[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_341":342,"_343":344},"routes/_app.x.$handle.$name",{"_100":99,"_31":44,"_109":90,"_26":110,"_13":14,"_111":-5,"_11":112,"_113":114,"_115":116,"_117":118,"_119":120,"_20":-5,"_121":-5,"_122":-5,"_123":24,"_124":125,"_126":59,"_127":-5,"_128":-5,"_129":130},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":54,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":71,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":83,"_84":85,"_86":87,"_88":24},"version",21,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","src/ui/from-check-record.ts","latestPath","fileId","9329ca82-a63e-11f1-9b04-1607ee4eb77e","name","from-check-record.ts","fileType","script","content","import type {\n CheckRecord,\n CheckResult,\n SiteHealthPageSample,\n SiteHealthSample,\n VisibilityEvidence,\n VisibilityReport,\n} from '../runtime/types.ts'\nimport { PUBLIC_RATE_LIMITED_ERROR_CODE } from '../runtime/types.ts'\nimport type {\n CanonryDemoViewModel,\n CheckFormViewModel,\n QueryEvidenceViewModel,\n SiteHealthFactorViewModel,\n SiteHealthFixViewModel,\n SiteHealthPageViewModel,\n VisibilityViewModel,\n} from './types.ts'\n\nexport interface CheckRecordViewOptions {\n form?: CheckFormViewModel\n displayName?: string\n locale?: string\n title?: string\n}\n\nconst LOCAL_READY_FORM: CheckFormViewModel = {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n verificationStatus: 'not-required',\n submitLabel: 'Check a domain',\n}\n\n/**\n * Converts a sanitized, durable public-check record into the narrow UI model.\n * It deliberately never turns an absent provider report into a 0% score.\n */\nexport function toCanonryDemoViewModel(\n record: CheckRecord | null,\n options: CheckRecordViewOptions = {},\n): CanonryDemoViewModel {\n const domain = record?.domain ?? ''\n const result = record?.result ?? null\n const status = record ? mapStatus(record) : 'empty'\n const resultDomain = result?.domain || domain\n const displayName = options.displayName ?? nameFromDomain(resultDomain || 'Canonry')\n const visibility = result?.visibility ? mapVisibility(result.visibility) : undefined\n const siteHealth = result?.siteHealth ? mapSiteHealth(result.siteHealth, result.generatedAt) : undefined\n\n return {\n status,\n title: options.title,\n displayName,\n domain: resultDomain,\n locale: options.locale,\n form: { ...LOCAL_READY_FORM, ...options.form },\n visibility,\n siteHealth,\n notice: buildNotice(record, result),\n }\n}\n\nfunction mapStatus(record: CheckRecord): CanonryDemoViewModel['status'] {\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) return 'rate-limited'\n switch (record.status) {\n case 'queued':\n case 'running':\n return 'loading'\n case 'partial':\n return 'partial'\n case 'failed':\n return 'error'\n case 'complete':\n return 'ready'\n }\n}\n\nfunction mapVisibility(report: VisibilityReport): VisibilityViewModel {\n const providers = uniqueProviders(report.evidence)\n const denominator = report.summary.successfulChecks\n const mentioned = report.evidence.filter((row) => row.mentioned).length\n const cited = report.evidence.filter((row) => row.cited).length\n const failed = report.summary.failedChecks\n return {\n historyKind: 'snapshot',\n requestedAt: report.startedAt,\n checkedAt: report.completedAt,\n providers,\n summaries: {\n mentioned: {\n rate: percent(report.summary.mentionRate),\n numerator: mentioned,\n denominator,\n },\n cited: {\n rate: percent(report.summary.citationRate),\n numerator: cited,\n denominator,\n },\n },\n completedChecks: denominator,\n requestedChecks: denominator + failed,\n failedChecks: failed,\n evidence: report.evidence.map(mapEvidence),\n notice: failed > 0\n ? {\n tone: 'caution',\n title: `${failed} ${failed === 1 ? 'check' : 'checks'} unavailable`,\n detail: 'Mention and citation rates use completed checks only.',\n }\n : undefined,\n }\n}\n\nfunction uniqueProviders(evidence: readonly VisibilityEvidence[]): VisibilityViewModel['providers'] {\n const seen = new Map()\n for (const row of evidence) {\n if (seen.has(row.provider)) continue\n seen.set(row.provider, {\n id: row.provider,\n label: providerLabel(row.provider),\n model: row.requestedModel ?? undefined,\n })\n }\n return [...seen.values()]\n}\n\nfunction mapEvidence(row: VisibilityEvidence): QueryEvidenceViewModel {\n // The portable probe distinguishes all provider sources from the sources\n // whose URL actually matches the target. Accept the old runtime shape while\n // it rolls forward, but never mark every cited source as a target citation.