{APP_NAME}

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_494":495,"_496":497},"routes/_app.x.$handle.$name",{"_101":100,"_32":46,"_110":91,"_27":54,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":25,"_124":125,"_126":60,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":84,"_85":86,"_87":88,"_89":25},"version",96,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","backend/auth.ts","latestPath","fileId","e84f973a-9018-11f1-9acf-1607ee4eb77e","name","auth.ts","fileType","script","content","// auth.ts — Two independent auth surfaces:\n// 1. Admin UI → Val Town OAuth, gated to the ADMIN_USERS env allow-list.\n// 2. Fn calls → one global API key (see settings-store.ts), checked as a\n// bearer token on every /get-* and /webhook request.\n// Docs: https://docs.val.town/guides/auth/#sign-in-with-val-town\n\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { HttpError } from \"./http.ts\";\nimport { getOrCreateApiKey } from \"./settings-store.ts\";\nimport { env, isRecord } from \"./shared.ts\";\n\n// ------------------------------------------------------------------------------\n// types\n// ------------------------------------------------------------------------------\n\nexport interface AdminUc {\n username: string | null;\n avatarUrl?: string;\n isAuthed: boolean;\n isAdmin: boolean;\n}\n\n// ------------------------------------------------------------------------------\n// middleware — only intercepts /auth/* ; never force-redirects other routes\n// ------------------------------------------------------------------------------\n\nexport function withValTownAuth(\n handler: (req: Request) => Response | Promise,\n): (req: Request) => Promise {\n return oauthMiddleware(handler) as (req: Request) => Promise;\n}\n\n// ------------------------------------------------------------------------------\n// fn auth (global API key)\n// ------------------------------------------------------------------------------\n\n/** Verify the caller's bearer token against the global API key. Throws HttpError. */\nexport async function authenticateApi(req: Request): Promise {\n const token = bearerToken(req);\n if (!token) throw new HttpError(\"Missing API key\", 401);\n const key = await getOrCreateApiKey();\n if (!timingSafeEqual(token, key)) throw new HttpError(\"Invalid API key\", 401);\n}\n\n// ------------------------------------------------------------------------------\n// admin context (OAuth)\n// ------------------------------------------------------------------------------\n\n/** Resolve the admin context from the Val Town session cookie. */\nexport async function getAdminUc(req: Request): Promise {\n const session = await getOAuthUserData(req);\n const username = normalizeUsername(session?.user);\n if (!username) return { username: null, isAuthed: false, isAdmin: false };\n return {\n username,\n avatarUrl: avatarUrl(session?.user),\n isAuthed: true,\n isAdmin: adminUsers().has(norm(username)),\n };\n}\n\n// ------------------------------------------------------------------------------\n// helpers\n// ------------------------------------------------------------------------------\n\nfunction adminUsers(): Set {\n return new Set(\n env(\"ADMIN_USERS\")\n .split(\",\")\n .map((u) => norm(u))\n .filter(Boolean),\n );\n}\n\nfunction normalizeUsername(raw: unknown): string | null {\n if (!isRecord(raw)) return null;\n return str(raw.username) ?? str(raw.handle) ?? null;\n}\n\nfunction avatarUrl(raw: unknown): string | undefined {\n if (!isRecord(raw)) return undefined;\n return str(raw.avatarUrl) ?? str(raw.avatar_url);\n}\n\nfunction str(value: unknown): string | undefined {\n if (typeof value === \"string\" && value.length > 0) return value;\n if (typeof value === \"number\") return String(value);\n return undefined;\n}\n\nfunction norm(value: string): string {\n return value.trim().toLowerCase();\n}\n\n/** Read the key from `Authorization: Bearer `, falling back to `X-API-Key`. */\nfunction bearerToken(req: Request): string | null {\n const auth = req.headers.get(\"authorization\");\n if (auth) {\n const m = /^Bearer\\s+(.