \"~\");\n\n return urlSafe;\n}\n\n/**\n * Decodes a URL-safe encoded string back into an array of tags\n */\nexport function decodeTagsFromUrl(encoded: string): string[] {\n try {\n // Convert from URL-safe back to standard base64\n const base64 = encoded\n .replace(/-/g, \"+\")\n .replace(/_/g, \"/\")\n .replace(/~/g, \"=\");\n\n // Decode from base64\n const joined = atob(base64);\n\n // Split by delimiter\n const tags = joined.split(\"|\");\n\n // Validate we got at least one tag\n if (tags.length === 0 || tags[0] === \"\") {\n throw new Error(\"No valid tags found\");\n }\n\n return tags;\n } catch (err) {\n throw new Error(`Invalid encoded tags: ${err.message}`);\n }\n}\n",[],[724,740],[724],{"_102":749,"_95":750,"_154":751,"_156":-5,"_157":139,"_158":752,"_160":161,"_104":753,"_99":119,"_163":177,"_165":754,"_166":22,"_167":-5,"_168":755,"_98":756},"bb09c0c4-c23d-11f0-95a2-42dde27851f2",".env.example","e0c3c960-a85a-11f0-9032-0224a6c84d84",307,["D",1763223083506],"# Local Development Environment Variables\n# Copy this file to .env and fill in your values\n\n# Base URL for your application\n# Val.Town production: https://your-val.val.town\n# Local development: http://127.0.0.1:8000 (use 127.0.0.1, not localhost - RFC 8252)\nBASE_URL=http://127.0.0.1:8000\n\n# Cookie secret for session encryption\n# IMPORTANT: Generate a secure random string (minimum 32 characters)\n# You can generate one with: openssl rand -base64 32\nCOOKIE_SECRET=your-secure-random-secret-minimum-32-chars-long\n\n# Optional: Custom port for local dev server (default: 8000)\n# PORT=8000\n",[],[750],{"_102":758,"_95":759,"_154":760,"_156":-5,"_157":139,"_158":761,"_160":161,"_104":762,"_99":219,"_163":177,"_165":763,"_166":22,"_167":-5,"_168":764,"_98":765},"d1327df2-d073-11f0-8127-42dde27851f2",".gitignore","e0d5cda4-a85a-11f0-90b0-0224a6c84d84",426,["D",1764785629785],"# Environment variables\n.env\n.env.local\n.env.*.local\n\n# Local development\n.local/\n*.db\n*.db-shm\n*.db-wal\n\n# Deno\n.deno/\n\n# Val.town\n.vt/\n\n# Editor\n.vscode/\n.idea/\n.claude/\n*.swp\n*.swo\n*~\n\n# OS\n.DS_Store\nThumbs.db\n\n# Logs\n*.log\nnpm-debug.log*\n",[],[759],{"_102":767,"_95":768,"_154":769,"_156":-5,"_157":139,"_158":770,"_160":161,"_104":771,"_99":726,"_163":177,"_165":772,"_166":22,"_167":-5,"_168":773,"_98":774},"d139bef0-d073-11f0-9b9b-42dde27851f2",".vtignore","e0caa5a0-a85a-11f0-b31b-0224a6c84d84",427,["D",1764785629841],".git\n.vscode\n.cursorrules\n.DS_Store\n.local\n.claude\nnode_modules\nvendor\nresources\n*.db\n*.db-shm\n*.db-wal",[],[768],{"_102":776,"_95":777,"_154":778,"_156":-5,"_157":139,"_158":779,"_160":161,"_104":780,"_99":159,"_163":177,"_165":781,"_166":22,"_167":-5,"_168":782,"_98":783},"aa95bd90-cc30-11f0-a11f-42dde27851f2","CLAUDE.md","e0cf22e2-a85a-11f0-af68-0224a6c84d84",396,["D",1764316984046],"# CLAUDE.md\n\nThis file provides guidance to Claude Code (claude.ai/code) when working with\ncode in this repository.\n\n## Project Overview\n\nkipclip is a bookmark manager for the AT Protocol ecosystem. Users authenticate\nvia Bluesky OAuth and store bookmarks on their personal data server (PDS) using\nthe community bookmark lexicon.