\n const matchedCitationUrls = new Set(readMatchedCitationUrls(row))\n return {\n id: `${row.provider}:${row.query}:${row.completedAt}`,\n query: row.query,\n provider: row.provider,\n providerLabel: providerLabel(row.provider),\n requestedModel: row.requestedModel,\n servedModel: row.servedModel,\n completedAt: row.completedAt,\n mentioned: row.mentioned,\n cited: row.cited,\n matchedTerms: row.matchedTerms,\n answerText: row.answerText,\n sources: row.sources.map((source) => ({\n url: source.url,\n title: source.title,\n isTargetDomain: matchedCitationUrls.has(source.url),\n })),\n searchQueries: row.searchQueries,\n retrievalStatus: mapRetrievalStatus(row.retrievalStatus),\n error: row.error,\n }\n}\n\nfunction readMatchedCitationUrls(row: VisibilityEvidence): readonly string[] {\n return (row as VisibilityEvidence & { matchedCitationUrls?: readonly string[] }).matchedCitationUrls ?? []\n}\n\nfunction percent(value: number | null): number | null {\n if (value == null || !Number.isFinite(value)) return null\n return Math.max(0, Math.min(100, value * 100))\n}\n\nfunction mapRetrievalStatus(status: VisibilityEvidence['retrievalStatus']): QueryEvidenceViewModel['retrievalStatus'] {\n if (status === 'error') return 'failed'\n if (status === 'grounded') return 'success'\n if (status === 'not-grounded') return 'not-measured'\n return 'pending'\n}\n\nfunction mapSiteHealth(sample: SiteHealthSample, checkedAt: string): NonNullable {\n const complete = sample.pages.filter((page) => page.status === 'success').length\n const failed = sample.pages.filter((page) => page.status === 'error').length\n const attempted = Math.min(5, Math.max(sample.pages.length, sample.pagesObserved))\n return {\n sampleLabel: sample.label,\n score: sample.score,\n discoveredPages: sample.pagesDiscovered,\n attemptedPages: attempted,\n completedPages: complete,\n failedPages: failed,\n checkedAt,\n factors: sample.factors.map((factor) => {\n const state = factorState(sample, factor.id, factor.count)\n return {\n id: factor.id,\n label: factor.name,\n state,\n score: state === 'measured' ? factor.averageScore : null,\n detail: state === 'measured'\n ? `Measured across ${factor.count} sampled ${factor.count === 1 ? 'page' : 'pages'}.`\n : state === 'not-applicable'\n ? 'Not applicable to the sampled page types.'\n : 'Not measured in this sample.',\n }\n }),\n topFixes: topFixes(sample),\n worstPages: sample.pages.map(mapSiteHealthPage),\n terminationReason: sample.terminationReason,\n provenance: {\n schemaVersion: sample.schemaVersion,\n rootUrl: sample.rootUrl,\n finalRootUrl: sample.finalRootUrl,\n attemptedHosts: sample.attemptedHosts,\n engineVersion: readOptionalString(sample, 'engineVersion') ?? readOptionalString(sample, 'crawlEngineVersion'),\n },\n notice: sample.status === 'error' || sample.error\n ? {\n tone: 'caution',\n title: 'Site sample unavailable',\n detail: sample.error ?? 'The Technical AEO sample could not complete.',\n }\n : sample.status === 'partial'\n ? {\n tone: 'caution',\n title: 'Partial site sample',\n detail: 'Only completed pages contribute to the shown evidence.',\n }\n : sample.warnings.length\n ? { tone: 'caution', title: 'Sample warning', detail: sample.warnings[0]! }\n : undefined,\n }\n}\n\nfunction factorState(sample: SiteHealthSample, factorId: string, count: number): SiteHealthFactorViewModel['state'] {\n if (count > 0) return 'measured'\n const sampled = sample.pages.flatMap((page) => page.factors.filter((factor) => factor.id === factorId))\n if (sampled.length > 0 && sampled.every((factor) => factor.applicable === false)) return 'not-applicable'\n return 'unavailable'\n}\n\nfunction readOptionalString(value: object, key: string): string | null {\n const candidate = (value as Record)[key]\n return typeof candidate === 'string' && candidate.trim() ? candidate.trim() : null\n}\n\nfunction mapSiteHealthPage(page: SiteHealthPageSample): SiteHealthPageViewModel {\n const findings = [\n ...page.criticalDefects.map((defect) => defect.detail),\n ...page.factors.flatMap((factor) => factor.findings.map((finding) => finding.message)),\n ...(page.error ? [page.error] : []),\n ].filter(Boolean).slice(0, 6)\n return {\n url: page.url,\n score: page.score,\n status: page.status === 'error' ? 'unavailable' : (page.score ?? 0) >= 80 ? 'good' : 'needs-attention',\n findings,\n indexable: indexability(page.indexability),\n }\n}\n\nfunction topFixes(sample: SiteHealthSample): SiteHealthFixViewModel[] {\n const fixes = new Map\n }>()\n for (const page of sample.pages) {\n for (const defect of page.criticalDefects) {\n addFix(fixes, page.url, defect.recommendation || defect.detail, defect.detail)\n }\n for (const factor of page.factors) {\n for (const recommendation of factor.recommendations) {\n addFix(fixes, page.url, recommendation, factor.name)\n }\n }\n }\n return [...fixes.values()].slice(0, 3).map((fix) => ({\n id: fix.id,\n title: fix.title,\n detail: fix.detail,\n affectedPages: fix.affectedPageUrls.size,\n }))\n}\n\nfunction addFix(\n fixes: Map }>,\n pageUrl: string,\n recommendation: string,\n detail: string,\n): void {\n const title = firstSentence(recommendation || detail)\n const key = title.toLocaleLowerCase('en-US')\n if (!title) return\n const known = fixes.get(key)\n if (known) {\n known.affectedPageUrls.add(pageUrl)\n return\n }\n fixes.set(key, {\n id: `${fixes.size + 1}:${key}`,\n title,\n detail: recommendation && recommendation !== title ? recommendation : detail,\n affectedPageUrls: new Set([pageUrl]),\n })\n}\n\nfunction firstSentence(value: string): string {\n const sentence = value.split(/[.!?]\\s|[.!?]