[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","mcpconformance","name","mcp-client-conformance","path","src/hosted/traffic.ts","project",{"_22":49,"_11":12,"_35":50,"_51":-5,"_52":44,"_53":54,"_55":54,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":34,"_63":-5,"_64":-5,"_65":38,"_66":67,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":44},"file",{"_22":23,"_11":24,"_25":26,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":-5,"_13":46},"permalink","https://www.val.town/x/mcpconformance/mcp-client-conformance/code/src/hosted/traffic.ts","extension","id","51865bb8-276b-4f41-a9a3-bd0c98333f68","traffic.ts","fileId","01f17e9c-b021-11f1-878d-1607ee4eb77e","parentId","11abc952-e3be-41e6-ac33-6929c3af1284","branchId","fdc11199-683b-41f1-a3c5-d5ac53972f86","branchVersion",386,"latest",true,"createdAt",["D",1789379123801],"version",0,"fileType","script","content","/**\n * A cell's traffic: each request the client sent it — to its MCP endpoint,\n * to the metadata the cell serves at its own origin, and to its sign-in\n * server through the relay — with the cell's answer, as the cell page lists\n * it and `/results//traffic.jsonl` hands it out.\n *\n * Each process keeps, per build of a cell, one row of exchanges and writes\n * it to the run store beside its checks (see SessionManager.write()), so a\n * page served by any process lists what every process saw. A row is capped\n * (TRAFFIC_ROW_EXCHANGES, TRAFFIC_ROW_BYTES), and so is each body\n * (TRAFFIC_BODY_CAP), with the cut said; a store refuses a row that would\n * take one cell's traffic over TRAFFIC_CELL_BYTES.\n *\n * What is never kept: the value of an Authorization or DPoP header (only\n * whether one was sent), nor a credential's value in a body (see\n * redacted()). A credential the cell issued (a registered\n * client_id, an authorization code, an access or refresh token) is kept as\n * a keyed hash in `issued`, so that after a reset the cell can refuse one\n * handed out before it (see refusedCredential()).\n */\n\nimport { createHash, randomBytes } from 'node:crypto';\nimport type { IncomingHttpHeaders, IncomingMessage } from 'node:http';\n\n/** Which origin an exchange went to, as the page's gutter shows it. */\nexport type Lane = 'mcp' | 'metadata' | 'sign-in';\n\n/** Request and response bodies are kept up to this many bytes each. */\nexport const TRAFFIC_BODY_CAP = 8 * 1024;\n\n/** Exchanges one process keeps per cell and attempt; later ones are counted. */\nexport const TRAFFIC_ROW_EXCHANGES = 150;\n\n/** …and bytes: whichever comes first. */\nexport const TRAFFIC_ROW_BYTES = 192 * 1024;\n\n/**\n * One cell's traffic across processes, at most: a store refuses a row that\n * would take the cell over it (see RunStore.saveTraffic()).\n */\nexport const TRAFFIC_CELL_BYTES = 1024 * 1024;\n\n/** A JSON-RPC message the request carried: its method and id. */\nexport interface RpcSummary {\n method?: string;\n id?: string | number | null;\n}\n\nexport interface Exchange {\n /** When the request arrived (ISO 8601, with milliseconds). */\n at: string;\n /** How long the cell took to answer, when it has. */\n ms?: number;\n lane: Lane;\n /** On the sign-in lane: which relay (`as`, `as2`, `idp`). */\n role?: string;\n method: string;\n /** The path at the cell's origin, with its query. */\n path: string;\n rpc?: RpcSummary[];\n /** The request headers that matter (see keptRequestHeaders()). */\n headers: Record;\n /** Whether the request carried an Authorization header; never its value. */\n authorization: 'present' | 'absent';\n /**\n * The credential the client presented was issued before the cell was\n * last reset, so the cell treated it as unknown (see refusedCredential()).\n */\n refused?: CredentialKind;\n /** The request body as text, cut at TRAFFIC_BODY_CAP. */\n body?: string;\n /** The body's full size in bytes, when it was cut. */\n bodyBytes?: number;\n /** Absent while a stream the cell answered with is still open. */\n status?: number;\n responseHeaders?: Record;\n responseBody?: string;\n responseBytes?: number;\n /**\n * Which connection carried it: `s:` on the stateful wire,\n * else `t:.` when the host shows the socket; absent when\n * it cannot be told (a fetch-style host sees no sockets).