` per row opens every verified sentence, the concerns,\n the typed sources, the searches the engine ran, and the full answer.\n3. **Concerns raised** — phrase plus \"in N of M answers\". An empty list is STATED, not omitted: \"no concern was raised\"\n is a finding, and a missing section reads as a broken page.\n4. **Sources the engine attributed** — by kind, counted once per answer, with the share and the unattributed remainder\n stated separately.\n\nOther rules the tests hold:\n\n- **Heavy explanation lives in tooltips, not inline prose.** Each section heading carries a CSS-only `info-tip`: a real\n `${\n escapeHtml(copy)\n }`\n}\n\n/**\n * One tone vocabulary for the whole page. The badge and the KPI cell read the\n * SAME `verdictTone`, so the colour of \"Cautions\" cannot be rose in one place\n * and amber in the other — which is what happens when a renderer decides tone\n * a second time.\n */\nconst VERDICT_TONE_CLASS = {\n positive: 'signal-positive',\n negative: 'signal-negative',\n caution: 'signal-caution',\n neutral: 'signal-neutral',\n} as const\n\nconst VERDICT_GLYPH = { recommends: '✓', cautions: '!', mixed: '~', none: '−' } as const\n\n/** A verdict badge, never a score. An unmeasured row is dimmed, not toned. */\nfunction verdictBadge(answer: PerceptionAnswerViewModel): string {\n const glyph = answer.verdict === null ? '?' : VERDICT_GLYPH[answer.verdict]\n const className = answer.verdict === null ? 'signal-unavailable' : VERDICT_TONE_CLASS[answer.verdictTone]\n return `${glyph}${\n escapeHtml(answer.verdictLabel)\n }`\n}\n\n/**\n * The headline cell.\n *\n * A measured verdict quotes the answer's own first verified sentence. `none`\n * gets a statement of what happened, and an unmeasured row gets the reason it\n * was not measured — the row already says \"Not measured\", and the question a\n * reader then asks is \"why\".\n */\nfunction answerHeadlineCell(answer: PerceptionAnswerViewModel): string {\n if (answer.verdict === null) {\n return `${escapeHtml(answer.error ?? 'This answer was not measured.')}`\n }\n if (answer.headline) {\n return `${escapeHtml(answer.headline)}`\n }\n return 'The answer described the brand without taking a position.'\n}\n\nfunction renderSource(source: PerceptionSourceViewModel): string {\n const url = safeUrl(source.url)\n const title = source.title?.trim() || (url ? safeHost(url) : 'Unavailable source')\n const host = url ? safeHost(url) : source.domain\n const meta = `${escapeHtml(host ?? 'Unattributed host')} · ${escapeHtml(source.typeLabel)}`\n if (!url) {\n return `

${escapeHtml(title)}${meta}

`\n }\n return `

${\n escapeHtml(title)\n }${meta}

`\n}\n\nfunction renderAnswerDetails(answer: PerceptionAnswerViewModel): string {\n const quotes = answer.evidenceSentences.length\n ? `

What the answer said

${escapeHtml(sentence)}

`\n : `

What the answer said

${\n answer.verdict === null\n ? 'This answer was not measured, so nothing was read out of it.'\n : 'No sentence in this answer took a position on the brand.'\n }

`\n const concerns = answer.concerns.length\n ? `

Concerns this answer raised

${escapeHtml(concern)}

`\n : ''\n const sources = answer.sources.length\n ? `

${answer.sources.map(renderSource).join('')}`\n : `

${\n answer.verdict === null\n ? 'This answer was not measured, so no source was attributed to it.'\n : 'The engine attributed no source to this answer.'\n }

`\n const searches = answer.searchQueries.length\n ? `

Searches the engine ran${\n escapeHtml(answer.searchQueries.join(', '))\n }

`\n : ''\n const models = [\n answer.requestedModel ? `Requested: ${escapeHtml(answer.requestedModel)}` : '',\n answer.servedModel ? `Served: ${escapeHtml(answer.servedModel)}` : '',\n answer.completedAt && formatTime(answer.completedAt)\n ? `Completed: ${escapeHtml(formatTime(answer.completedAt)!)}`\n : '',\n ].filter(Boolean).join('')\n const answerText = answer.answerText\n ? `

Full answer

${\n escapeHtml(clip(answer.answerText))\n }

`\n : '

Answer text was not retained for this result.

'\n const error = answer.error\n ? `

Not measured${escapeHtml(answer.error)}

`\n : ''\n return `\n

View evidence

${models}

\n ${quotes}${concerns}${error}\n

Sources

${sources}

\n ${searches}\n ${answerText}\n

`\n}\n\n/**\n * The headline row.\n *\n * Flat KPI cells, never progress bars: \"2 of 3 answers\" has no target to fill,\n * and a bar would invent one. The denominator is written under every number\n * rather than once at the top, because the number and the bound it rests on\n * have to be read together.\n */\nfunction renderVerdictSnapshot(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const checkedAt = formatTime(perception.checkedAt)\n const cells = perception.verdicts.map((verdict) =>\n `

${escapeHtml(verdict.label)}

${\n measured === 0\n ? '