$/)[0] ?? value\n return sentence.trim().slice(0, 110)\n}\n\nfunction indexability(value: string | null): boolean | null {\n if (!value) return null\n if (value === 'eligible' || value === 'indexable') return true\n if (value === 'hidden' || value === 'failed' || value === 'not-indexable') return false\n return null\n}\n\nfunction providerLabel(provider: string): string {\n const known: Record = {\n gemini: 'Gemini',\n openai: 'OpenAI',\n claude: 'Claude',\n perplexity: 'Perplexity',\n }\n return known[provider] ?? (provider ? `${provider.slice(0, 1).toUpperCase()}${provider.slice(1)}` : 'Unknown engine')\n}\n\nfunction buildNotice(record: CheckRecord | null, result: CheckResult | null): CanonryDemoViewModel['notice'] {\n if (!record) return undefined\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) {\n return {\n tone: 'caution',\n title: 'Check limit reached',\n detail: record.errorMessage ?? 'This public sample has reached its current limit. Try again later.',\n }\n }\n if (record.status === 'failed') {\n return {\n tone: 'negative',\n title: 'This check could not finish',\n detail: record.errorMessage ?? 'Try another public domain later.',\n }\n }\n if (result?.errors.length) {\n const first = result.errors[0]!\n return {\n tone: 'caution',\n title: first.area === 'visibility' ? 'Visibility was unavailable' : 'Site sample was unavailable',\n detail: first.message,\n }\n }\n return undefined\n}\n\nfunction nameFromDomain(domain: string): string {\n const host = domain.replace(/^www\\./i, '').split('.')[0] ?? domain\n return host\n .replace(/[-_]+/g, ' ')\n .replace(/\\b\\w/g, (letter) => letter.toUpperCase())\n}\n","createdAt",["D",1788292311210],"branchVersion","branchId","a4524491-dcb3-470a-a361-437a88df6a63","id","b1194860-7c77-41d7-b0b7-f3529a80e15b","AI-Visibility-Check",["D",1788292195151],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Does AI mention your brand and cite your site? Free check.","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/f4d36c97-6af9-485c-0fa5-13e825466c01/square512?exp=1789570799&sig=b8b365c6d498a5a4522e27a75fd89806beff33118e1103a92f289f8490677a9b","891d245e-ec71-404d-a5ca-223733ee2844","pinnedFileId","92ee44ee-a63e-11f1-8fd4-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a0460b-6625-75ce-9e7f-9a6b062b0798","tursoName","b11948607c7741d7b0b7f3529a80e15b","tursoHostname","b11948607c7741d7b0b7f3529a80e15b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789514495229],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_100":99,"_108":104},"org",{"_100":99,"_101":102,"_103":104,"_18":-5,"_105":106,"_107":24},"branch",{"_13":89,"_31":90,"_42":41,"_91":43,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":44,"_98":99},"isOwned",333,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","canonry","handle","displayName","Canonry","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/5ae39d80-0d23-48e5-89d8-6bd2a7096401/square512?exp=1789570799&sig=5b06f1be2f49aa6d0654ea41b696918f193d61c191337909ce18034dcf4e9091","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":336,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":54,"_18":55,"_56":57,"_58":59,"_60":-5,"_61":-5,"_62":63,"_64":65,"_66":67,"_68":69,"_70":337,"_72":-5,"_73":74,"_75":74,"_76":77,"_78":77,"_79":77,"_80":74,"_81":74,"_82":338,"_84":339,"_86":340,"_88":24},"tree",[193,209,210,211,212,213],"files",[193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213],"counts",{"_182":63,"_183":178,"_184":63,"_185":186,"_187":188},"contents",[131,132,133,134,135,136],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":175,"_31":176,"_29":177,"_139":-5,"_40":41,"_39":178,"_141":59,"_37":179,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_26":181},{"_42":168,"_31":169,"_29":170,"_139":-5,"_40":41,"_39":171,"_141":24,"_37":172,"_13":63,"_33":20,"_35":173,"_23":24,"_145":-5,"_26":174},{"_42":161,"_31":162,"_29":163,"_139":-5,"_40":41,"_39":164,"_141":24,"_37":165,"_13":63,"_33":20,"_35":166,"_23":24,"_145":-5,"_26":167},{"_42":154,"_31":155,"_29":156,"_139":-5,"_40":41,"_39":157,"_141":59,"_37":158,"_13":63,"_33":20,"_35":159,"_23":24,"_145":-5,"_26":160},{"_42":147,"_31":148,"_29":149,"_139":-5,"_40":41,"_39":150,"_141":24,"_37":151,"_13":63,"_33":20,"_35":152,"_23":24,"_145":-5,"_26":153},{"_42":137,"_31":138,"_29":57,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":142,"_13":63,"_33":143,"_35":144,"_23":24,"_145":-5,"_26":146},"5188999e-ad25-4c5c-8de9-2938d6984856","main.http.tsx","parentId",15,"latest",["D",1788292310790],"http","import { sqlite } from '@valtown/sqlite'\nimport { createValTownApp } from './src/app/app.ts'\nimport { loadValTownConfig } from './src/config/index.ts'\nimport { createPublicCheckRunner, createRequestBoundDispatcher } from './src/jobs/public-check.ts'\nimport { createSiteHealthRunner } from './src/site-health/runner.ts'\nimport { ValSqliteCheckStore } from './src/storage/val-sqlite.ts'\nimport {\n canonryDemoClientScript,\n canonryDemoStyles,\n createPublicCheckForm,\n demoCanonryViewModel,\n renderCanonryDemo,\n toCanonryDemoViewModel,\n} from './src/ui/index.ts'\nimport { createGeminiValVisibilityProbe } from './src/visibility/gemini-probe.ts'\n\nconst config = loadValTownConfig()\nconst