+)$/i.exec(auth.trim());\n if (m) return m[1].trim();\n }\n const apiKey = req.headers.get(\"x-api-key\");\n return apiKey?.trim() || null;\n}\n\n/** Constant-time compare. The early length check still leaks length — acceptable\n * here since the key has a fixed length. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n","// auth.ts — Two independent auth surfaces:\n// 1. Admin UI → Val Town OAuth, gated to the ADMIN_USERS env allow-list.\n// 2. Fn calls → one global API key (see settings-store.ts), checked as a\n// bearer token on every /get-* and /webhook request.\n// Docs: https://docs.val.town/guides/auth/#sign-in-with-val-town\n\nimport { getOAuthUserData, oauthMiddleware } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { HttpError } from \"./api.ts\";\nimport { getOrCreateApiKey } from \"./settings-store.ts\";\nimport { env, isRecord } from \"./shared.ts\";\n\n// ------------------------------------------------------------------------------\n// types\n// ------------------------------------------------------------------------------\n\nexport interface AdminUc {\n username: string | null;\n avatarUrl?: string;\n isAuthed: boolean;\n isAdmin: boolean;\n}\n\n// ------------------------------------------------------------------------------\n// auth surfaces — admin OAuth (Val Town sign-in) + fn calls (global API key)\n// ------------------------------------------------------------------------------\n\n// OAuth middleware — only intercepts /auth/* ; never force-redirects other routes ---\n\nexport function withValTownAuth(\n handler: (req: Request) => Response | Promise,\n): (req: Request) => Promise {\n return oauthMiddleware(handler) as (req: Request) => Promise;\n}\n\n// fn auth (global API key) ---\n\n/** Verify the caller's bearer token against the global API key. Throws HttpError. */\nexport async function authenticateApi(req: Request): Promise {\n const token = bearerToken(req);\n if (!token) throw new HttpError(\"Missing API key\", 401);\n const key = await getOrCreateApiKey();\n if (!timingSafeEqual(token, key)) throw new HttpError(\"Invalid API key\", 401);\n}\n\n// admin context (OAuth) ---\n\n/** Resolve the admin context from the Val Town session cookie. */\nexport async function getAdminUc(req: Request): Promise {\n const session = await getOAuthUserData(req);\n const username = normalizeUsername(session?.user);\n if (!username) return { username: null, isAuthed: false, isAdmin: false };\n return {\n username,\n avatarUrl: avatarUrl(session?.user),\n isAuthed: true,\n isAdmin: adminUsers().has(norm(username)),\n };\n}\n\n// ------------------------------------------------------------------------------\n// helpers\n// ------------------------------------------------------------------------------\n\nfunction adminUsers(): Set {\n return new Set(\n env(\"ADMIN_USERS\")\n .split(\",\")\n .map((u) => norm(u))\n .filter(Boolean),\n );\n}\n\nfunction normalizeUsername(raw: unknown): string | null {\n if (!isRecord(raw)) return null;\n return str(raw.username) ?? str(raw.handle) ?? null;\n}\n\nfunction avatarUrl(raw: unknown): string | undefined {\n if (!isRecord(raw)) return undefined;\n return str(raw.avatarUrl) ?? str(raw.avatar_url);\n}\n\nfunction str(value: unknown): string | undefined {\n if (typeof value === \"string\" && value.length > 0) return value;\n if (typeof value === \"number\") return String(value);\n return undefined;\n}\n\nfunction norm(value: string): string {\n return value.trim().toLowerCase();\n}\n\n/** Read the key from `Authorization: Bearer `, falling back to `X-API-Key`. */\nfunction bearerToken(req: Request): string | null {\n const auth = req.headers.get(\"authorization\");\n if (auth) {\n const m = /^Bearer\\s+(.