[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_112":113,"_114":115},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","canonry","name","Brand-Perception-Check","path","src/app/app.ts","project",{"_22":49,"_11":12,"_35":50,"_51":-5,"_52":44,"_53":54,"_55":54,"_56":57,"_58":59,"_60":61,"_62":63,"_64":34,"_65":-5,"_66":-5,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":-5,"_78":79,"_80":79,"_81":82,"_83":82,"_84":82,"_85":79,"_86":79,"_87":88,"_89":90,"_91":92,"_93":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/canonry/Brand-Perception-Check/code/src/app/app.ts","extension","id","4f817035-aa37-4dfa-9636-dc05d001c627","app.ts","fileId","ef9ec922-a7bd-11f1-ba16-1607ee4eb77e","parentId","ee205a2a-a7bd-11f1-a3ef-1607ee4eb77e","branchId","0ff5a62c-67cf-45f9-85df-c272daf0a6a9","branchVersion",27,"latest",true,"createdAt",["D",1788474100495],"version",1,"fileType","script","content","import { Hono } from 'npm:hono@4.12.25'\nimport type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport {\n type CheckRecord,\n checkFingerprint,\n type CheckStore,\n isCheckExpired,\n type JobDispatcher,\n newCheckRecord,\n normalizeUserQueries,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport {\n HumanVerificationError,\n normalizePublicDomain,\n PublicUrlError,\n utcDay,\n} from 'npm:@canonry/val-kit@0.2.0/security'\nimport { PublicQuotaError } from '../jobs/perception-check.ts'\nimport { createMcpHandler } from '../mcp/server.ts'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst MAX_BODY_BYTES = 4_096\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\nexport interface PageAssets {\n styles: string\n script: string\n /** Plated logo, used as the favicon. */\n mark: string\n /** Bare glyph, used inline in the brand lockup. */\n glyph: string\n}\n\nexport interface ValTownAppDependencies {\n store: CheckStore\n config: ValTownConfig\n dispatcher: JobDispatcher\n /** The UI is injected so this host stays independent from the renderer implementation. */\n renderPage: (record: CheckRecord | null) => string\n assets: PageAssets\n now?: () => Date\n}\n\nexport class PublicCheckUnavailableError extends Error {\n override name = 'PublicCheckUnavailableError'\n}\n\nclass PublicCheckAdmissionBusyError extends Error {\n override name = 'PublicCheckAdmissionBusyError'\n constructor() {\n super('Another request for this domain is being accepted. Try again shortly.')\n }\n}\n\nclass PublicCheckCapacityError extends Error {\n override name = 'PublicCheckCapacityError'\n constructor() {\n super('The public check is at capacity. Try again shortly.')\n }\n}\n\nexport function createValTownApp(deps: ValTownAppDependencies): Hono {\n const app = new Hono()\n const now = deps.now ?? (() => new Date())\n\n app.use('*', async (context, next) => {\n const turnstileAllowed = deps.config.publicChecksEnabled &&\n deps.config.humanVerificationStatus === 'ready' && Boolean(deps.config.turnstileSiteKey)\n context.header('Content-Security-Policy', contentSecurityPolicy(turnstileAllowed))\n context.header('X-Content-Type-Options', 'nosniff')\n context.header('Referrer-Policy', 'strict-origin-when-cross-origin')\n context.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()')\n context.header('Cross-Origin-Opener-Policy', 'same-origin')\n await next()\n })\n\n app.get('/healthz', (context) => context.json({ ok: true }))\n\n // Anonymous, read-only MCP over Streamable HTTP. It shares this app's store\n // so an agent reads exactly the checks the UI shows, and it owns its own\n // method/origin/envelope handling — including the 405 for a non-POST, which\n // is why it is registered for every method rather than POST alone.\n const mcp = createMcpHandler({\n store: deps.store,\n now,\n startCheck: deps.config.mcpStartChecksEnabled\n ? async (domain, remoteIp, queries) => {\n const outcome = await submitCheck(deps, {\n domain,\n queries,\n token: null,\n remoteIp,\n now: now(),\n admission: 'mcp',\n })\n return { record: (await deps.store.get(outcome.record.id)) ?? outcome.record, reused: outcome.reused }\n }\n : undefined,\n })\n app.all('/mcp', (context) => mcp(context.req.raw))\n // Immutable: the document references these with a content hash, so a changed\n // asset arrives under a new URL rather than waiting out a TTL.