store = new ValSqliteCheckStore(sqlite)\nawait store.initialize()\n\nconst visibilityProbe = config.geminiApiKey\n ? createGeminiValVisibilityProbe({ apiKey: config.geminiApiKey, model: config.geminiModel ?? undefined })\n : null\nconst runner = createPublicCheckRunner({\n store,\n visibilityProbe,\n siteHealthRunner: createSiteHealthRunner(),\n ttlMs: config.checkTtlMs,\n})\n\nconst form = createPublicCheckForm(config)\n\nconst app = createValTownApp({\n store,\n config,\n dispatcher: createRequestBoundDispatcher(runner),\n renderPage: (record) =>\n record\n ? renderCanonryDemo(toCanonryDemoViewModel(record, { form, title: 'Canonry sample' }))\n : renderCanonryDemo({ ...demoCanonryViewModel, form }),\n assets: { styles: canonryDemoStyles, script: canonryDemoClientScript },\n})\n\nexport default app.fetch\n","label",[138],"d96e6cf8-bc82-4972-bc5b-b415d772d5e5","README.md","92e8b0ce-a63e-11f1-91a7-1607ee4eb77e",14,["D",1788292310785],"# AEO Check — a Canonry sample on Val Town\n\nThis directory contains **AEO Check** (`canonry/aeo-check`), a free, bounded public sample of Canonry. Git is the\nsource for every file in the Val.\n\nIt is deliberately not called Canonry: one check is 3 generated non-brand queries against Gemini plus a 5-page audit,\nwhile Canonry tracks Gemini, ChatGPT, Claude, and Perplexity on a schedule with no such limits. Every surface — header\nbyline, footer, MCP `initialize` instructions, the `self_host` tool, and the bundled skills — points back at the\nopen-source project at [github.com/Canonry/canonry](https://github.com/Canonry/canonry).\n\nThe sample uses one Canonry interface for two reports:\n\n- **AI Visibility** shows a sample trend, fresh Gemini results, and source evidence for each query.\n- **Site Health** shows a bounded Technical AEO score, factors, fixes, and page evidence.\n\nThe same data is also served to agents over MCP at `POST /mcp`, together with the bundled `canonry` and `aero` skills.\n\nThe four-engine trend contains labeled sample data. A fresh domain check contains one real Gemini snapshot and no\ninvented history.\n\n## Architecture\n\n```mermaid\nflowchart LR\n B[Browser] --> H[Val Town Deno host]\n H --> V[Val-local visibility core]\n H --> A[@canonry/aeo-audit]\n V --> G[Gemini: 1 plan + 3 queries]\n A --> C[5-page site sample]\n G --> S[Sanitized check result]\n C --> S\n S --> Q[Val-scoped SQLite]\n Q --> B\n Q --> M[MCP endpoint /mcp]\n K[canonry + aero skills] --> M\n M --> N[Any MCP client]\n```\n\nThe Deno host owns HTTP routes, Turnstile, quotas, cache records, job leases, and HTML. Technical AEO comes from the\npinned audit engine. This Val owns the visibility contracts, bounded evidence runner, Gemini planner, and Gemini adapter.\nThe visibility core does not read environment, storage, or HTTP state.\n\n## Directory map\n\n```text\napps/val-town/\n├── main.http.tsx Val HTTP entry\n├── deno.json Production imports and Deno tasks\n├── deno.lock Deno dependency lock\n├── .vt/state.json Val and branch identity\n├── src/\n│ ├── app/ HTTP routes and response policy\n│ ├── config/ Environment configuration\n│ ├── jobs/ Request-bound check runner\n│ ├── mcp/ MCP transport, tools, and generated skill resources\n│ ├── security/ URL and Turnstile checks\n│ ├── site-health/ Technical AEO adapter\n│ ├── storage/ SQLite and memory ports\n│ ├── ui/ Canonry HTML, CSS, and browser script\n│ └── visibility/ Local contracts, evidence runner, Gemini planner and adapter\n└── test/ Deno backend and UI tests\n```\n\n## Connect an agent\n\n`POST /mcp` speaks the Model Context Protocol over Streamable HTTP. Point any MCP client at the Val's `/mcp` URL; no\ncredential is required, because everything it serves is already public.\n\n```json\n{ \"mcpServers\": { \"aeo-check\": { \"url\": \"https:///mcp\" } } }\n```\n\nIt exposes six read tools — `get_check`, `get_ai_visibility`, `get_site_health`, `list_skills`, `read_skill`,\n`self_host` — plus `start_check`, and serves all 16 `canonry` and `aero` skill documents as MCP resources, entry points first. An agent\nreads the entry point for how to interpret coverage, then opens the reference the task calls for, exactly as it would\nin a local install.\n\nReads address a check by `checkId` or by `domain` and never spend: a domain resolves to the most recent cached check,\nor reports a miss. `start_check` runs a fresh one and blocks until it finishes, up to about 45 seconds, because\nexecution is request-bound and there is no background queue.\n\n`start_check` skips Turnstile, which an agent cannot solve, and spends from its own daily bucket\n(`CANONRY_MCP_PER_CLIENT_DAILY_LIMIT`, default 2) keyed on the caller's edge IP. It shares the same global daily cap\nand the same single execution lease as the browser, so MCP widens who may spend the budget, never how large it is. A\ndomain checked within the cache TTL returns immediately at no cost. Set `CANONRY_MCP_START_CHECKS=0` to remove the\ntool entirely.\n\nBoth protocol revisions work: the sessionless `2026-07-28` transport and the older `initialize` handshake that current\nclients still use.