\n\n## Commands\n\n```bash\ndeno task test # Run tests\ndeno task check # Type check backend and frontend\ndeno task quality # Format and lint\ndeno task deploy # Quality checks + deploy to Val Town\ndeno fmt # Format code\ndeno lint # Lint code\n```\n\n## Architecture\n\n- **Frontend**: React SPA with Tailwind CSS, served as static files\n- **Backend**: Hono HTTP server on Val Town\n- **Database**: Val Town SQLite (only for OAuth sessions, not bookmarks)\n- **Bookmark Storage**: User's PDS via AT Protocol\n\n### OAuth Stack\n\nUses framework-agnostic OAuth libraries:\n\n- `@tijs/atproto-oauth` - OAuth orchestration and route handlers\n- `@tijs/atproto-storage` - SQLite session storage with Val Town adapter\n- `@tijs/atproto-sessions` - Cookie/token management\n\nOAuth routes are registered individually in `backend/index.ts`:\n\n```typescript\napp.get(\"/login\", (c) => oauth.handleLogin(c.req.raw));\napp.get(\"/oauth/callback\", (c) => oauth.handleCallback(c.req.raw));\napp.get(\"/api/auth/session\", async (c) => {/* app-specific */});\n```\n\n### Key Files\n\n- `backend/index.ts` - Main Hono app, route registration\n- `backend/oauth-config.ts` - OAuth instance configuration\n- `backend/utils/session.ts` - Session extraction with error logging\n- `backend/routes/` - API route handlers\n- `frontend/components/App.tsx` - Main React component\n\n## Val Town Specifics\n\n- Export `app.fetch` as default export\n- Use `serveFile` from `https://esm.town/v/std/utils` for static files\n- Never use Hono's `serveStatic` or CORS middleware\n- Environment variables: `BASE_URL`, `COOKIE_SECRET`\n\n## Testing\n\nTests use `MemoryStorage` from `@tijs/atproto-storage` for isolation. Place test\nfiles next to source: `service.ts` → `service.test.ts`.\n\n## Code Style\n\n- TypeScript for all code\n- JSX pragma required for React: `/** @jsxImportSource https://esm.sh/react */`\n- Import from `jsr:` for Deno packages, `https://esm.sh/` for npm packages\n- Keep files under 500 lines\n",[],[777],{"_102":785,"_95":786,"_154":787,"_156":-5,"_157":139,"_158":788,"_160":161,"_104":789,"_99":119,"_163":177,"_165":790,"_166":22,"_167":-5,"_168":791,"_98":792},"1db0e968-c249-11f0-b1a8-42dde27851f2","DEVELOPMENT.md","bacecfbe-c23d-11f0-8e67-42dde27851f2",318,["D",1763227973490],"# Local Development Guide\n\nThis guide explains how to run kipclip locally for development and testing.\n\n## Full-Stack Local Development\n\nThe local dev server provides complete full-stack development:\n\n- ✅ **Backend API** - All endpoints work locally\n- ✅ **Frontend UI** - React/TSX transpiled on-the-fly with esbuild\n- ✅ **Database** - Local SQLite with migrations\n- ⚠️ **OAuth Flow** - Requires public URL (see below)\n\n### OAuth Setup with ngrok\n\nATProto OAuth requires a **publicly accessible** client metadata URL. For local\ndevelopment, use ngrok to expose your local server:\n\n**Setup Steps:**\n\n```bash\n# In terminal 1: Start dev server\ndeno task dev\n\n# In terminal 2: Expose with ngrok\nngrok http 8000\n\n# Update .env with ngrok URL\nBASE_URL=https://your-random-id.ngrok.io\n\n# Restart dev server to pick up new BASE_URL\n# Ctrl+C in terminal 1, then:\ndeno task dev\n```\n\n**Important:** Always restart the dev server after changing `BASE_URL` in `.env`\nso OAuth redirects work correctly.\n\n**Option 2: Mock authentication (recommended for API development)**\n\n- Use the test utilities in `backend/test-utils.ts`\n- Create mock sessions for testing authenticated endpoints\n- No internet required, very fast\n\n**Option 3: Deploy to Val.Town for OAuth testing**\n\n- Deploy changes to Val.Town\n- Test OAuth flow in production\n- Use local dev for API logic only\n\n## Quick Start\n\n1. **Copy environment template**\n ```bash\n cp .env.example .env\n ```\n\n2. **Generate a cookie secret**\n ```bash\n openssl rand -base64 32\n ```\n Paste the output into `.env` as `COOKIE_SECRET`\n\n3. **Start the dev server**\n ```bash\n deno task dev\n ```\n\n4. **Open in browser**\n ```\n http://localhost:8000\n ```\n\n## Development Setup\n\n### Environment Configuration\n\nEdit `.env` with your values:\n\n```bash\n# Base URL for OAuth redirects\nBASE_URL=http://localhost:8000\n\n# Secure random string (min 32 chars)\nCOOKIE_SECRET=your-generated-secret-from-openssl\n\n# Optional: Custom port (default: 8000)\n# PORT=3000\n```\n\n### Local vs Production\n\nThe app automatically detects whether it's running on Val.Town or locally:\n\n- **Val.Town**: Uses Val.Town's `sqlite2` module\n- **Local**: Uses Deno's native SQLite with file at `.local/kipclip.db`\n\nNo code changes needed between environments!