+)$/i.exec(auth.trim());\n if (m) return m[1].trim();\n }\n const apiKey = req.headers.get(\"x-api-key\");\n return apiKey?.trim() || null;\n}\n\n/** Constant-time compare. The early length check still leaks length — acceptable\n * here since the key has a fixed length. */\nfunction timingSafeEqual(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n","createdAt",["D",1785864194953],"branchVersion","branchId","5ce0246c-39c2-47d2-86b7-4133abafc79e","id","fd3404f9-cc43-40a4-9f5e-11cc4fb7f36a","uFns",["D",1780696380052],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","279c3e70-f2b8-11ef-a073-37253b8bcbda","pinnedFileId","ecb9a046-6128-11f1-a23b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019e994f-fcc4-73e9-86ed-2d14fe9f5dfa","tursoName","fd3404f9cc4340a49f5e11cc4fb7f36a","tursoHostname","fd3404f9cc4340a49f5e11cc4fb7f36a-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789506093912],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_101":100,"_109":105},"org",{"_101":100,"_102":103,"_104":105,"_18":-5,"_106":107,"_108":25},"branch",{"_13":90,"_32":91,"_44":43,"_92":45,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":-5,"_98":46,"_99":100},"isOwned",112,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","ttai","handle","displayName","Tough Tongue AI","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/4b8edab4-7879-48e2-f777-109aa5256800/square512?exp=1789538399&sig=f978c5623c37a24b1c2bd834ce5944a75af416ca407e74dc08ea9b2a912bd15f","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_44":45,"_32":46,"_39":489,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":68,"_69":70,"_71":490,"_73":-5,"_74":75,"_76":75,"_77":78,"_79":78,"_80":78,"_81":75,"_82":75,"_83":491,"_85":492,"_87":493,"_89":25},"tree",[211,227,241,242,243,244,245,246],"files",[211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246],"counts",{"_201":64,"_202":191,"_203":64,"_204":205,"_206":207},"contents",[131,132,133,134,135,136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":195,"_32":196,"_30":197,"_142":-5,"_42":43,"_41":198,"_144":60,"_39":199,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_27":200},{"_44":188,"_32":189,"_30":190,"_142":-5,"_42":43,"_41":191,"_144":60,"_39":192,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_27":194},{"_44":181,"_32":182,"_30":183,"_142":-5,"_42":43,"_41":184,"_144":60,"_39":185,"_13":64,"_34":20,"_36":186,"_24":25,"_148":-5,"_27":187},{"_44":173,"_32":174,"_30":175,"_142":-5,"_42":43,"_41":176,"_144":25,"_39":177,"_13":178,"_34":20,"_36":179,"_24":25,"_148":-5,"_27":180},{"_44":165,"_32":166,"_30":167,"_142":-5,"_42":43,"_41":168,"_144":60,"_39":169,"_13":64,"_34":170,"_36":171,"_24":25,"_148":-5,"_27":172},{"_44":158,"_32":159,"_30":160,"_142":-5,"_42":43,"_41":161,"_144":60,"_39":162,"_13":64,"_34":20,"_36":163,"_24":25,"_148":-5,"_27":164},{"_44":150,"_32":151,"_30":58,"_142":-5,"_42":43,"_41":152,"_144":25,"_39":153,"_13":146,"_34":154,"_36":155,"_24":25,"_148":156,"_27":157},{"_44":139,"_32":140,"_30":141,"_142":-5,"_42":43,"_41":143,"_144":25,"_39":145,"_13":146,"_34":20,"_36":147,"_24":25,"_148":-5,"_27":149},"e99236a2-0a34-4b3b-ade3-8cf24714e31c","val.yml","ec9d2eac-6128-11f1-a087-1607ee4eb77e","parentId",63,"latest",["D",1785859375335],3,"# val.yml — metadata contract for this val. Not consumed by `vt` today; reserved\n# for a future repo wrapper over vt-cli (safer deploys, env checks, file typing).\nname: \"uFns\"\norg: \"ttai\"\npublic: true\n# Mock/dev integration fns behind one global API key + a beer.css admin UI\n# gated to ADMIN_USERS via Val Town OAuth (see backend/auth.ts). Dev/staging only.\nfiles:\n index.http.ts: http\n cron.ts: interval\n","label",[140],"a0dcc931-1a03-46db-be70-1f46b7be2183","index.http.ts",66,["D",1785859376153],"http","// index.http.ts — HTTP entry point: fn routes + the beer.css admin UI.\n// Routing and error dispatch live here; logic in backend/fns/ and backend/pages/.\n//\n// Two surfaces:\n// Fn calls → /get-user-details, /get-information*, /webhook — POST-only,\n// each requires the global API key (Authorization: Bearer ).