\n\n`src/mcp/skills/` is generated from `skills/` at the repository root — Val Town caps a file at 80,000 characters and\n`canonry-cli.md` is over it, so the mirror chunks each document. Run `node scripts/sync-val-town-skills.mjs` after\nediting a skill and commit the result; `--check` fails on drift.\n\n## Fixed public limits\n\n- One grounded Gemini planning call creates three non-brand queries.\n- Three Gemini checks run with a concurrency limit of two.\n- The site sample checks at most five pages and 2,500 edges.\n- The full request stops after 45 seconds.\n- Turnstile, daily quotas, one active job, and a 24-hour cache bound public use.\n\nThe host never sets `allowPrivateHost`. Failed provider checks stay `Not measured` and do not reduce the reported rates.\n\n## Run it locally\n\n```sh\ncd apps/val-town\ndeno task dev # http://localhost:8787 — stub runners, no network\nGEMINI_API_KEY=… deno task dev # real Gemini planner, probes, and crawl\n```\n\nIn-memory storage and no Turnstile, so the UI and `/mcp` both work without credentials. Smoke-test the endpoint with:\n\n```sh\ncurl -s localhost:8787/mcp -H 'content-type: application/json' \\\n -d '{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"tools/list\"}'\n```\n\nOr drive it from a real client: `npx @modelcontextprotocol/inspector`, then connect to\n`http://localhost:8787/mcp` over Streamable HTTP.\n\n## Local checks\n\n```sh\nnode scripts/sync-val-town-skills.mjs --check # from the repository root\n\ncd apps/val-town\nnpx --yes deno@2.7.5 check --allow-import --frozen --config deno.json main.http.tsx\nnpx --yes deno@2.7.5 lint --config deno.json main.http.tsx src test\nnpx --yes deno@2.7.5 test --allow-env --allow-net --allow-import --frozen --config deno.json test\n```\n\n## Production configuration\n\nSet these environment variables in Val Town:\n\n- `VAL_TOWN_ENV=production`\n- `GEMINI_API_KEY`\n- `CANONRY_QUOTA_SALT`\n- `TURNSTILE_SECRET_KEY`\n- `TURNSTILE_SITE_KEY`\n- `TURNSTILE_ALLOWED_HOSTNAMES`\n\nOptional: `CANONRY_MCP_START_CHECKS=0` disables MCP-started checks; `CANONRY_MCP_PER_CLIENT_DAILY_LIMIT` sets their\ndaily per-caller allowance (default 2).\n\nThe host disables public checks when the production quota salt or Turnstile configuration is absent.\n\n## Release order\n\n1. Regenerate `deno.lock` with `deno.json`, and the skill mirror with `node scripts/sync-val-town-skills.mjs`.\n2. Run the local checks.\n3. Run `vt push --dry-run` from this directory.\n4. Review the file plan.\n5. Run `vt push` only after approval.\n6. Request `/healthz` and make sure that it returns `{\"ok\":true}`.\n\n`vt push` makes the Val match this directory. It deletes remote-only files, so do not edit production in the Val Town\neditor.\n",[148],"655360bd-bc32-4a60-b9ab-c9156f924695","CLAUDE.md","930d2c42-a63e-11f1-8d00-1607ee4eb77e",18,["D",1788292310988],"@AGENTS.md\n",[155],"45bc70da-b408-45c0-826b-7bd5c2e0dc27","AGENTS.md","92f64d1a-a63e-11f1-8d00-1607ee4eb77e",16,["D",1788292310802],"# AEO Check (Val Town)\n\nThis directory is the exact source mirrored to the public `canonry/aeo-check` val. Git is authoritative; do not make\nproduction-only edits in Val Town because `vt push` removes remote-only files.\n\n## Naming\n\nThe Val is **AEO Check**, not Canonry. It runs 3 generated queries against one engine and audits 5 pages; Canonry\ntracks four engines on a schedule with no such limits. Calling this \"Canonry\" would tell a visitor — or an agent\nreading `serverInfo` — that they had the platform when they have a sample of it, so the product name, the val name,\nand the MCP `serverInfo.name` all say `aeo-check`.\n\nAttribution runs the other way, and deliberately: every surface points back at the open-source project. The header\nbyline, the footer (with the install command), the MCP `initialize` instructions, the `self_host` tool, and the\nbundled skills all name Canonry and link to it. Keep that; a sample that does not lead anywhere is just a toy.\n\n## Boundaries\n\n- Keep the host Deno-native and web-standard. Do not import the Node Canonry server, Fastify, `better-sqlite3`, or the\n Vite dashboard.\n- Import reusable engines through exact pins. Technical AEO uses `@canonry/aeo-audit`; AI Visibility is implemented\n locally under `src/visibility/` so this Val owns its Gemini planner, adapter, and evidence runner.\n- The browser never receives provider, Turnstile-secret, deployment, or signing credentials.\n- Anonymous work is bounded by human verification, atomic quotas, cache reuse, output clipping, and hard provider/crawl\n deadlines.\n- Never set `allowPrivateHost`. Keep Technical AEO labeled as a bounded page sample, not a whole-site score.\n- Mention and citation are independent signals. Summary denominators contain successful checks only; failures stay\n visible.\n- The visibility core (`contracts`, `runtime`, `brand`, `runner`) must not read environment, storage, or HTTP state.\n Only the Gemini adapter makes provider calls; the host owns credentials, quotas, and scheduling.\n- Demo history must be explicitly labeled sample data. A fresh check is a snapshot until real history exists.