\n */\n conn?: string;\n /** The same exchange again right after, this many more times. */\n repeats?: number;\n}\n\n/** One process's traffic for one build of a cell, as stored. */\nexport interface TrafficRow {\n exchanges: Exchange[];\n /** Exchanges not kept because the row reached its cap. */\n omitted: number;\n /** Keyed hashes of the credentials the cell issued (see issuedBy()). */\n issued: string[];\n}\n\nexport function emptyRow(): TrafficRow {\n return { exchanges: [], omitted: 0, issued: [] };\n}\n\nconst KEPT_HEADERS = new Set([\n 'user-agent',\n 'content-type',\n 'accept',\n 'last-event-id',\n 'origin'\n]);\n\n/**\n * The request headers an exchange keeps: every `Mcp-*` header, and\n * User-Agent, Content-Type, Accept, Last-Event-ID and Origin. A DPoP proof,\n * like Authorization, is kept only as present.\n */\nexport function keptRequestHeaders(\n headers: IncomingHttpHeaders\n): Record {\n const out: Record = {};\n for (const [name, value] of Object.entries(headers)) {\n if (value === undefined) continue;\n const text = Array.isArray(value) ? value.join(', ') : value;\n if (name.startsWith('mcp-') || KEPT_HEADERS.has(name)) out[name] = text;\n else if (name === 'dpop') out[name] = '(present)';\n }\n return out;\n}\n\nconst KEPT_RESPONSE_HEADERS = new Set([\n 'content-type',\n 'www-authenticate',\n 'location',\n 'allow'\n]);\n\nexport function keptResponseHeaders(\n get: (name: string) => unknown,\n names: readonly string[]\n): Record {\n const out: Record = {};\n for (const name of names) {\n const n = name.toLowerCase();\n if (!n.startsWith('mcp-') && !KEPT_RESPONSE_HEADERS.has(n)) continue;\n const value = get(n);\n if (typeof value === 'string') out[n] = value;\n else if (typeof value === 'number') out[n] = String(value);\n else if (Array.isArray(value)) out[n] = value.join(', ');\n }\n return out;\n}\n\n/** `text` cut at TRAFFIC_BODY_CAP bytes, with its full size when cut. */\nexport function capped(\n text: string | undefined,\n size = text === undefined ? 0 : Buffer.byteLength(text)\n): { text?: string; bytes?: number } {\n if (text === undefined || text === '') return {};\n if (size <= TRAFFIC_BODY_CAP && Buffer.byteLength(text) <= TRAFFIC_BODY_CAP)\n return { text };\n const cut = Buffer.from(text).subarray(0, TRAFFIC_BODY_CAP).toString('utf8');\n return { text: cut.replace(/�$/, ''), bytes: size };\n}\n\n/**\n * Fields whose values are credentials a client could present: an access\n * token is what an Authorization header carries, so it is no more kept in\n * a body than in the header. What the flow needs to be read (a code, a\n * PKCE verifier, a client_id) stays.\n */\nconst SECRET_FIELDS = new Set([\n 'access_token',\n 'refresh_token',\n 'id_token',\n 'client_secret',\n 'client_assertion',\n 'assertion',\n 'subject_token',\n 'actor_token'\n]);\n\n/** What a credential's value reads as in a kept body. */\nexport const REDACTED = '(not kept)';\n\nconst SECRET_PAIR = new RegExp(\n `\"(${Array.from(SECRET_FIELDS).join('|')})\"\\\\s*:\\\\s*\"(?:[^\"\\\\\\\\]|\\\\\\\\.)*\"`,\n 'g'\n);\n\n/**\n * A JSON or form body with each credential's value (SECRET_FIELDS, at any\n * depth of a JSON body) replaced by REDACTED. Anything else is returned as\n * it is.\n */\nexport function redacted(text: string | undefined): string | undefined {\n if (!text) return text;\n const trimmed = text.trimStart();\n if (trimmed.startsWith('{') || trimmed.startsWith('[')) {\n let parsed: unknown;\n try {\n parsed = JSON.parse(text);\n } catch {\n // Cut short, say: each \"field\": \"value\" pair is found by pattern.\n return text.replace(\n SECRET_PAIR,\n (_m, k: string) => `\"${k}\":\"${REDACTED}\"`\n );\n }\n let hit = false;\n const walk = (v: unknown): unknown => {\n if (Array.isArray(v)) return v.map(walk);\n if (typeof v !== 'object' || v === null) return v;\n return Object.fromEntries(\n Object.entries(v).map(([k, x]) => {\n if (SECRET_FIELDS.has(k) && typeof x === 'string') {\n hit = true;\n return [k, REDACTED];\n }\n return [k, walk(x)];\n })\n );\n };\n const out = walk(parsed);\n return hit ? JSON.stringify(out) : text;\n }\n if (/^[\\w.