\n// Admin UI → / (tabs), POST /settings, POST /api-key/regenerate — Val Town\n// OAuth, gated to the ADMIN_USERS allow-list (see backend/auth.ts).\n\nimport { authenticateApi, getAdminUc, withValTownAuth } from \"./backend/auth.ts\";\nimport { getInformationSlow } from \"./backend/fns/get-information-slow.ts\";\nimport { getInformation } from \"./backend/fns/get-information.ts\";\nimport { getUserDetails } from \"./backend/fns/get-user-details.ts\";\nimport { webhookHandler } from \"./backend/fns/webhook.ts\";\nimport { dispatch, type RouteHandler } from \"./backend/http.ts\";\nimport { buildAdminView } from \"./backend/pages/admin.ts\";\nimport { regenerateApiKey, saveSettingsForm } from \"./backend/settings-store.ts\";\nimport { html, jsonError } from \"./backend/shared.ts\";\nimport { renderAdmin } from \"./frontend/admin.tsx\";\nimport { renderDenied, renderLogin } from \"./frontend/auth.tsx\";\nimport type { AdminUser } from \"./frontend/layout.tsx\";\n\n// ------------------------------------------------------------------------------\n// types\n// ------------------------------------------------------------------------------\ntype Method = \"GET\" | \"POST\" | \"PUT\" | \"DELETE\";\n\n// ------------------------------------------------------------------------------\n// fn routes — POST-only, each gated by the global API key\n// ------------------------------------------------------------------------------\n\nfunction withAuth(fn: RouteHandler): RouteHandler {\n return async (req, url) => {\n await authenticateApi(req);\n return await fn(req, url);\n };\n}\n\nconst ROUTES: Record>> = {\n \"/get-user-details\": { POST: withAuth(getUserDetails) },\n \"/get-information\": { POST: withAuth(getInformation) },\n \"/get-information-slow\": { POST: withAuth(getInformationSlow) },\n \"/webhook\": { POST: withAuth(webhookHandler) },\n};\n\n// admin UI paths — gated to ADMIN_USERS (see adminHandler below)\nconst ADMIN_PATHS: Record = {\n \"/\": true,\n \"/settings\": true,\n \"/api-key/regenerate\": true,\n};\n\n// ------------------------------------------------------------------------------\n// entry\n// ------------------------------------------------------------------------------\nasync function handler(req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname === \"\" ? \"/\" : url.pathname;\n\n if (path in ADMIN_PATHS) return await adminHandler(req, url, path);\n\n const route = ROUTES[path];\n if (!route) return jsonError(`Not found: ${path}`, 404);\n\n const fn = route[req.method as Method];\n if (!fn) return jsonError(`Method ${req.method} not allowed`, 405);\n\n return await dispatch(fn, req, url);\n}\n\nexport default withValTownAuth(handler);\n\n// ------------------------------------------------------------------------------\n// admin UI — Val Town OAuth, then the tabbed page + its two action routes\n// ------------------------------------------------------------------------------\n\nasync function adminHandler(req: Request, url: URL, path: string): Promise {\n const uc = await getAdminUc(req);\n if (!uc.isAuthed) return html(renderLogin(), 401);\n if (!uc.isAdmin) return html(renderDenied(uc.username ?? \"\"), 403);\n const user: AdminUser = { username: uc.username ?? \"\", avatarUrl: uc.avatarUrl };\n\n if (path === \"/\") {\n if (req.method !== \"GET\") return jsonError(`Method ${req.method} not allowed`, 405);\n return await dispatch((r, u) => adminPage(r, u, user), req, url);\n }\n if (req.method !