\n- Never present the Val as the full platform. Bounds stay stated on the surface that shows the number.\n- `src/mcp/skills/` is generated. Edit `skills//` at the repository root, then run\n `node scripts/sync-val-town-skills.mjs` and commit the result. Never hand-edit a generated module.\n\n## MCP endpoint\n\n`POST /mcp` serves Model Context Protocol over Streamable HTTP so an agent can read this Val's checks directly. It is\nadditive: every browser route is unchanged, and the endpoint shares the same `CheckStore`, so an agent sees exactly the\nchecks the UI shows.\n\n- **Reads never spend.** `get_check`, `get_ai_visibility`, and `get_site_health` resolve through `store.get` and\n `store.findReusable` only. They must never reach `admit` or `dispatch`; a test asserts an uncached domain lookup\n leaves the store untouched.\n- **`start_check` is the only tool that spends,** and it runs the host's full admission path. It skips Turnstile,\n which an agent cannot solve, and spends from its own `mcp:` quota subject with its own daily limit. It must keep\n sharing the global daily cap and the single execution lease: the global cap is what bounds the bill, so MCP may\n widen who spends the budget but never how large it is. Disable with `CANONRY_MCP_START_CHECKS=0`.\n- **It blocks.** Execution is request-bound (`AbortSignal.timeout(45_000)`); there is no background queue, so\n returning a check ID early would kill the work with the request.\n- **Anonymous, on purpose.** Everything reachable here is already public: `/api/checks/:id` serves any check without a\n credential, and the skills ship in a public npm package. A token would gate nothing and would make the endpoint\n useless as something an agent is simply pointed at.\n- **Two protocol eras.** Revision `2026-07-28` removed sessions and the GET stream; every shipping client still opens\n with `initialize`. Both work. Keep the strict mirrored-header checks keyed off the version the caller declared, or\n legacy clients break.\n- Responses are always `application/json`. Nothing here streams, so do not add an SSE encoder.\n- `self_host` is the conversion path and costs nothing. Keep it in the read set and keep its comparison honest.\n- Mention and citation stay independent in tool output, and a failed check stays `null` rather than becoming `false`.\n\n## UI\n\nMatch the Canonry dashboard's restrained evidence-first hierarchy: compact header, underline tabs,\ncharts/tables/details, visible focus, and native disclosure controls. Do not port the full React SPA or add a card grid.\n\n## Verification\n\nRun `deno task check`, `deno task lint`, and `deno task test` from this directory, and\n`node scripts/sync-val-town-skills.mjs --check` from the repository root. A deployment additionally requires a\n`vt push --dry-run` and a live health smoke test.\n",[162],"32515d7c-b260-427a-af1a-f218e7d2f15a",".vtignore","92ff2520-a63e-11f1-91a7-1607ee4eb77e",17,["D",1788292310911],".env\n.env.*\ncoverage/\ntest/\n",[169],"70fabb5a-32a8-428a-9a8c-08292618dd57","src","91c8aac8-a63e-11f1-b64b-1607ee4eb77e",1,["D",1788292308897],"directory",[176],"pulls","branches","forks","envVars",{"_189":191,"_192":63},"connections",{"_189":63,"_190":63},"count","unfilledCount",7,"emptyCount",{"_42":175,"_31":176,"_29":177,"_139":-5,"_40":41,"_39":178,"_141":59,"_37":333,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":334,"_26":335},{"_42":326,"_31":327,"_29":328,"_139":177,"_40":41,"_39":329,"_141":59,"_37":330,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":331,"_26":332},{"_42":319,"_31":320,"_29":321,"_139":177,"_40":41,"_39":322,"_141":24,"_37":323,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":324,"_26":325},{"_42":312,"_31":313,"_29":314,"_139":177,"_40":41,"_39":315,"_141":24,"_37":316,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":317,"_26":318},{"_42":305,"_31":306,"_29":307,"_139":177,"_40":41,"_39":308,"_141":59,"_37":309,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":310,"_26":311},{"_42":300,"_31":299,"_29":294,"_139":177,"_40":41,"_39":301,"_141":59,"_37":302,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":303,"_26":304},{"_42":291,"_31":292,"_29":293,"_139":294,"_40":41,"_39":295,"_141":24,"_37":296,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":297,"_26":298},{"_42":285,"_31":286,"_29":287,"_139":177,"_40":41,"_39":191,"_141":59,"_37":288,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":289,"_26":290},{"_42":278,"_31":279,"_29":280,"_139":177,"_40":41,"_39":281,"_141":24,"_37":282,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":283,"_26":284},{"_42":271,"_31":272,"_29":273,"_139":177,"_40":41,"_39":274,"_141":59,"_37":275,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":276,"_26":277},{"_42":264,"_31":265,"_29":266,"_139":177,"_40":41,"_39":267,"_141":24,"_37":268,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":269,"_26":270},{"_42":259,"_31":246,"_29":240,"_139":177,"_40":41,"_39":260,"_141":59,"_37":261,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":262,"_26":263},{"_42":251,"_31":252,"_29":253,"_139":240,"_40":41,"_39":254,"_141":24,"_37":255,"_13":