\n app.get('/assets/canonry-ui.css', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.styles, 200, { 'content-type': 'text/css; charset=utf-8' })\n })\n app.get('/assets/canonry-ui.js', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.script, 200, { 'content-type': 'application/javascript; charset=utf-8' })\n })\n app.get('/assets/canonry-mark.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.mark, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n app.get('/assets/canonry-glyph.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.glyph, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n\n app.get('/', async (context) => {\n const requestedId = context.req.query('check')\n const stored = requestedId && CHECK_ID.test(requestedId) ? await deps.store.get(requestedId) : null\n const record = stored && !isCheckExpired(stored, now()) ? stored : null\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(record))\n })\n\n app.get('/api/checks/:id', async (context) => {\n const id = context.req.param('id')\n if (!CHECK_ID.test(id)) return apiError(context, 404, 'not-found', 'Check not found.')\n const record = await deps.store.get(id)\n if (!record || isCheckExpired(record, now())) return apiError(context, 404, 'not-found', 'Check not found.')\n context.header('Cache-Control', 'no-store')\n return context.json({ check: publicCheckRecord(record) })\n })\n\n app.post('/api/checks', async (context) => {\n const payload = await parseJsonBody(context.req.raw)\n const outcome = await submitCheck(deps, {\n domain: payload.domain,\n queries: payload.queries,\n token: typeof payload.turnstileToken === 'string' ? payload.turnstileToken : null,\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n context.header('Cache-Control', 'no-store')\n if (outcome.dispatch === 'busy') {\n return apiError(context, 503, 'busy', 'The public check is at capacity. Try again shortly.')\n }\n return context.json(\n { check: publicCheckRecord(outcome.record), reused: outcome.reused },\n outcome.record.status === 'queued' || outcome.record.status === 'running' ? 202 : 200,\n )\n })\n\n app.post('/check', async (context) => {\n let submittedDomain: unknown = null\n try {\n const form = await parseFormBody(context.req.raw)\n submittedDomain = form.get('domain')\n const outcome = await submitCheck(deps, {\n domain: submittedDomain,\n queries: form.get('queries'),\n token: form.get('cf-turnstile-response'),\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n if (outcome.dispatch === 'busy') throw new PublicCheckCapacityError()\n return context.redirect(`/?check=${encodeURIComponent(outcome.record.id)}`, 303)\n } catch (error) {\n const failure = formFailureRecord(submittedDomain, now(), error)\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(failure), formFailureStatus(error))\n }\n })\n\n app.notFound((context) => apiError(context, 404, 'not-found', 'Not found.'))\n app.onError((error, context) => {\n if (error instanceof PublicUrlError) return apiError(context, 400, 'invalid-domain', error.message)\n if (error instanceof HumanVerificationError) {\n const status = error.code === 'unavailable' || error.code === 'transport' ? 503 : 403\n return apiError(context, status, `human-verification-${error.code}`, error.message)\n }\n if (error instanceof PublicQuotaError) return apiError(context, 429, `${error.scope}-quota`, error.message)\n if (error instanceof PublicCheckAdmissionBusyError) return apiError(context, 503, 'admission-busy', error.message)\n if (error instanceof PublicCheckCapacityError) return apiError(context, 503, 'busy', error.message)\n if (error instanceof PublicCheckUnavailableError) return apiError(context, 503, 'unavailable', error.message)\n if (error instanceof BodyTooLargeError) {\n return apiError(context, 413, 'body-too-large', 'Request body is too large.')