== \"POST\") return jsonError(`Method ${req.method} not allowed`, 405);\n if (path === \"/settings\") return await dispatch(saveSettingsPage, req, url);\n return await dispatch(regenerateKeyPage, req, url);\n}\n\nasync function adminPage(_req: Request, url: URL, user: AdminUser): Promise {\n const saved = url.searchParams.get(\"saved\") === \"1\";\n const view = await buildAdminView(url, saved);\n return html(renderAdmin(view, user));\n}\n\nasync function saveSettingsPage(req: Request): Promise {\n await saveSettingsForm(req);\n return Response.redirect(new URL(\"/?saved=1#data\", req.url).href, 303);\n}\n\nasync function regenerateKeyPage(req: Request): Promise {\n await regenerateApiKey();\n return Response.redirect(new URL(\"/?saved=1#data\", req.url).href, 303);\n}\n","micro-fns",[151],"e70eafe0-39e0-45c4-8d7e-4abf2fd344df","deno.json","ec82e4ac-6128-11f1-9fb3-1607ee4eb77e",8,["D",1780696381966],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/348900b8b79f4a434cab4c74b3bc8d4d2fa8ee74/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": false,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\"dom\", \"dom.iterable\", \"dom.asynciterable\", \"deno.ns\", \"deno.unstable\"]\n },\n \"fmt\": {\n \"lineWidth\": 100\n },\n \"lint\": {\n \"rules\": {\n \"exclude\": [\"no-explicit-any\", \"no-external-import\", \"no-import-prefix\"]\n }\n },\n \"node_modules_dir\": false,\n \"unstable\": [\"temporal\", \"worker-options\", \"sloppy-imports\", \"node-globals\"]\n}\n",[159],"612c8dcf-a5cf-490b-8aad-f4f05d872659","cron.ts","eccd21ac-6128-11f1-ac3a-1607ee4eb77e",16,["D",1780696382454],"interval","// cron.ts — Scheduled cleanup: prune logs older than RETENTION_DAYS.\n\nimport { RETENTION_DAYS } from \"./backend/config.ts\";\nimport { deleteOldData } from \"./backend/db.ts\";\n\nexport default async function cleanup() {\n const result = await deleteOldData(RETENTION_DAYS);\n console.log(\n `Cleanup done: deleted ${result.requests} request(s), ${result.webhooks} webhook(s) older than ${RETENTION_DAYS}d`,\n );\n}\n",[166],"adece2be-d633-4b47-82b1-db9759c119dc","README.md","eca9edfe-6128-11f1-90f7-1607ee4eb77e",78,["D",1785861998257],5,"# uFns\n\nSmall integration functions for ToughTongue AI — mock user details, weather + headlines lookups,\nwebhook capture, and a single tabbed admin UI (Data / Debug / Activity / Info).\n\nPair with **uAgents** for heavier per-customer agent APIs behind header secrets.\n\n| Val | Role |\n| ----------- | ---------------------------------------------------------------- |\n| **uFns** | Lightweight integration fns (`/get-user-details`, `/webhook`, …) |\n| **uAgents** | Customer-scoped agent fns at `/fns//` |\n\nDeployed to the `ttai` org on Val Town (`vt create … --org-name ttai`).\n\n## Auth\n\nTwo independent surfaces:\n\n- **Fn calls** — one **global API key**, sent as `Authorization: Bearer ` (or\n `X-API-Key: `) on every request. The key is auto-minted on first use, viewable and rotatable\n on the **Data** tab. There is no per-customer scoping (that's what uAgents is for) — one key,\n checked in constant time, guards every fn.\n- **Admin UI** (`/`) — **Val Town sign-in**, gated to an allow-list, same pattern as uAgents. Set\n the `ADMIN_USERS` env var (Val Town sidebar) to a comma-separated list of Val Town usernames\n (case-insensitive). Sign-in uses\n [`std/oauth`](https://docs.val.town/guides/auth/#sign-in-with-val-town); see `backend/auth.ts`.\n\n## Admin UI\n\nA single page at `/` with four hash-routed tabs (`/#data`, `/#debug`, `/#activity`, `/#info`):\n\n| Tab | What |\n| ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| **Data** | Mock user fields (returned by `/get-user-details`) + the global API key |\n| **Debug** | Pick a fn, edit its JSON body, and fire a live call from the browser — see the resolved URL, `Authorization` header, and an equivalent `curl` update live |\n| **Activity** | Fn catalog + a live request/webhook log |\n| **Info** | Role, auth model, quick start, pairing with uAgents |\n\n## Fn endpoints\n\nAll POST-only, all require the API key:\n\n| Path | Purpose |\n| ----------------------- | --------------------------------------------------------------------------------------- |\n| `/get-user-details` | Returns the mock user from SQLite |\n| `/get-information` | Weather + headlines, padded to ~6s |\n| `/get-information-slow` | Weather + headlines, padded to ~20s |\n| `/webhook` | Captures a POST body for the Activity log — a regular fn like the rest, not a catch-all |\n\n`/get-information*` accept an optional JSON body `{\"location\": \"Tokyo\"}`; without one they fall back\nto the mock user's `location` (Data tab, default `Paris`).