63,"_33":34,"_35":256,"_23":24,"_145":-5,"_215":257,"_26":258},{"_42":247,"_31":32,"_29":30,"_139":240,"_40":41,"_39":14,"_141":24,"_37":248,"_13":63,"_33":34,"_35":36,"_23":24,"_145":-5,"_215":249,"_26":250},{"_42":237,"_31":238,"_29":239,"_139":240,"_40":41,"_39":241,"_141":24,"_37":242,"_13":63,"_33":34,"_35":243,"_23":24,"_145":-5,"_215":244,"_26":245},{"_42":230,"_31":231,"_29":232,"_139":177,"_40":41,"_39":233,"_141":24,"_37":234,"_13":63,"_33":180,"_35":-5,"_23":24,"_145":-5,"_215":235,"_26":236},{"_42":168,"_31":169,"_29":170,"_139":-5,"_40":41,"_39":171,"_141":24,"_37":227,"_13":63,"_33":20,"_35":173,"_23":24,"_145":-5,"_215":228,"_26":229},{"_42":161,"_31":162,"_29":163,"_139":-5,"_40":41,"_39":164,"_141":24,"_37":224,"_13":63,"_33":20,"_35":166,"_23":24,"_145":-5,"_215":225,"_26":226},{"_42":154,"_31":155,"_29":156,"_139":-5,"_40":41,"_39":157,"_141":59,"_37":221,"_13":63,"_33":20,"_35":159,"_23":24,"_145":-5,"_215":222,"_26":223},{"_42":147,"_31":148,"_29":149,"_139":-5,"_40":41,"_39":150,"_141":24,"_37":218,"_13":63,"_33":20,"_35":152,"_23":24,"_145":-5,"_215":219,"_26":220},{"_42":137,"_31":138,"_29":57,"_139":-5,"_40":41,"_39":140,"_141":24,"_37":214,"_13":63,"_33":143,"_35":144,"_23":24,"_145":-5,"_215":216,"_26":217},["D",1788292310790],"children",[],[138],["D",1788292310785],[],[148],["D",1788292310988],[],[155],["D",1788292310802],[],[162],["D",1788292310911],[],[169],"7093d43c-bb87-4fe5-82ad-1c7711051c31","visibility","92153f82-a63e-11f1-8621-1607ee4eb77e",4,["D",1788292309391],[],[176,231],"b9daa5e5-0737-4b14-b647-904b6d187cb0","types.ts","931ff2a0-a63e-11f1-b64b-1607ee4eb77e","91e63a7a-a63e-11f1-9a7d-1607ee4eb77e",20,["D",1788292311121],"/**\n * The public Val Town page consumes this intentionally small, serializable\n * view model. The runtime maps normalized Canonry results into it; this layer\n * never reads secrets, provider payloads, or storage directly.\n */\n\nexport type DemoUiStatus =\n | 'demo'\n | 'ready'\n | 'loading'\n | 'partial'\n | 'error'\n | 'rate-limited'\n | 'empty'\n\nexport type VisibilityMetric = 'mentioned' | 'cited'\nexport type EvidenceState = 'success' | 'pending' | 'failed' | 'not-measured'\n\nexport interface UiAction {\n label: string\n href?: string\n /** Submit action when the action is represented by the public check form. */\n formAction?: string\n}\n\nexport interface UiNotice {\n title: string\n detail: string\n tone: 'neutral' | 'positive' | 'caution' | 'negative'\n action?: UiAction\n}\n\nexport interface ProviderDescriptor {\n id: string\n label: string\n /** Requested model, never inferred from a response. */\n model?: string\n color?: string\n}\n\nexport interface VisibilityTrendPoint {\n /** Human-readable bucket label, for example \"May 06\". */\n label: string\n observedAt?: string\n values: Record>>\n}\n\nexport interface VisibilitySummaryMetric {\n /** 0..100 only when denominator is known. */\n rate: number | null\n numerator: number\n denominator: number\n deltaPoints?: number | null\n}\n\nexport interface EvidenceSource {\n url: string\n title?: string | null\n /** Whether the source URL belongs to the checked domain. */\n isTargetDomain?: boolean\n}\n\nexport interface QueryEvidenceViewModel {\n id: string\n query: string\n provider: string\n providerLabel?: string\n requestedModel?: string | null\n servedModel?: string | null\n completedAt?: string | null\n /** A null signal means unavailable, never false. */\n mentioned: boolean | null\n /** A null signal means unavailable, never false. */\n cited: boolean | null\n matchedTerms?: readonly string[]\n answerText?: string | null\n sources?: readonly EvidenceSource[]\n searchQueries?: readonly string[]\n retrievalStatus?: EvidenceState\n error?: string | null\n}\n\nexport interface VisibilityViewModel {\n /** Demo history is explicitly synthetic. Fresh live work is a snapshot. */\n historyKind: 'demo-history' | 'snapshot'\n checkedAt?: string | null\n requestedAt?: string | null\n providers: readonly ProviderDescriptor[]\n summaries: Record\n trend?: readonly VisibilityTrendPoint[]\n evidence: readonly QueryEvidenceViewModel[]\n /** Successful checks only are the denominator for the summary rates. */\n completedChecks: number\n requestedChecks: number\n failedChecks?: number\n notice?: UiNotice\n}\n\nexport type SiteHealthFactorState = 'measured' | 'not-applicable' | 'unavailable'\n\nexport interface SiteHealthFactorViewModel {\n id: string\n label: string\n state: SiteHealthFactorState\n score: number | null\n detail: string\n}\n\nexport type PageHealthStatus = 'good' | 'needs-attention' | 'unavailable'\n\nexport interface SiteHealthPageViewModel {\n url: string\n score: number | null\n status: PageHealthStatus\n findings: readonly string[]\n indexable?: boolean | null\n}\n\nexport interface SiteHealthFixViewModel {\n id: string\n title: string\n detail: string\n affectedPages?: number | null\n}\n\nexport interface SiteHealthProvenanceViewModel {\n /** Crawl-result schema retained so the bounded sample remains traceable. */\n schemaVersion?: string | null\n /** Requested and resolved crawl roots distinguish a redirect from a