\n\n### Database\n\n**Local SQLite file**: `.local/kipclip.db`\n\n- Created automatically on first run\n- Migrations run automatically\n- Inspect with any SQLite browser (e.g., DB Browser for SQLite)\n- Ignored by git (see `.gitignore`)\n\n**Schema**: Defined in `backend/database/schema.ts`\n\n**Migrations**: Tracked in `backend/database/migrations.ts`\n\n## Testing\n\n### Unit Tests\n\nFast tests using MemoryStorage and mocked OAuth:\n\n```bash\n# Run all tests\ndeno task test\n\n# Watch mode for TDD\ndeno task test:watch\n```\n\n### Test Utilities\n\nUse `backend/test-utils.ts` for testing:\n\n```typescript\nimport { createMockSession, createTestOAuth } from \"./test-utils.ts\";\n\n// Create test OAuth instance with MemoryStorage\nconst oauth = createTestOAuth();\n\n// Create mock session (bypasses real authentication)\nconst session = createMockSession({\n sub: \"did:plc:testuser\",\n handle: \"test.bsky.social\",\n});\n```\n\n### Example Tests\n\nSee `backend/routes/bookmarks.test.ts` for examples of:\n\n- Testing route handlers\n- Mocking authentication\n- Validating responses\n\n## Testing the API\n\nSince the frontend UI requires Val.Town's transpilation, test the backend API\ndirectly:\n\n### Example API Requests\n\n```bash\n# Check server health\ncurl http://localhost:8000/\n\n# Start OAuth login (redirects to Bluesky)\ncurl -I http://localhost:8000/login\n\n# List bookmarks (requires authentication)\ncurl http://localhost:8000/api/bookmarks\n\n# Get OAuth callback (after authentication)\n# This happens automatically in browser flow\n```\n\n### Using with Frontend on Val.Town\n\n1. Run backend locally: `deno task dev`\n2. Deploy frontend-only changes to Val.Town\n3. Point Val.Town frontend to `http://localhost:8000` API\n4. Test full stack with local backend + deployed frontend\n\n## Available Tasks\n\n```bash\ndeno task dev # Start local dev server (with watch mode)\ndeno task test # Run unit tests\ndeno task test:watch # Run tests in watch mode\ndeno task quality # Run formatters and linters\ndeno task check # Type check all files\ndeno task deploy # Quality checks + deploy to Val.Town\n```\n\n## OAuth Flow\n\nThe local dev server uses **real ATProto OAuth**:\n\n1. Click \"Login with Bluesky\"\n2. Redirects to your PDS (e.g., bsky.social)\n3. Authorize the app\n4. Redirects back to `http://localhost:8000/oauth/callback`\n5. Session stored in local SQLite database\n\n## Project Structure\n\n```\nkipclip-appview/\n├── .env # Your local environment (gitignored)\n├── .env.example # Environment template\n├── .local/ # Local dev files (gitignored)\n│ └── kipclip.db # SQLite database\n├── backend/\n│ ├── dev.ts # Local dev server entry point\n│ ├── index.ts # Production entry point (Val.Town)\n│ ├── test-utils.ts # Test helpers\n│ ├── database/\n│ │ ├── db.ts # Environment-aware DB config\n│ │ ├── local-sqlite.ts # Local SQLite adapter\n│ │ ├── schema.ts # Database schema\n│ │ └── migrations.ts # Migration runner\n│ ├── routes/\n│ │ ├── bookmarks.ts # Bookmark API routes\n│ │ └── bookmarks.test.ts # Example tests\n│ └── services/\n│ └── auth.ts # OAuth session handling\n└── frontend/ # React frontend\n```\n\n## Troubleshooting\n\n### Database locked error\n\nSQLite can only have one writer at a time. Make sure you don't have multiple dev\nservers running.