\n }\n if (error instanceof InvalidBodyError) return apiError(context, 400, 'invalid-body', error.message)\n return apiError(context, 500, 'internal-error', 'The public check could not be started.')\n })\n\n return app\n}\n\ninterface CheckSubmission {\n record: CheckRecord\n reused: boolean\n dispatch: 'completed' | 'busy' | 'ignored'\n}\n\ninterface SubmitInput {\n domain: unknown\n /** Raw caller input; normalized here, never trusted as given. */\n queries?: unknown\n token: string | null\n remoteIp: string | null\n now: Date\n /**\n * Which admission rules apply. `mcp` skips human verification, which an\n * agent cannot perform, and spends from a separate, tighter daily bucket so\n * it cannot consume the browser allowance. Every other control — the global\n * daily cap, the single execution lease, cache reuse — is identical.\n */\n admission?: 'browser' | 'mcp'\n}\n\nasync function submitCheck(\n deps: ValTownAppDependencies,\n input: SubmitInput,\n): Promise {\n if (!deps.config.publicChecksEnabled) {\n throw new PublicCheckUnavailableError(\n deps.config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.',\n )\n }\n const target = normalizePublicDomain(input.domain)\n const userQueries = normalizeUserQueries(input.queries)\n const viaMcp = input.admission === 'mcp'\n if (!viaMcp) await deps.config.humanVerifier.verify({ token: input.token, remoteIp: input.remoteIp })\n // The questions join the reuse key. They change what the check measures, so\n // a second caller asking different questions about the same domain must not\n // be handed the first caller's answers.\n const fingerprint = checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, target.domain, userQueries)\n const timestamp = input.now.toISOString()\n\n // Cached and already-active work is useful without consuming the one global\n // execution slot. This keeps same-domain retries quota- and capacity-free.\n const reusable = await deps.store.findReusable(fingerprint, timestamp)\n if (reusable) return dispatchExistingCheck(deps, reusable)\n\n const hashedClient = await hashQuotaSubject(deps.config.quotaSalt, input.remoteIp ?? 'unknown')\n // A distinct subject rather than a distinct scope: `CheckQuotaClaim.scope` is\n // a closed union, and prefixing keeps the two buckets disjoint without\n // widening a durable contract.\n const clientSubject = viaMcp ? `mcp:${hashedClient}` : hashedClient\n const clientMax = viaMcp ? deps.config.mcpPerClientDailyLimit : deps.config.perClientDailyLimit\n const day = utcDay(input.now)\n const executionLeaseOwner = crypto.randomUUID()\n const executionLeaseUntil = new Date(input.now.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const capacityAvailable = await deps.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n executionLeaseOwner,\n timestamp,\n executionLeaseUntil,\n )\n if (!capacityAvailable) throw new PublicCheckCapacityError()\n\n let capacityHeld = true\n let dispatchOwnsCapacity = false\n const releaseCapacity = async () => {\n if (!capacityHeld) return\n await deps.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, executionLeaseOwner)\n capacityHeld = false\n }\n\n try {\n const admission = await deps.store.admit({\n candidate: newCheckRecord({\n id: crypto.randomUUID(),\n fingerprint,\n domain: target.domain,\n userQueries,\n now: input.now,\n }),\n now: timestamp,\n clientQuota: { scope: 'client', subject: clientSubject, day, max: clientMax },\n globalQuota: { scope: 'global', subject: 'all', day, max: deps.config.globalDailyLimit },\n })\n if (admission.kind === 'quota-exhausted') throw new PublicQuotaError(admission.scope)\n if (admission.kind === 'busy') throw new PublicCheckAdmissionBusyError()\n\n if (admission.kind === 'reused') {\n // A concurrent same-domain admission won. It must not inherit capacity\n // reserved by this request, so it goes through ordinary reuse dispatch.\n await releaseCapacity()\n return dispatchExistingCheck(deps, admission.record)\n }\n\n let dispatch: 'completed' | 'busy' | 'ignored' = 'ignored'\n if (admission.record.status === 'queued') {\n // Request-bound dispatch takes responsibility for this owner as soon as\n // it receives the promise. Its runner releases even a lost job claim.