~%-]+=/.test(trimmed)) {\n const params = new URLSearchParams(text);\n let hit = false;\n for (const key of params.keys()) {\n if (SECRET_FIELDS.has(key)) {\n params.set(key, REDACTED);\n hit = true;\n }\n }\n return hit ? params.toString() : text;\n }\n return text;\n}\n\n/** The JSON-RPC messages in a body: each one's method and id. */\nexport function rpcOf(body: string | undefined): RpcSummary[] | undefined {\n if (!body) return undefined;\n let parsed: unknown;\n try {\n parsed = JSON.parse(body);\n } catch {\n return undefined;\n }\n const list = Array.isArray(parsed) ? parsed : [parsed];\n const out: RpcSummary[] = [];\n for (const m of list) {\n if (typeof m !== 'object' || m === null) continue;\n const r = m as Record;\n if (r.jsonrpc === undefined && r.method === undefined) continue;\n const id = r.id;\n out.push({\n ...(typeof r.method === 'string' && { method: r.method }),\n ...((typeof id === 'string' || typeof id === 'number' || id === null) && {\n id\n })\n });\n }\n return out.length ? out : undefined;\n}\n\n/** Without the JSON-RPC ids, so two otherwise equal messages compare equal. */\nfunction withoutIds(body: string | undefined): string {\n if (!body) return '';\n try {\n const parsed: unknown = JSON.parse(body);\n const strip = (m: unknown) => {\n if (typeof m !== 'object' || m === null || Array.isArray(m)) return m;\n const rest = { ...(m as Record) };\n delete rest.id;\n return rest;\n };\n return JSON.stringify(\n Array.isArray(parsed) ? parsed.map(strip) : strip(parsed)\n );\n } catch {\n return body;\n }\n}\n\n/**\n * The same request with the same answer, but for JSON-RPC ids and times: a\n * client asking again and again (a server/discover on every reconnect, a\n * poll) makes one row with `repeats`, and a row whose only change is a\n * repeat is not written on its own (see substance()).\n */\nexport function sameExchange(a: Exchange, b: Exchange): boolean {\n return (\n a.lane === b.lane &&\n a.method === b.method &&\n a.path === b.path &&\n a.status === b.status &&\n a.conn === b.conn &&\n a.authorization === b.authorization &&\n a.refused === b.refused &&\n JSON.stringify(a.headers) === JSON.stringify(b.headers) &&\n withoutIds(a.body) === withoutIds(b.body) &&\n withoutIds(a.responseBody) === withoutIds(b.responseBody)\n );\n}\n\n/**\n * The row as it is compared with what was last written: without repeat\n * counts, so asking the same thing again sends no write of its own.\n */\nexport function substance(row: TrafficRow): string {\n return JSON.stringify({\n ...row,\n exchanges: row.exchanges.map((e) => ({ ...e, repeats: undefined }))\n });\n}\n\n/** What kind of credential a request presented or a response issued. */\nexport type CredentialKind = 'token' | 'code' | 'client_id' | 'refresh_token';\n\n/**\n * A credential's keyed hash, as `issued` keeps it: enough to know one again,\n * never enough to use it.\n */\nexport function credentialHash(value: string): string {\n return createHash('sha256')\n .update('hosted-credential\\n')\n .update(value)\n .digest('base64url')\n .slice(0, 22);\n}\n\nfunction parseJson(text: string | undefined): Record {\n if (!text) return {};\n try {\n const v: unknown = JSON.parse(text);\n return typeof v === 'object' && v !== null && !Array.isArray(v)\n ? (v as Record)\n : {};\n } catch {\n return {};\n }\n}\n\n/**\n * The credentials a response hands the client, hashed: a registration's\n * client_id, the code in an authorization redirect, and the access and\n * refresh tokens of a token response.\n */\nexport function issuedBy(\n path: string,\n status: number,\n location: string | undefined,\n body: string | undefined\n): string[] {\n const out: string[] = [];\n if (status >= 200 && status < 300) {\n const json = parseJson(body);\n for (const key of ['access_token', 'refresh_token']) {\n const v = json[key];\n if (typeof v === 'string' && v) out.push(credentialHash(v));\n }\n const route = path.split('?')[0];\n if (route.endsWith('/register') && typeof json.client_id === 'string')\n out.push(credentialHash(json.client_id));\n }\n if (location && status >= 300 && status < 400) {\n try {\n const code = new URL(location, 'http://x').searchParams.get('code');\n if (code) out.push(credentialHash(code));\n } catch {\n // not a URL\n }\n }\n return out;\n}\n\n/** The bearer or DPoP token in an Authorization header. */\nexport function presentedToken(\n authorization: string | undefined\n): string | undefined {\n const m = /^(?:Bearer|DPoP)\\s+(\\S+)/i.exec(authorization ?? '');\n return m?.