\n\nReady-to-run `curl` examples with the real deployed base URL filled in live on the **Activity** tab\n(empty-state) and the **Info** tab (quick start) — no guessing your val's hostname.\n\n### Weather + headlines API options\n\nBoth fns call **free, keyless** public APIs — no signup, no rate-limit surprises for a dev tool:\n\n- **Weather — [Open-Meteo](https://open-meteo.com)** (chosen). Free forecast + geocoding APIs, no\n API key, no rate limit for reasonable use. Alternatives considered: [wttr.in](https://wttr.in)\n (free, keyless, but plain-text/ANSI-first — JSON is an afterthought) and\n [OpenWeatherMap](https://openweathermap.org/api) (richer data, but requires a free-tier API key —\n adds a required env var for a mock endpoint).\n- **Headlines — [Hacker News (Firebase) API](https://github.com/HackerNews/API)** (chosen). Free,\n keyless, and consistently fast (`topstories.json` + a parallel `item/.json` fetch per story —\n measured ~0.3s per call). Headlines skew tech/HN, not general news. Alternatives considered:\n [GDELT DOC 2.0](https://blog.gdeltproject.org/gdelt-doc-2-0-api-debuts/) (free, keyless, broader\n real-world news coverage via full-text search — but measured ~13s per query from this repo's dev\n network, too slow/unpredictable for a 6–20s budget); **NewsAPI.org** / **GNews** / **currentsapi**\n (broader coverage and categories, but all require a free-tier API key).\n\n## Push\n\nFrom this directory:\n\n```bash\nvt create uFns . --org-name ttai --upload-if-exists --no-editor-files\nvt push # ship changes\n```\n\n`val.yml` is not read by `vt` yet — it documents the val contract for a future repo wrapper over\nvt-cli.\n\n## Add a function\n\n1. Write a thin handler in `backend/fns/.ts` — throw `HttpError` for client errors; body\n parsing via `readJson` / `readText` from `backend/http.ts`.\n2. Register it in `ROUTES` inside `index.http.ts`, wrapped in `withAuth(...)` so it requires the\n global API key (dispatch wraps error handling).\n3. Add it to `FN_SPECS` in `backend/config.ts` (path, note, sample body) so it shows up in the\n Activity table and the Debug tab's picker.\n4. `vt push`.\n",[174],"62fccb20-2409-47d1-b439-93272bd0e887",".env.sample","e81e6098-9018-11f1-ba51-1607ee4eb77e",36,["D",1785857207264],"# Val Town env vars for uFns (set in the Val Town sidebar — Deno.env.set() is a no-op).\n\n# Comma-separated Val Town usernames allowed into the admin UI (/, /settings, /info).\n# Case-insensitive; unset or empty = nobody gets in (signed-in visitors see \"Access denied\").\nADMIN_USERS=\n",[182],"f3312fd8-02a6-496a-986f-44d7e39f2f13","frontend","ec17eeae-6128-11f1-87d6-1607ee4eb77e",1,["D",1780696381266],"directory",[189],"3362f264-0383-4acf-b57d-e1b15ccedfca","backend","ec3e8050-6128-11f1-9fb3-1607ee4eb77e",2,["D",1780696381494],[196],"pulls","branches","forks","envVars",{"_208":64,"_210":64},"connections",{"_208":64,"_209":64},"count","unfilledCount","emptyCount",{"_44":195,"_32":196,"_30":197,"_142":-5,"_42":43,"_41":198,"_144":60,"_39":486,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_248":487,"_27":488},{"_44":481,"_32":456,"_30":450,"_142":197,"_42":43,"_41":482,"_144":60,"_39":483,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_248":484,"_27":485},{"_44":473,"_32":474,"_30":475,"_142":450,"_42":43,"_41":476,"_144":60,"_39":477,"_13":64,"_34":35,"_36":478,"_24":25,"_148":-5,"_248":479,"_27":480},{"_44":465,"_32":466,"_30":467,"_142":450,"_42":43,"_41":468,"_144":25,"_39":469,"_13":191,"_34":35,"_36":470,"_24":25,"_148":-5,"_248":471,"_27":472},{"_44":457,"_32":458,"_30":459,"_142":450,"_42":43,"_41":460,"_144":60,"_39":461,"_13":191,"_34":35,"_36":462,"_24":25,"_148":-5,"_248":463,"_27":464},{"_44":447,"_32":448,"_30":449,"_142":450,"_42":43,"_41":451,"_144