\n const dispatched = deps.dispatcher.dispatch(admission.record.id, { executionLeaseOwner })\n dispatchOwnsCapacity = true\n dispatch = await dispatched\n }\n return {\n record: (await deps.store.get(admission.record.id)) ?? admission.record,\n reused: admission.kind !== 'created',\n dispatch,\n }\n } finally {\n // The runner owns capacity only after dispatch receives the owner. The app\n // releases every admission, reuse, quota, and pre-dispatch error path.\n if (!dispatchOwnsCapacity) await releaseCapacity()\n }\n}\n\nasync function dispatchExistingCheck(\n deps: ValTownAppDependencies,\n record: CheckRecord,\n): Promise {\n const dispatch = record.status === 'queued' ? await deps.dispatcher.dispatch(record.id) : 'ignored'\n return {\n record: (await deps.store.get(record.id)) ?? record,\n reused: true,\n dispatch,\n }\n}\n\nfunction publicCheckRecord(\n record: CheckRecord,\n): Omit, 'fingerprint' | 'leaseOwner' | 'leaseUntil'> {\n const { fingerprint: _fingerprint, leaseOwner: _leaseOwner, leaseUntil: _leaseUntil, ...safe } = record\n return safe\n}\n\nfunction apiError(\n context: { json: (body: unknown, status?: number) => Response; header: (name: string, value: string) => void },\n status: number,\n code: string,\n message: string,\n): Response {\n context.header('Cache-Control', 'no-store')\n return context.json({ error: { code, message } }, status)\n}\n\nclass BodyTooLargeError extends Error {}\nclass InvalidBodyError extends Error {}\n\nasync function parseJsonBody(request: Request): Promise> {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/json')) {\n throw new InvalidBodyError('Expected a JSON request body.')\n }\n const text = await readLimitedBody(request)\n try {\n const parsed = JSON.parse(text)\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error()\n return parsed as Record\n } catch {\n throw new InvalidBodyError('Request body must be a JSON object.')\n }\n}\n\nasync function parseFormBody(request: Request): Promise {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/x-www-form-urlencoded')) {\n throw new InvalidBodyError('Expected a form submission.')\n }\n return new URLSearchParams(await readLimitedBody(request))\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const contentLength = Number(request.headers.get('content-length'))\n if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) throw new BodyTooLargeError()\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n throw new BodyTooLargeError()\n }\n chunks.push(next.value)\n }\n const output = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n output.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(output)\n}\n\nfunction remoteIp(request: Request): string | null {\n // Val injects this edge header. `x-forwarded-for` is caller-controlled on a\n // public val, so it is deliberately ignored for quota identity.\n const cf = request.headers.get('cf-connecting-ip')?.trim()\n if (cf && cf.length <= 128) return cf\n return null\n}\n\nasync function hashQuotaSubject(salt: string, value: string): Promise {\n const bytes = new TextEncoder().encode(`${salt}\\u0000${value}`)\n const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))\n return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * `frame-ancestors` allows Val Town because the val's own page previews the\n * deployed site in an iframe, and `'none'` renders that preview blank — the\n * first thing anyone arriving from val.town sees. The allowance is exactly the\n * hosting platform and nothing else, so ordinary clickjacking is still blocked.\n * There is little to hijack regardless: no session, no credential, and the only\n * action is submitting a public domain.\n */\nconst FRAME_ANCESTORS = [\"'self'\", 'https://www.val.town', 'https://val.town'].join(' ')\n\n/**\n * Geist is served from jsDelivr because a Val cannot ship the font itself:\n * woff2 is binary and Val Town refuses to push binary files. It is the same\n * package and version the dashboard bundles (`@fontsource-variable/geist`), so\n * the two surfaces render in the same typeface rather than this one silently\n * falling back to a system font, which is what it did before.