[1];\n}\n\n/**\n * The first credential in a request that the cell issued before its last\n * reset (`refused` holds their hashes), with its kind: a token in the\n * Authorization header, or a code, refresh token or client_id in the query\n * or the (JSON or form) body. A client_id is refused only where it names the\n * client (the authorization and token endpoints), not in a registration.\n */\nexport function refusedCredential(\n refused: ReadonlySet,\n authorization: string | undefined,\n path: string,\n body: string | undefined,\n contentType: string | undefined\n): CredentialKind | undefined {\n if (!refused.size) return undefined;\n const token = presentedToken(authorization);\n if (token && refused.has(credentialHash(token))) return 'token';\n const q = path.indexOf('?');\n const params = new URLSearchParams(q === -1 ? '' : path.slice(q + 1));\n let fields: Record = Object.fromEntries(params);\n if (body) {\n if (/json/i.test(contentType ?? ''))\n fields = { ...fields, ...parseJson(body) };\n else if (/x-www-form-urlencoded/i.test(contentType ?? ''))\n fields = { ...fields, ...Object.fromEntries(new URLSearchParams(body)) };\n }\n const route = (q === -1 ? path : path.slice(0, q)).replace(/\\/+$/, '');\n const kinds: CredentialKind[] = ['code', 'refresh_token'];\n if (!route.endsWith('/register')) kinds.push('client_id');\n for (const kind of kinds) {\n const v = fields[kind];\n if (typeof v === 'string' && v && refused.has(credentialHash(v)))\n return kind;\n }\n return undefined;\n}\n\n/** What a refused credential is called on the page. */\nexport const REFUSED_TEXT: Record = {\n token: 'an access token',\n code: 'an authorization code',\n refresh_token: 'a refresh token',\n client_id: 'a client registration'\n};\n\n/**\n * The OAuth error the sign-in server answers a refused code, refresh token\n * or client_id with (a token is refused by withholding it from the cell,\n * which then answers its normal 401).\n */\nexport function refusalBody(kind: CredentialKind): {\n error: string;\n error_description: string;\n} {\n const what = REFUSED_TEXT[kind];\n return {\n error: kind === 'client_id' ? 'invalid_client' : 'invalid_grant',\n error_description: `${what} issued before this test cell was reset; start the sign-in again${\n kind === 'client_id' ? ' and register again' : ''\n }`\n };\n}\n\n/**\n * Add `exchange` to `row`: as a repeat of the row's last exchange when it is\n * the same (sameExchange()), else as a new one, unless the row is at its\n * cap, when it is only counted. Returns the exchange the row now holds for\n * it (the earlier one on a repeat), or undefined when it was not kept.\n */\nexport function addExchange(\n row: TrafficRow,\n exchange: Exchange,\n size: { bytes: number }\n): Exchange | undefined {\n const last = row.exchanges[row.exchanges.length - 1];\n if (last && sameExchange(last, exchange)) {\n last.repeats = (last.repeats ?? 0) + 1;\n return last;\n }\n const bytes = JSON.stringify(exchange).length;\n if (\n row.exchanges.length >= TRAFFIC_ROW_EXCHANGES ||\n size.bytes + bytes > TRAFFIC_ROW_BYTES\n ) {\n row.omitted++;\n return undefined;\n }\n size.bytes += bytes;\n row.exchanges.push(exchange);\n return exchange;\n}\n\n/** Note what a response issued in the row, once each. */\nexport function addIssued(row: TrafficRow, hashes: readonly string[]): void {\n for (const h of hashes) if (!row.issued.includes(h)) row.issued.push(h);\n}\n\n/** Every row's exchanges in time order, each said once. */\nexport function mergeRows(rows: Iterable): {\n exchanges: Exchange[];\n omitted: number;\n} {\n const seen = new Set();\n const exchanges: Exchange[] = [];\n let omitted = 0;\n for (const row of rows) {\n omitted += row.omitted;\n for (const e of row.exchanges) {\n const key = JSON.stringify(e);\n if (seen.has(key)) continue;\n seen.add(key);\n exchanges.push(e);\n }\n }\n exchanges.sort((a, b) => a.at.localeCompare(b.at));\n return { exchanges, omitted };\n}\n\n/** How long after an exchange's