\n\n### OAuth redirect fails\n\nCheck that `BASE_URL` in `.env` matches the URL you're accessing (including\nport).\n\n### Port already in use\n\nChange the port in `.env`:\n\n```bash\nPORT=3000\n```\n\n### Tests failing\n\nMake sure you're using `deno task test` (not just `deno test`) to get the\ncorrect permissions.\n\n## Tips\n\n1. **Database inspection**: Use DB Browser for SQLite to inspect\n `.local/kipclip.db`\n2. **Watch mode**: Both `dev` and `test:watch` tasks auto-reload on file changes\n3. **Real OAuth**: Test with your actual Bluesky account for realistic testing\n4. **Fast tests**: Unit tests use MemoryStorage, so they're very fast\n5. **Clean state**: Delete `.local/` directory to reset local database\n\n## Next Steps\n\n- Write more tests for your API routes\n- Add integration tests that hit real PDS (optional)\n- Inspect database schema to understand data model\n- Try adding new features locally before deploying\n",[],[786],{"_102":794,"_95":795,"_154":796,"_156":-5,"_157":139,"_158":797,"_160":161,"_104":798,"_99":452,"_163":177,"_165":799,"_166":22,"_167":-5,"_168":800,"_98":801},"aaa43eec-cc30-11f0-b505-42dde27851f2","README.md","e0a55016-a85a-11f0-af68-0224a6c84d84",397,["D",1764316984020],"# kipclip\n\n[![Test](https://github.com/tijs/kipclip-appview/workflows/Test/badge.svg)](https://github.com/tijs/kipclip-appview/actions/workflows/test.yml)\n\n[![Ko-fi](https://ko-fi.com/img/githubbutton_sm.svg)](https://ko-fi.com/tijsteulings/tip)\n\nFind it, Kip it. Save and organize bookmarks using the AT Protocol community\nbookmark lexicon.\n\n## Features\n\n- AT Protocol OAuth authentication\n- Save bookmarks to your personal data server (PDS)\n- Automatic URL enrichment (title extraction)\n- View and manage your bookmarks\n- Uses\n [community.lexicon.bookmarks.bookmark](https://github.com/lexicon-community/lexicon/blob/main/community/lexicon/bookmarks/bookmark.json)\n schema\n\n## Architecture\n\n- **Frontend**: React + TypeScript + Tailwind CSS\n- **Backend**: Hono + AT Protocol OAuth\n- **Database**: Val.town SQLite for OAuth session storage\n- **Bookmark Storage**: User's PDS (not in appview database)\n\n## Project Structure\n\n```text\nkipclip-appview/\n├── backend/\n│ ├── database/ # SQLite migrations\n│ ├── routes/ # API & static routes\n│ ├── services/ # URL enrichment\n│ └── index.ts # Main Hono app\n├── frontend/\n│ ├── components/ # React components\n│ ├── index.html # Bootstrap\n│ ├── index.tsx # React entry\n│ └── style.css # Custom styles\n└── shared/\n └── types.ts # Shared TypeScript types\n```\n\n## Setup\n\n### Prerequisites\n\n- Deno installed\n- Val Town account\n\n### Environment Variables\n\nCreate these in your Val.town environment:\n\n```bash\nBASE_URL=https://your-val.val.town\nCOOKIE_SECRET=your-random-secret-string-at-least-32-chars\n```\n\nVal.town provides SQLite automatically. The `COOKIE_SECRET` is required for\nencrypting OAuth session cookies.\n\n### Local Development\n\n```bash\n# Type check\ndeno task check\n\n# Run quality checks (format, lint, type check, test)\ndeno task quality\n\n# Deploy to Val.town\ndeno task deploy\n```\n\n## Mascot\n\nThe kipclip mascot is a friendly chicken carrying a bookmark bag. Replace the\nplaceholder image URL in `frontend/components/Login.tsx` with your\nCloudinary-hosted mascot image.\n\n## OAuth Flow\n\nkipclip uses [@tijs/atproto-oauth](https://jsr.io/@tijs/atproto-oauth) for AT\nProtocol authentication.