":60,"_39":452,"_13":198,"_34":35,"_36":453,"_24":25,"_148":-5,"_248":454,"_27":455},{"_44":442,"_32":433,"_30":427,"_142":197,"_42":43,"_41":443,"_144":60,"_39":444,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_248":445,"_27":446},{"_44":434,"_32":435,"_30":436,"_142":427,"_42":43,"_41":437,"_144":60,"_39":438,"_13":198,"_34":35,"_36":439,"_24":25,"_148":-5,"_248":440,"_27":441},{"_44":424,"_32":425,"_30":426,"_142":427,"_42":43,"_41":428,"_144":60,"_39":429,"_13":191,"_34":35,"_36":430,"_24":25,"_148":-5,"_248":431,"_27":432},{"_44":416,"_32":417,"_30":418,"_142":197,"_42":43,"_41":419,"_144":25,"_39":420,"_13":198,"_34":154,"_36":421,"_24":25,"_148":-5,"_248":422,"_27":423},{"_44":412,"_32":33,"_30":31,"_142":197,"_42":43,"_41":14,"_144":60,"_39":413,"_13":198,"_34":35,"_36":38,"_24":25,"_148":-5,"_248":414,"_27":415},{"_44":404,"_32":405,"_30":406,"_142":197,"_42":43,"_41":407,"_144":25,"_39":408,"_13":286,"_34":35,"_36":409,"_24":25,"_148":-5,"_248":410,"_27":411},{"_44":396,"_32":397,"_30":398,"_142":197,"_42":43,"_41":399,"_144":60,"_39":400,"_13":191,"_34":35,"_36":401,"_24":25,"_148":-5,"_248":402,"_27":403},{"_44":388,"_32":389,"_30":390,"_142":197,"_42":43,"_41":391,"_144":25,"_39":392,"_13":198,"_34":35,"_36":393,"_24":25,"_148":-5,"_248":394,"_27":395},{"_44":380,"_32":381,"_30":382,"_142":197,"_42":43,"_41":383,"_144":60,"_39":384,"_13":191,"_34":35,"_36":385,"_24":25,"_148":-5,"_248":386,"_27":387},{"_44":372,"_32":373,"_30":374,"_142":197,"_42":43,"_41":375,"_144":60,"_39":376,"_13":198,"_34":35,"_36":377,"_24":25,"_148":-5,"_248":378,"_27":379},{"_44":188,"_32":189,"_30":190,"_142":-5,"_42":43,"_41":191,"_144":60,"_39":369,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_248":370,"_27":371},{"_44":364,"_32":347,"_30":341,"_142":190,"_42":43,"_41":365,"_144":60,"_39":366,"_13":64,"_34":193,"_36":-5,"_24":25,"_148":-5,"_248":367,"_27":368},{"_44":356,"_32":357,"_30":358,"_142":341,"_42":43,"_41":359,"_144":60,"_39":360,"_13":64,"_34":35,"_36":361,"_24":25,"_148":-5,"_248":362,"_27":363},{"_44":348,"_32":349,"_30":350,"_142":341,"_42":43,"_41":351,"_144":60,"_39":352,"_13":64,"_34":35,"_36":353,"_24":25,"_148":-5,"_248":354,"_27":355},{"_44":338,"_32":339,"_30":340,"_142":341,"_42":43,"_41":342,"_144":60,"_39":343,"_13":64,"_34":35,"_36":344,"_24":25,"_148":-5,"_248":345,"_27":346},{"_44":330,"_32":331,"_30":332,"_142":190,"_42":43,"_41":333,"_144":60,"_39":334,"_13":178,"_34":35,"_36":335,"_24":25,"_148":-5,"_248":336,"_27":337},{"_44":322,"_32":323,"_30":324,"_142":190,"_42":43,"_41":325,"_144":25,"_39":326,"_13":191,"_34":35,"_36":327,"_24":25,"_148":-5,"_248":328,"_27":329},{"_44":314,"_32":315,"_30":316,"_142":190,"_42":43,"_41":317,"_144":60,"_39":318,"_13":191,"_34":35,"_36":319,"_24":25,"_148":-5,"_248":320,"_27":321},{"_44":306,"_32":307,"_30":308,"_142":190,"_42":43,"_41":309,"_144":60,"_39":310,"_13":191,"_34":35,"_36":311,"_24":25,"_148":-5,"_248":312,"_27":313},{"_44":298,"_32":299,"_30":300,"_142":190,"_42":43,"_41":301,"_144":25,"_39":302,"_13":198,"_34":35,"_36":303,"_24":25,"_148":-5,"_248":304,"_27":305},{"_44":290,"_32":291,"_30":292,"_142":190,"_42":43,"_41":293,"_144":25,"_39":294,"_13":286,"_34":35,"_36":295,"_24":25,"_148":-5,"_248":296,"_27":297},{"_44":281,"_32":282,"_30":283,"_142":190,"_42":43,"_41":284,"_144":25,"_39":285,"_13":286,"_34":35,"_36":287,"_24":25,"_148":-5,"_248":288,"_27":289},{"_44":273,"_32":274,"_30":275,"_142":190,"_42":43,"_41":276,"_144":60,"_39":277,"_13":198,"_34":35,"_36":278,"_24":25,"_148":-5,"_248":279,"_27":280},{"_44":266,"_32":267,"_30":268,"_142":190,"_42":43,"_41":146,"_144":60,"_39":269,"_13":64,"_34":35,"_36":270,"_24":25,"_148":-5,"_248":271,"_27":272},{"_44":181,"_32":182,"_30":183,"_142":-5,"_42":43,"_41":184,"_144":60,"_39":263,"_13":64,"_34":20,"_36":186,"_24":25,"_148":-5,"_248":264,"_27":265},{"_44":173,"_32":174,"_30":175,"_142":-5,"_42":43,"_41":176,"_144":25,"_39":260,"_13":178,"_34":20,"_36":179,"_24":25,"_