# capsite checklist

Goal: an EmDash site (madmode) collecting diigo.com bookmarks, credentials
held by the host, never inside the plugin (see capsite-notes.md).

## Architecture (as of 2026-10-07)

- `webapp/` — site-agnostic DO factory worker (deploy-once). Each instance
  is an attenuated credentialed handle to one HTTP surface; ids are bearer
  capabilities (128-bit, inderivable; not logged). Fluent surface
  (`pathjoin/query/withHeaders/cookies/get/post`), flower-style unions
  (contra-value throws; after NuxiNL/flower v0.11), promise-pipelined
  (whole chain = 1 round trip; only terminal get/post does I/O).
- `diigo-dump/` — the webapp consumer: mint call carries all diigo
  knowledge (interact_api url, UA + x-requested-with headers, cookie,
  500ms gate). Drives dumps via `WEBAPP.at(id)` stub.
- `madmode/` — EmDash site; `diigo-bookmarks/` native plugin (API-key
  path; currently 401 — see step 2); `diigo-ping/` obsolete probe worker
  (kept as evidence).

## State of the ladder

- [x] **1. Cookie-path dump worker** (`diigo-dump/`): GET is inert; dump
      only on POST. Manual test (2026-10-06): 200, `total: 1674`.
      (Scrubbed: static API-key ping worker failed 401 — cookie path works.)
- [x] **1b. webapp DO factory split**: credentialed authority in a
      Durable Object (storage persists init/config across restarts and
      evictions); consumer talks via service binding + id.
      Dev wiring verified: `pnpm dev` in diigo-dump → Ready on :8787,
      home + /_connect pages answer. NOT yet verified: mint through the
      running dev server (POST /_mint with a fresh cookie), then dump
      page 1 through the DO — the end-to-end chain.
- [ ] **2. Real API key in madmode/.dev.vars**: fetch a key from
      https://www.diigo.com/settings/api; confirm the EmDash plugin's
      "Sync now" returns success (status 200, bookmarks stored).
      Note: API-key path 401'd with the placeholder key; webapp's cookie
      path is proven — if the key path stays broken, consider whether the
      plugin should ride the webapp DO instead.
- [ ] **3. `/bookmarks` page renders real data** after a sync — titles/tags
      visible at `http://localhost:4321/bookmarks`.
- [ ] **4. Cron sync works** locally without errors (`0 */6 * * *` task in
      `_emdash_cron_tasks`).
- [ ] **5. Deploy order**: webapp first (`cd webapp && npx wrangler
      deploy`), then diigo-dump; mint a prod instance (POST /_mint with
      cookie; capture id from x-diigo-web-id header);
      `wrangler secret put DIIGO_WEB_ID` in diigo-dump; then madmode
      (`pnpm wrangler deploy`, secrets via `wrangler secret put`);
      plugin "Sync now" against prod.
- [ ] **6. bib sync #195**: repeat the pattern for the next read-access need.

## How to run (continuation prompts)

Dev (diigo-dump + webapp in one workerd):

    cd ~/oros-bots/capsite/diigo-dump
    pnpm dev                        # → http://localhost:8787
                                    # webapp rides along (binding-only)

First connect (or re-connect after cookie expiry) — browser flow, primary:

    open http://localhost:8787/_connect
    # paste the Cookie header from diigo.com devtools; mint
    # success page shows a copy button for the id
    # add DIIGO_WEB_ID="<id>" to diigo-dump/.dev.vars (only the id lives
    # on disk; the cookie lives in the DO's storage)
    # restart wrangler (pnpm dev) to pick it up

Terminal flow (superseded by the page; needs a display):

    pnpm -s diigo-login >> .dev.vars   # askpass prompt; appends the id line
                                       # (.dev.vars: pnpm stdout noise can
                                       # interleave; grep ^DIIGO_ to clean)

Then: enter a page number on the home page, dump → JSON items. GET /
is inert (no accidental fetches; dumps happen only on POST submits).

## Hard rules (learned 2026-10-06/07; keep them)

- The ASSISTANT never runs wrangler/astro dev servers; the user does
  (assistant watches work happen via .tmp/capsite.script; one-shot
  codegen like `wrangler types` is fine).
- Worker secrets never in source/config; `.dev.vars` (gitignored) locally,
  `wrangler secret put` deployed. Since the DO split, only DIIGO_WEB_ID
  is a diigo-dump secret at all.
- Error messages must not contain header or param values (they cross RPC
  as exceptions and land in logs); URLs appear query-stripped. TODO:
  @endo/errors for structured details once node_modules exists.
- `wrangler types` after any wrangler.jsonc change (generated
  worker-configuration.d.ts is gitignored).

## Pointers

- capsite-notes.md — the original goal + EmDash wiring details
- ../mm-diigo/projects/diigo-bak/ — provenance of the fluent client and
  dump generator (WebApp.js, diigo-dump.mjs, diigo-interact.mjs;
  commit 7dbb367, Oct 6 2026)
- webapp/README.md — HTTP + RPC surfaces; TODO there: proxy-page vs
  primary-worker mint form
- diigo-dump/README.md — consumer wiring, run/deploy details