\n\n1. User enters their AT Protocol handle\n2. App redirects to `/login?handle=user.bsky.social`\n3. OAuth package handles authentication with user's PDS\n4. Session stored in Val.town SQLite (14 days)\n5. User can now view/add bookmarks\n\nFor implementation details, see the\n[package documentation](https://jsr.io/@tijs/atproto-oauth).\n\n### Dependencies\n\n- [@tijs/atproto-oauth](https://jsr.io/@tijs/atproto-oauth) - OAuth\n orchestration\n- [@tijs/atproto-storage](https://jsr.io/@tijs/atproto-storage) - SQLite session\n storage\n- [@tijs/atproto-sessions](https://jsr.io/@tijs/atproto-sessions) - Cookie/token\n management\n\n## API Endpoints\n\n- `GET /api/bookmarks` - List user's bookmarks from PDS\n- `POST /api/bookmarks` - Add new bookmark with URL enrichment\n- `DELETE /api/bookmarks/:rkey` - Delete a bookmark\n- `/api/auth/session` - Check current session\n- `/api/auth/logout` - Logout\n- `/login` - OAuth login flow\n- `/oauth/callback` - OAuth callback\n\n## Bookmark Schema\n\nBookmarks are stored using the community lexicon:\n\n```typescript\n{\n subject: string; // URL being bookmarked\n createdAt: string; // ISO 8601 datetime\n tags?: string[]; // Optional tags\n}\n```\n\nThe app enriches bookmarks with page titles by fetching and parsing HTML\nmetadata.\n\n## Development Guidelines\n\n- Keep code files under 500 lines\n- Write testable code with dependency injection\n- Test files go next to code: `service.ts` → `service.test.ts`\n- Follow SOLID principles\n- Use TypeScript for all code\n\n## License\n\nMIT\n",[],[795],{"_102":803,"_95":804,"_154":805,"_156":-5,"_157":139,"_158":806,"_160":161,"_104":807,"_99":263,"_163":177,"_165":808,"_166":22,"_167":-5,"_168":809,"_98":810},"d1004e04-d073-11f0-9aff-42dde27851f2","deno.json","e07cf4f4-a85a-11f0-b7ed-0224a6c84d84",419,["D",1764785629384],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"imports\": {\n \"fresh\": \"jsr:@fresh/core@^2.2.0\"\n },\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"jsx\": \"react-jsx\",\n \"jsxImportSource\": \"https://esm.sh/react\",\n \"types\": [\n \"https://www.val.town/types/valtown.d.ts\"\n ],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"rules\": {\n \"exclude\": [\n \"no-explicit-any\",\n \"no-import-prefix\"\n ]\n }\n },\n \"include\": [\n \"backend/\",\n \"frontend/\",\n \"shared/\"\n ],\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n },\n \"tasks\": {\n \"dev\": \"deno run --allow-all --watch backend/dev.ts\",\n \"quality\": \"deno fmt && deno lint\",\n \"deploy\": \"deno task quality && vt push\",\n \"check\": \"deno check --allow-import backend/index.ts frontend/index.tsx\",\n \"test\": \"deno test --allow-all\",\n \"test:watch\": \"deno test --allow-all --watch\",\n \"fmt\": \"deno fmt\",\n \"lint\": \"deno lint\"\n }\n}\n",[],[804],"files",[151,170,182,189,196,207,215,222,229,240,249,259,266,275,285,294,303,312,321,330,340,350,357,367,374,383,393,402,414,423,432,442,448,455,464,473,482,492,502,511,520,529,538,547,556,566,575,585,592,602,609,619,625,635,645,655,665,672,679,685,697,704,711,722,729,738,748,757,766,775,784,793,802],"counts",{"_815":32,"_816":119,"_817":159,"_818":819},"pulls","branches","forks","envVars",{"_820":226,"_821":32},"count","emptyCount","contents",[824,827,830,833,836,839,842,845,848,851,854,857,860,863,866],{"_102":152,"_95":153,"_154":155,"_156":-5,"_157":139,"_158":159,"_160":161,"_104":825,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":826},["D",1760376869832],[153],{"_102":183,"_95":184,"_154":185,"_156":-5,"_157":139,"_158":186,"_160":161,"_104":828,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":829},["D",1764316983594],[184],{"_102":208,"_95":209,"_154":210,"_156":-