answer a check it decided may be stamped. */\nconst LINK_SLACK_MS = 250;\n\n/** How far a check may trail an exchange it is tied to by time alone. */\nconst LINK_WINDOW_MS = 2_000;\n\n/**\n * The exchange that decided a check stamped `timestamp`: the latest one\n * under way at that moment (arrived at or before it, answered no more than\n * LINK_SLACK_MS before it), else the latest one that arrived within\n * LINK_WINDOW_MS before it. Scenarios record a check while they handle the\n * request it is about, and the hosted layer as the answer goes out, so the\n * time ties each to its exchange. Returns an index into `exchanges`, which\n * are in time order.\n */\nexport function exchangeFor(\n timestamp: string | undefined,\n exchanges: readonly Exchange[]\n): number | undefined {\n const t = Date.parse(timestamp ?? '');\n if (Number.isNaN(t)) return undefined;\n let fallback: number | undefined;\n for (let i = exchanges.length - 1; i >= 0; i--) {\n const start = Date.parse(exchanges[i].at);\n if (start > t + 2) continue;\n const end = start + (exchanges[i].ms ?? 0);\n if (exchanges[i].ms === undefined || t <= end + LINK_SLACK_MS) return i;\n if (fallback === undefined && t - start <= LINK_WINDOW_MS) fallback = i;\n }\n return fallback;\n}\n\n/** An exchange as one line of `traffic.jsonl`. */\nexport function jsonLine(\n e: Exchange,\n attempt: number,\n n: number,\n conns: ReadonlyMap\n): string {\n const { conn, ...rest } = e;\n return JSON.stringify({\n attempt,\n n,\n ...rest,\n ...(conn !== undefined && { connection: conns.get(conn) })\n });\n}\n\n/** This process, in the connection keys it makes. */\nconst PROCESS = randomBytes(3).toString('hex');\n\n/**\n * Set on a request the hosted layer makes from another (a composite's copy\n * for each of its cells): the connection the original came over.\n */\nexport const CONNECTION = Symbol.for('mcp-conformance.hosted.connection');\n\nconst sockets = new WeakMap();\nlet socketSeq = 0;\n\n/**\n * The connection a request came over, as Exchange.conn keeps it: on the\n * stateful wire, its MCP session when it names one (or `opened`, the one\n * its answer opened); else the socket, when the host has a real one (the\n * stateless wire's session header names no session). Undefined when\n * neither can be told, as behind a fetch-style host.\n */\nexport function connectionOf(\n req: IncomingMessage,\n session?: { stateful: boolean; opened?: string }\n): string | undefined {\n if (session?.stateful) {\n const named = req.headers['mcp-session-id'];\n const id = typeof named === 'string' ? named : session.opened;\n if (id) return `s:${id}`;\n }\n const carried = (req as IncomingMessage & { [CONNECTION]?: string })[\n CONNECTION\n ];\n if (typeof carried === 'string') return carried;\n const socket = req.socket as IncomingMessage['socket'] | undefined;\n if (!socket || socket.remotePort === undefined) return undefined;\n let id = sockets.get(socket);\n if (!id) sockets.set(socket, (id = `t:${PROCESS}.${++socketSeq}`));\n return id;\n}\n\n/** Each connection key numbered 1, 2, … in the order it first appears. */\nexport function connectionNumbers(\n exchanges: readonly Exchange[]\n): Map {\n const out = new Map();\n for (const e of exchanges) {\n if (e.conn !== undefined && !out.has(e.conn)) out.set(e.conn, out.size + 1);\n }\n return out;\n}\n","deleted",false,"label",[47,48,24],"src","hosted","7dcb6042-d92f-40c5-9cc8-0f661f96e58b",["D",1789043604380],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","f4518a30-f52b-4b12-891c-a8fffb7240f8","pinnedFileId","e6dd13e2-ad13-11f1-a612-1607ee4eb77e","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a07c12-b73a-76de-b96a-421ce8582af6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":-5},"org",{"_9":10,"_98":99,"_100":-5,"_58":-5,"_101":102,"_103":44},"branch",{"_37":88,"_11":89,"_22":30,"_90":49,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",396,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","MCP Conformance","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":44,"_145":44,"_146":44,"_147":34,"_148":-5,"_149":-7,"_150":-7,"_151":38,"_152":44,"_153":44,"_154":-5,"_155":44,"_156":44,"_157":44,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]