\n */\nconst FONT_CDN = 'https://cdn.jsdelivr.net'\n\nfunction contentSecurityPolicy(turnstileAllowed: boolean): string {\n const turnstile = turnstileAllowed ? ' https://challenges.cloudflare.com' : ''\n return [\n \"default-src 'self'\",\n \"base-uri 'none'\",\n \"object-src 'none'\",\n `frame-ancestors ${FRAME_ANCESTORS}`,\n \"form-action 'self'\",\n `script-src 'self'${turnstile}`,\n `style-src 'self' ${FONT_CDN}`,\n `font-src ${FONT_CDN}`,\n `connect-src 'self'${turnstile}`,\n `frame-src${turnstile || \" 'none'\"}`,\n \"img-src 'self' data: https:\",\n ].join('; ')\n}\n\nfunction formFailureRecord(domain: unknown, now: Date, error: unknown): CheckRecord {\n const displayDomain = typeof domain === 'string' ? domain.trim().slice(0, 253) : ''\n const timestamp = now.toISOString()\n return {\n id: crypto.randomUUID(),\n fingerprint: '',\n domain: displayDomain,\n userQueries: [],\n status: 'failed',\n createdAt: timestamp,\n updatedAt: timestamp,\n expiresAt: null,\n result: null,\n errorCode: error instanceof PublicQuotaError ? PUBLIC_RATE_LIMITED_ERROR_CODE : 'form-submission-failed',\n errorMessage: formFailureMessage(error),\n leaseOwner: null,\n leaseUntil: null,\n }\n}\n\nfunction formFailureMessage(error: unknown): string {\n if (\n error instanceof PublicUrlError || error instanceof PublicQuotaError || error instanceof HumanVerificationError ||\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return error.message\n if (error instanceof BodyTooLargeError) return 'The submission was too large. Enter only a domain.'\n if (error instanceof InvalidBodyError) return 'The form could not be read. Try again.'\n return 'The public check could not be started. Try again later.'\n}\n\nfunction formFailureStatus(error: unknown): 400 | 403 | 413 | 429 | 503 {\n if (error instanceof PublicUrlError || error instanceof InvalidBodyError) return 400\n if (error instanceof BodyTooLargeError) return 413\n if (error instanceof PublicQuotaError) return 429\n if (\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return 503\n if (error instanceof HumanVerificationError) return error.code === 'invalid' ? 403 : 503\n return 503\n}\n","deleted",false,"label",[47,48,24],"src","app","801445f4-c67d-433d-af43-92af47fb72c9",["D",1788456812405],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","What AI engines say about a brand. Powered by Canonry.","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/aa8bd75a-0bc9-4694-0b72-9f187d1a6201/square512?exp=1789545599&sig=0d50af3ca47756c9d91729054814666cbff9b08dacac948b0607b6a85560fb3f","userId","891d245e-ec71-404d-a5ca-223733ee2844","pinnedFileId","f06d06b6-a7bd-11f1-990b-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0460b-6625-75ce-9e7f-9a6b062b0798","tursoName","801445f4c67d433daf4392af47fb72c9","tursoHostname","801445f4c67d433daf4392af47fb72c9-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789501263826],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_111":107},"org",{"_9":10,"_104":105,"_106":107,"_60":-5,"_108":109,"_110":44},"branch",{"_37":94,"_11":95,"_22":30,"_96":49,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":-5,"_102":12,"_103":10},"isOwned",40,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Canonry","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/5ae39d80-0d23-48e5-89d8-6bd2a7096401/square512?exp=1789545599&sig=0a9960884ebd7ffe829b9ebc677a1a156ca38fbe9a62f701ba13a4f84918b351","tier","free","canRestrictVals","profileImageUrl","ctx",{"_87":-5,"_145":146,"_147":148,"_149":150,"_151":44,"_152":44,"_153":44,"_154":34,"_155":-5,"_156":-7,"_157":-7,"_158":68,"_159":44,"_160":44,"_161":-5,"_162":44,"_163":44,"_164":44,"_165":-5},"ENV",{"_116":117,"_118":119,"_120":95,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138,"_139":140,"_141":142,"_143":144},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]