5,"_157":139,"_158":211,"_160":161,"_104":831,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":832},["D",1763223082385],[209],{"_102":216,"_95":217,"_154":218,"_156":-5,"_157":139,"_158":219,"_160":161,"_104":834,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":835},["D",1760376870022],[217],{"_102":443,"_95":444,"_154":445,"_156":-5,"_157":139,"_158":119,"_160":161,"_104":837,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":838},["D",1760376869661],[444],{"_102":666,"_95":667,"_154":668,"_156":-5,"_157":139,"_158":669,"_160":161,"_104":840,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":841},["D",1760687735246],[667],{"_102":698,"_95":699,"_154":700,"_156":-5,"_157":139,"_158":701,"_160":161,"_104":843,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":844},["D",1760792387394],[699],{"_102":723,"_95":724,"_154":725,"_156":-5,"_157":139,"_158":726,"_160":161,"_104":846,"_99":32,"_163":164,"_165":-5,"_166":22,"_167":-5,"_98":847},["D",1760376870215],[724],{"_102":749,"_95":750,"_154":751,"_156":-5,"_157":139,"_158":752,"_160":161,"_104":849,"_99":119,"_163":177,"_165":754,"_166":22,"_167":-5,"_98":850},["D",1763223083506],[750],{"_102":758,"_95":759,"_154":760,"_156":-5,"_157":139,"_158":761,"_160":161,"_104":852,"_99":219,"_163":177,"_165":763,"_166":22,"_167":-5,"_98":853},["D",1764785629785],[759],{"_102":767,"_95":768,"_154":769,"_156":-5,"_157":139,"_158":770,"_160":161,"_104":855,"_99":726,"_163":177,"_165":772,"_166":22,"_167":-5,"_98":856},["D",1764785629841],[768],{"_102":776,"_95":777,"_154":778,"_156":-5,"_157":139,"_158":779,"_160":161,"_104":858,"_99":159,"_163":177,"_165":781,"_166":22,"_167":-5,"_98":859},["D",1764316984046],[777],{"_102":785,"_95":786,"_154":787,"_156":-5,"_157":139,"_158":788,"_160":161,"_104":861,"_99":119,"_163":177,"_165":790,"_166":22,"_167":-5,"_98":862},["D",1763227973490],[786],{"_102":794,"_95":795,"_154":796,"_156":-5,"_157":139,"_158":797,"_160":161,"_104":864,"_99":452,"_163":177,"_165":799,"_166":22,"_167":-5,"_98":865},["D",1764316984020],[795],{"_102":803,"_95":804,"_154":805,"_156":-5,"_157":139,"_158":806,"_160":161,"_104":867,"_99":263,"_163":177,"_165":808,"_166":22,"_167":-5,"_98":868},["D",1764785629384],[804],"upstreamProject","upstreamBranch","emptyEnvVars","isNew","flags",[],"routes/_app.x.$handle.$name.environment-variables",{"_93":94,"_95":96,"_100":877,"_818":882},{"_102":103,"_95":96,"_104":878,"_106":-5,"_107":22,"_108":109,"_110":111,"_112":113,"_14":114,"_115":-5,"_116":22,"_117":-5,"_118":119,"_16":120,"_121":122,"_123":122,"_124":125,"_126":125,"_127":125,"_128":122,"_129":122,"_23":879,"_133":880,"_136":881,"_148":22},["D",1760293850431],{"_93":94,"_131":132},{"_93":94,"_135":132,"_14":114},{"_99":138,"_95":43,"_102":139,"_140":103,"_141":-5,"_142":-5,"_143":-5,"_144":-5,"_145":-5,"_146":96,"_147":94},[883,889,892,896,900,903],{"_884":885,"_104":886,"_887":-5,"_110":72,"_888":22},"key","BUNNY_STORAGE_PASSWD",["D",1764616529978],"updatedAt","isEmpty",{"_884":890,"_104":891,"_887":-5,"_110":72,"_888":22},"BUNNY_STORAGE_ZONE",["D",1764616278796],{"_884":893,"_104":894,"_887":-5,"_110":895,"_888":22},"BUNNY_PULL_URL",["D",1764616008379],"kipclip.b-cdn.net",{"_884":897,"_104":898,"_887":899,"_110":72,"_888":22},"ENVIRONMENT",["D",1763228727651],["D",1763228734439],{"_884":901,"_104":902,"_887":-5,"_110":72,"_888":22},"COOKIE_SECRET",["D",1760466781874],{"_884":904,"_104":905,"_887":906,"_110":72,"_888":22},"BASE_URL",["D",1760377007036],["D",1760789612968],"actionData","errors"]

Key	Description
BUNNY_STORAGE_PASSWD
BUNNY_STORAGE_ZONE
BUNNY_PULL_URL	kipclip.b-cdn.net
ENVIRONMENT
COOKIE_SECRET
BASE_URL