diigo-cache: /public/<username>/all, searched client-side

Every stored shared bookmark on one page, in the public page's
microformats. Without JS that's the whole list, and the search form
asks the server's filtered page. With JS, the newest 5 show and search
hides and shows entries in place.

The browser runs the server's own matcher: query.ts becomes query.js
(JSDoc types, checkJs), which the worker imports as code and serves as
text at /_query.js via a `?raw` import and a wrangler Text rule.
`shown()` picks what the page shows; the page's script reads items
back from each h-entry.

Tests: shown(); /all lists all 270 stored shared items, none hidden;
/_query.js is the module the worker runs; and client-side search over
/all's parsed microformats finds what the server's ?q= finds. The
script itself was checked once in headless Chromium (5 of 54 shown by
default; ?q=fragments shows 8), not in CI.

Generated-by: Claude Opus 5.5

diigo-cache/README.md

@@ -19,6 +19,7 @@ Then, in the browser:
 ## Bookmarks you hold, a page anyone can read
 
 - **Filter by date and search:** `?days=7`, `?in=2026-W41` (ISO week, UTC), `?after=2026-01-01&before=2026-02-01`, `?by=created`, and `?q=` with words, `"phrases"`, `#tags`, `-negation`, and gmail-style `newer_than:7d`. Add `Accept: application/json` for JSON.
+- **Everything on one page:** `/public/<you>/all` lists every stored shared bookmark; with JS it shows the newest 5 and searches as you type, with the same syntax.
 - **Private stays private:** the public cache drops private bookmarks before storing anything, so it never holds them.
 - **Ids are capabilities:** the cache id is a bearer key you keep in your password manager. It rides URL fragments and POST bodies, never a path or query string, so it stays out of logs and history.
 - **Cheap to read:** pages come from Durable Object SQLite storage, and a fill job in the background fetches each diigo page once.