148":-5,"_248":261,"_27":262},{"_44":165,"_32":166,"_30":167,"_142":-5,"_42":43,"_41":168,"_144":60,"_39":257,"_13":64,"_34":170,"_36":171,"_24":25,"_148":-5,"_248":258,"_27":259},{"_44":158,"_32":159,"_30":160,"_142":-5,"_42":43,"_41":161,"_144":60,"_39":254,"_13":64,"_34":20,"_36":163,"_24":25,"_148":-5,"_248":255,"_27":256},{"_44":150,"_32":151,"_30":58,"_142":-5,"_42":43,"_41":152,"_144":25,"_39":251,"_13":146,"_34":154,"_36":155,"_24":25,"_148":156,"_248":252,"_27":253},{"_44":139,"_32":140,"_30":141,"_142":-5,"_42":43,"_41":143,"_144":25,"_39":247,"_13":146,"_34":20,"_36":147,"_24":25,"_148":-5,"_248":249,"_27":250},["D",1785859375335],"children",[],[140],["D",1785859376153],[],[151],["D",1780696381966],[],[159],["D",1780696382454],[],[166],["D",1785861998257],[],[174],["D",1785857207264],[],[182],"4a4fc7c0-88a2-4fc8-907e-a84d47f5d374","utils.ts","ec609fd2-6128-11f1-ac3a-1607ee4eb77e",["D",1780696381742],"// utils.ts — Formatting helpers for SSR pages.\n\nexport function formatJson(raw: string): string {\n try {\n return JSON.stringify(JSON.parse(raw), null, 2);\n } catch {\n return raw;\n }\n}\n\nexport function truncate(s: string, max: number): string {\n const flat = s.replace(/\\s+/g, \" \").trim();\n return flat.length > max ? flat.slice(0, max) + \"…\" : flat;\n}\n\nexport function isoUtc(ts: string): string {\n return ts.replace(\" \", \"T\") + \"Z\";\n}\n\nexport function methodChip(method: string): string {\n if (method === \"GET\") return \"blue\";\n if (method === \"POST\") return \"green\";\n if (method === \"PUT\" || method === \"PATCH\") return \"orange\";\n if (method === \"DELETE\") return \"red\";\n return \"grey\";\n}\n",[],[189,267],"bccdb792-426f-4081-9aad-a6b7deda33b3","types.ts","ec7b6a4c-6128-11f1-b845-1607ee4eb77e",71,["D",1785861997486],"// types.ts — View models passed from backend handlers into SSR pages.\n\nimport type { RequestLogEntry, WebhookLogEntry } from \"../backend/db.ts\";\n\nexport interface UserDetails {\n user_name: string;\n user_email: string;\n dynamic_vars: Record;\n}\n\nexport interface ActivityView {\n requests: RequestLogEntry[];\n webhooks: WebhookLogEntry[];\n reqTotal: number;\n whTotal: number;\n tab: \"requests\" | \"webhooks\";\n page: number;\n totalPages: number;\n}\n\n/** The single admin page: mock user + API key (Data tab) and the Activity log. */\nexport interface AdminView {\n saved: boolean;\n values: Record;\n apiKey: string;\n activity: ActivityView;\n baseUrl: string;\n}\n",[],[189,274],"4265d0c5-8e35-4eac-b13f-6e4d1b006989","layout.tsx","ec667934-6128-11f1-b2c9-1607ee4eb77e",91,["D",1785864194262],4,"/** @jsxImportSource https://esm.sh/preact@10.29.1 */\n// layout.tsx — Shared beer.css shell: top app bar, hash-based tabs, panels.\n\nimport type { ComponentChildren } from \"https://esm.sh/preact@10.29.1\";\nimport { APP_NAME } from \"../backend/shared.ts\";\nimport { GLOBAL_CSS } from \"./styles/index.ts\";\n\nconst BEER_CSS = \"https://cdn.jsdelivr.net/npm/beercss@4.0.21/dist/cdn/beer.min.css\";\nconst BEER_JS = \"https://cdn.jsdelivr.net/npm/beercss@4.0.21/dist/cdn/beer.min.js\";\nconst MDC_JS =\n \"https://cdn.jsdelivr.net/npm/material-dynamic-colors@1.1.2/dist/cdn/material-dynamic-colors.min.js\";\nconst ICONS =\n \"https://fonts.googleapis.com/css2?family=Material+Symbols+Outlined:opsz,wght,FILL,GRAD@24,400,0,0\";\n\n/** Brand seed — beer.css generates the full M3 palette from this at runtime.\n * Distinct from uAgents' blue (#2E6BE6) so the two admin UIs read apart. */\nconst BRAND_SEED = \"#7C4DFF\";\n\nexport interface AdminUser {\n username: string;\n avatarUrl?: string;\n}\n\ninterface ShellProps {\n children: ComponentChildren;\n user?: AdminUser;\n}\n\n/** Full HTML document with beer.css and a minimal top app bar. Pass `user` on\n * authenticated admin pages to show the signed-in badge + sign-out button. */\nexport function Shell({ children, user }: ShellProps) {\n return (\n \n \n \n \n {APP_NAME}\n \n \n \n \n

Diff · v96