source URL. */\n rootUrl?: string | null\n finalRootUrl?: string | null\n /** Hosts the bounded runner actually attempted, in order. */\n attemptedHosts?: readonly string[]\n /** Optional engine identity when the host makes it available. */\n engineVersion?: string | null\n}\n\nexport interface SiteHealthViewModel {\n /** Must remain an honest bounded-sample label in the public demo. */\n sampleLabel: string\n score: number | null\n /** URLs found by the bounded crawl, not a total site-page count. */\n discoveredPages: number\n attemptedPages: number\n completedPages: number\n failedPages: number\n checkedAt?: string | null\n factors: readonly SiteHealthFactorViewModel[]\n topFixes: readonly SiteHealthFixViewModel[]\n worstPages: readonly SiteHealthPageViewModel[]\n /** Durable reason a bounded crawl ended before completion, never synthesized. */\n terminationReason?: string | null\n provenance?: SiteHealthProvenanceViewModel\n notice?: UiNotice\n}\n\nexport interface CheckFormViewModel {\n action: string\n method?: 'get' | 'post'\n /** Field read by the server-side verifier. Never render a secret in this model. */\n verificationFieldName?: string\n /** A public Cloudflare Turnstile site key. Omit it for local/test bypasses. */\n turnstileSiteKey?: string | null\n /** `audit` is intentionally fixed so the server can reject action mismatches. */\n turnstileAction?: 'audit'\n /** Production without a configured verifier is truthfully disabled. */\n verificationStatus?: 'ready' | 'not-required' | 'unavailable'\n verificationUnavailableMessage?: string\n submitLabel?: string\n}\n\nexport interface CanonryDemoViewModel {\n status: DemoUiStatus\n title?: string\n displayName: string\n domain: string\n locale?: string\n form?: CheckFormViewModel\n visibility?: VisibilityViewModel\n siteHealth?: SiteHealthViewModel\n notice?: UiNotice\n}\n",[],[176,246,238],"ui","6b5562ec-bdd4-495a-93a1-30472a334cc6",["D",1788292311210],[],[176,246,32],"bdd01eca-55df-4b2d-8bff-52e3ec3f77da","check-form.ts","9316a416-a63e-11f1-8fd4-1607ee4eb77e",19,["D",1788292311023],"import type { ValTownConfig } from '../config/index.ts'\nimport type { CheckFormViewModel } from './types.ts'\n\ntype PublicCheckFormConfig = Pick<\n ValTownConfig,\n | 'publicChecksEnabled'\n | 'publicChecksUnavailableMessage'\n | 'humanVerificationStatus'\n | 'turnstileSiteKey'\n>\n\n/** Builds the public form from the complete admission capability, not CAPTCHA alone. */\nexport function createPublicCheckForm(config: PublicCheckFormConfig): CheckFormViewModel {\n const unavailable = !config.publicChecksEnabled\n return {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n turnstileSiteKey: unavailable ? null : config.turnstileSiteKey,\n turnstileAction: 'audit',\n verificationStatus: unavailable ? 'unavailable' : config.humanVerificationStatus,\n verificationUnavailableMessage: unavailable\n ? config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.'\n : 'Human verification is not configured. Public checks are disabled.',\n submitLabel: 'Check a domain',\n }\n}\n",[],[176,246,252],"860a6741-04fd-4cac-81b8-88fa850c061e",2,["D",1788292309086],[205,206,207],[176,246],"01568ee8-b51f-43e3-8630-3492a546a4c6","storage","927bf83a-a63e-11f1-8d00-1607ee4eb77e",9,["D",1788292310084],[],[176,265],"9872971b-6df7-4db3-a940-d575fb5071df","site-health","92bd6c2a-a63e-11f1-9f99-1607ee4eb77e",12,["D",1788292310513],[],[176,272],"b8bce09a-c6af-4a10-812e-6d794b08426b","security","92429036-a63e-11f1-9a7d-1607ee4eb77e",6,["D",1788292309698],[],[176,279],"eb2d53de-7095-4756-867a-252fd03349cc","runtime","9256932e-a63e-11f1-9a7d-1607ee4eb77e",["D",1788292309828],[],[176,286],"b605cbd6-3f6c-41a7-9331-771bbb222029","skills","92d014b0-a63e-11f1-8fd4-1607ee4eb77e","9269bbca-a63e-11f1-8d00-1607ee4eb77e",13,["D",1788292310636],[],[176,299,292],"mcp","ae91bccc-3e31-4356-834f-cb508c834a4f",8,["D",1788292309949],[199],[176,299],"96780fc5-c060-4b02-86a2-4b51b47199f6","jobs","92af4352-a63e-11f1-9f99-1607ee4eb77e",11,["D",1788292310414],[],[176,306],"6ddf4a2e-04bf-4c6c-bba6-3dc1c98830a9","fixtures","929d710e-a63e-11f1-8621-1607ee4eb77e",10,["D",1788292310299],[],[176,313],"5b29d0bc-67f9-4641-abd9-7035be8a9b71","config","92281dc8-a63e-11f1-8621-1607ee4eb77e",5,["D",1788292309530],[],[176,320],"099c2e2e-a5d0-494f-ae81-754dd43458ad","app","91f8f4bc-a63e-11f1-8621-1607ee4eb77e",3,["D",1788292309199],[],[176,327],["D",1788292308897],[194,195,196,197,198,200,201,202,203,204,208],[176],["D",1788292195151],["D",1789514495229],{"_100":99,"_108":104},{"_100":99,"_101":102,"_103":104,"_18":-5,"_105":106,"_107":24},{"_13":89,"_31":90,"_42":41,"_91":43,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":-5,"_97":44,"_98":99},"ctx",{"_82":-5,"_128":374,"_375":376,"_377":378,"_379":24,"_380":24,"_381":24,"_382":59,"_383":-5,"_384":-7,"_385":-7,"_386":63,"_387":24,"_388":24,"_389":-5,"_390":24,"_391":24,"_392":24,"_393":-5},"ENV",{"_345":346,"_347":348,"_349":90,"_350":351,"_352":353,"_354":355,"_356":357,"_358":359,"_360":361,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371,"_372":373},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21