docs: checklist as a continuation prompt

Now carries the architecture sketch (webapp factory / diigo-dump
consumer / madmode site), the ladder state including what's verified
vs not (DO round trip still to exercise end-to-end), the run/how-to
commands, the hard rules learned this session (assistant never runs
dev servers; secrets discipline; error hygiene; wrangler types),
and pointers into the notes and provenance repos.

Generated-by: opencode (GLM)

capsite-checklist.md

@@ -1,39 +1,99 @@
 # capsite checklist
 
-Goal ladder toward "an EmDash site collecting diigo.com bookmarks, credentials
+Goal: an EmDash site (madmode) collecting diigo.com bookmarks, credentials
-held by the host, never inside the plugin" (see capsite-notes.md).
+held by the host, never inside the plugin (see capsite-notes.md).
-Start small; each step must pass before moving down.
 
-- [x] **1. Cookie-path dump worker** (`diigo-dump/`): port of
+## Architecture (as of 2026-10-07)
-      `mm-diigo/projects/diigo-bak/diigo-dump.mjs` — one page-number field +
+
-      button, GET `interact_api/load_user_items?sort=updated&count=24&page_num=N`
+- `webapp/` — site-agnostic DO factory worker (deploy-once). Each instance
-      with the browser session cookie (`DIIGO_COOKIE` secret).
+  is an attenuated credentialed handle to one HTTP surface; ids are bearer
-      **Result (2026-10-06):** manual integration test PASSES —
+  capabilities (128-bit, inderivable; not logged). Fluent surface
-      status 200, `total: 1674`, page-1 items returned. GET / is inert; dump
+  (`pathjoin/query/withHeaders/cookies/get/post`), flower-style unions
-      only on POST submit.
+  (contra-value throws; after NuxiNL/flower v0.11), promise-pipelined
-      (2026-10-06, scrubbed: a static API-key ping worker, `diigo-ping/`,
+  (whole chain = 1 round trip; only terminal get/post does I/O).
-      was tried first and failed — Diigo rejected the key pair with 401.
+- `diigo-dump/` — the webapp consumer: mint call carries all diigo
-      The session-cookie / interact_api path is the one that works.)
+  knowledge (interact_api url, UA + x-requested-with headers, cookie,
-- [ ] **2. Real credentials in madmode/.dev.vars**: replace the placeholder
+  500ms gate). Drives dumps via `WEBAPP.at(id)` stub.
-      `DIIGO_API_KEY="dckc-madmode"` with a key from
+- `madmode/` — EmDash site; `diigo-bookmarks/` native plugin (API-key
+  path; currently 401 — see step 2); `diigo-ping/` obsolete probe worker
+  (kept as evidence).
+
+## State of the ladder
+
+- [x] **1. Cookie-path dump worker** (`diigo-dump/`): GET is inert; dump
+      only on POST. Manual test (2026-10-06): 200, `total: 1674`.
+      (Scrubbed: static API-key ping worker failed 401 — cookie path works.)
+- [x] **1b. webapp DO factory split**: credentialed authority in a
+      Durable Object (storage persists init/config across restarts and
+      evictions); consumer talks via service binding + id.
+      Dev wiring verified: `pnpm dev` in diigo-dump → Ready on :8787,
+      home + /_connect pages answer. NOT yet verified: mint through the
+      running dev server (POST /_mint with a fresh cookie), then dump
+      page 1 through the DO — the end-to-end chain.
+- [ ] **2. Real API key in madmode/.dev.vars**: fetch a key from
       https://www.diigo.com/settings/api; confirm the EmDash plugin's
       "Sync now" returns success (status 200, bookmarks stored).
+      Note: API-key path 401'd with the placeholder key; webapp's cookie
+      path is proven — if the key path stays broken, consider whether the
+      plugin should ride the webapp DO instead.
 - [ ] **3. `/bookmarks` page renders real data** after a sync — titles/tags
       visible at `http://localhost:4321/bookmarks`.
 - [ ] **4. Cron sync works** locally without errors (`0 */6 * * *` task in
       `_emdash_cron_tasks`).
-- [ ] **5. Deploy**: madmode to Workers `pnpm wrangler deploy`, secrets via
+- [ ] **5. Deploy order**: webapp first (`cd webapp && npx wrangler
-      `wrangler secret put`; plugin "Sync now" against prod.
+      deploy`), then diigo-dump; mint a prod instance (POST /_mint with
+      cookie; capture id from x-diigo-web-id header);
+      `wrangler secret put DIIGO_WEB_ID` in diigo-dump; then madmode
+      (`pnpm wrangler deploy`, secrets via `wrangler secret put`);
+      plugin "Sync now" against prod.
 - [ ] **6. bib sync #195**: repeat the pattern for the next read-access need.
 
-## Step 1 how-to: diigo-dump (session-cookie path)
+## How to run (continuation prompts)
 
-```bash
+Dev (diigo-dump + webapp in one workerd):
-cd diigo-dump
-# .dev.vars: DIIGO_COOKIE="<paste Cookie header from diigo.com devtools>"
-npx wrangler dev --port 8788   # → http://localhost:8788
-wrangler restarts pick up .dev.vars edits only at startup
-```
 
-Enter a page number, click dump → status + `total` + JSON items. GET `/` is
+    cd ~/oros-bots/capsite/diigo-dump
-inert (no accidental fetches); dumps happen only on POST submits.
+    pnpm dev                        # → http://localhost:8787
+                                    # webapp rides along (binding-only)
+
+First connect (or re-connect after cookie expiry) — browser flow, primary:
+
+    open http://localhost:8787/_connect
+    # paste the Cookie header from diigo.com devtools; mint
+    # success page shows a copy button for the id
+    # add DIIGO_WEB_ID="<id>" to diigo-dump/.dev.vars (only the id lives
+    # on disk; the cookie lives in the DO's storage)
+    # restart wrangler (pnpm dev) to pick it up
+
+Terminal flow (superseded by the page; needs a display):
+
+    pnpm -s diigo-login >> .dev.vars   # askpass prompt; appends the id line
+                                       # (.dev.vars: pnpm stdout noise can
+                                       # interleave; grep ^DIIGO_ to clean)
+
+Then: enter a page number on the home page, dump → JSON items. GET /
+is inert (no accidental fetches; dumps happen only on POST submits).
+
+## Hard rules (learned 2026-10-06/07; keep them)
+
+- The ASSISTANT never runs wrangler/astro dev servers; the user does
+  (assistant watches work happen via .tmp/capsite.script; one-shot
+  codegen like `wrangler types` is fine).
+- Worker secrets never in source/config; `.dev.vars` (gitignored) locally,
+  `wrangler secret put` deployed. Since the DO split, only DIIGO_WEB_ID
+  is a diigo-dump secret at all.
+- Error messages must not contain header or param values (they cross RPC
+  as exceptions and land in logs); URLs appear query-stripped. TODO:
+  @endo/errors for structured details once node_modules exists.
+- `wrangler types` after any wrangler.jsonc change (generated
+  worker-configuration.d.ts is gitignored).
+
+## Pointers
+
+- capsite-notes.md — the original goal + EmDash wiring details
+- ../mm-diigo/projects/diigo-bak/ — provenance of the fluent client and
+  dump generator (WebApp.js, diigo-dump.mjs, diigo-interact.mjs;
+  commit 7dbb367, Oct 6 2026)
+- webapp/README.md — HTTP + RPC surfaces; TODO there: proxy-page vs
+  primary-worker mint form
+- diigo-dump/README.md — consumer wiring, run/deploy details