captoys/diigo-cache

diigo-dump

Cloudflare Worker consumer of the webapp factory: the site-side of dumping Diigo bookmarks from the mm-diigo provenance scripts (projects/diigo-bak/) — session-cookie access, most-recently-updated first. The static API-key path is dead (both known keys, all documented schemes → 401; see the capsite checklist, goal 2 preamble).

What it holds

Only the diigo flavoring — everything generic lives in webapp:

• the mint call: url = https://www.diigo.com/interact_api/, seed headers {user-agent, x-requested-with} (+ the cookie at mint time), msPerCall: 500
• the dump page: page-number form → WEBAPP.at(id) → pipelined pathjoin("load_user_items").query({sort, count, page_num}).get()
• the DiigoBridge entrypoint (open(), dumpNdjson()) for other workers; dumpBookmarks (the generator from mm-diigo's diigo-dump.mjs) is in src/diigo.ts

GET / is inert; dumps happen only on POST submits.

State surface

• The instance id (DIIGO_WEB_ID): the one secret (bearer capability; possession is authority). Not logged.
• The cookie: lives only in the webapp DO's storage, crosses the wire exactly once, at mint time. Nothing on disk holds it.
• /_connect: state-aware — pre-mint it's the paste-cookie form; post-mint it health-checks the instance (count=1 probe) and offers re-mint only for stale cookies.

RPC use (from another worker, same account)

// wrangler.jsonc of the caller
"services": [{ "binding": "DIIGO", "service": "diigo-dump", "entrypoint": "DiigoBridge" }]

const stub = await env.DIIGO.open();
// promise pipelining: whole chain = one round trip; cookie never leaves the DO
const first = JSON.parse(await stub.pathjoin("load_user_items")
	.query({ sort: "updated", count: 24, page_num: 1 }).get());

Run, deploy

[How to run / connect / deploy is maintained in the capsite checklist] (../capsite-checklist.md) (single source; this README keeps only worker-level facts).

Status: dev wiring verified (boots, pages answer); mint → dump through the DO not yet exercised end-to-end (checklist 1b-i). Earlier flat (non-DO) build passed manual test: 200, total: 1674 (2026-10-06).