Not measured

'\n : `

${verdict.count}

`\n }${\n measured === 0 ? 'No answer was measured' : `of ${measured} ${plural(measured, 'answer', 'answers')}`\n }

`\n ).join('')\n return `\n

Verdict snapshot${renderInfoTip(VERDICT_TIP)}

\n ${checkedAt ? `

Checked ${escapeHtml(checkedAt)}

` : ''}\n

${perception.requestedAnswers} branded ${\n plural(perception.requestedAnswers, 'question', 'questions')\n }Gemini${measured} measured

${cells}\n

`\n}\n\nfunction renderAnswers(perception: PerceptionViewModel): string {\n const rows = perception.answers.map((answer) => `\n \n ${escapeHtml(answer.query)}\n ${verdictBadge(answer)}\n ${answerHeadlineCell(answer)}\n ${\n // An unmeasured answer has no sources because there is no answer, not\n // because the engine attributed none. A 0 here would be a measured zero.\n answer.verdict === null\n ? 'not measured'\n : answer.sources.length\n }\n ${renderAnswerDetails(answer)}\n `).join('')\n const empty =\n '

No answers were recorded

Answers appear once the engine replies to a branded question.

'\n return `\n

Answers${renderInfoTip(ANSWERS_TIP)}

\n ${perception.notice ? renderNotice(perception.notice) : ''}\n ${\n perception.answers.length\n ? `

${rows}

Branded question	Verdict	What the answer said	Sources	Evidence

`\n : empty\n }\n

`\n}\n\nfunction renderConcerns(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const body = perception.concerns.length\n ? `

${escapeHtml(concern.phrase)}in ${concern.answers} of ${measured} ${\n plural(measured, 'answer', 'answers')\n }

`\n : `

${\n measured === 0\n ? 'No answer was measured, so no concern could be read out of one.'\n : `No concern was raised in the ${measured} ${plural(measured, 'answer', 'answers')} measured.`\n }

`\n return `\n

Concerns raised${\n renderInfoTip(CONCERNS_TIP)\n }

\n ${body}\n

`\n}\n\nfunction renderSourceTypes(perception: PerceptionViewModel): string {\n const share = perception.sourceTypes\n const body = share\n ? `

${\n share.entries.map((entry) =>\n ``\n ).join('')\n }

Kind of source	Answers	Share
${escapeHtml(entry.label)}	${entry.answers} of ${share.measuredAnswers}	${entry.percent}%

${\n share.unattributedAnswers > 0\n ? `

${share.unattributedAnswers} measured ${\n plural(share.unattributedAnswers, 'answer', 'answers')\n } attributed no source at all, and ${\n plural(share.unattributedAnswers, 'is', 'are')\n } excluded from the share.

`\n : ''\n }`\n : `

${\n perception.measuredAnswers === 0\n ? 'No answer was measured, so no source could be attributed.'\n : 'No measured answer attributed a source.'\n }

`\n return `\n

Sources the engine attributed${\n renderInfoTip(SOURCES_TIP)\n }

\n ${body}\n

`\n}\n\n/**\n * The waiting state, revealed by script when a check is submitted.\n *\n * A check takes about 45 seconds and execution is request-bound, so a native\n * form POST leaves the browser blocked on a navigation for the whole time with\n * nothing on screen but a disabled button. The work still happens inside one\n * request; this just stops that request being the thing the browser is painting.\n *\n * It claims only what is knowable while waiting. The domain and any questions\n * the visitor typed are theirs already, and elapsed time is counted rather than\n * guessed. There is ONE track, not a list of phases: this runner really is\n * sequential — plan, then probe, then read the answers back — but the server\n * reports no phase, so naming three of them would tell the reader which one is\n * running when nothing knows that.\n */\nfunction renderLoadingView(): string {\n return `\n `\n}\n\n/**\n * The form does two different jobs, so it gets two treatments.\n *\n * On the landing page it is the ONLY thing to do, so it is the hero: a full\n * headline, a large field, and the scope note underneath. On a result page the\n * reader already has what they came for, so it shrinks into the header as a\n * secondary action and drops the onboarding copy.\n */\nfunction renderCheckForm(model: BrandPerceptionViewModel, variant: 'hero' | 'compact' = 'compact'): string {\n if (!model.form) return ''\n const value = model.status === 'empty' ? '' : model.domain\n const verificationStatus = model.form.verificationStatus ?? (model.form.turnstileSiteKey ? 'ready' : 'not-required')\n const hasTurnstile = Boolean(model.form.turnstileSiteKey && verificationStatus === 'ready')\n const disabled = verificationStatus === 'unavailable'\n // interaction-only: the challenge still runs on load, so a token is ready at\n // submit, but the widget is drawn only if the visitor has to do something.\n const verification = hasTurnstile\n ? `

`\n : verificationStatus === 'unavailable'\n ? `

!${\n escapeHtml(\n model.form.verificationUnavailableMessage ?? 'Human verification is unavailable. Public checks are disabled.',\n )\n }

`\n : ''\n const verificationSlot = verification\n ? `

${verification}

`\n : ''\n const hero = variant === 'hero'\n const submitLabel = model.form.submitLabel ?? 'Check a brand'\n return `\n `\n}\n\nfunction brandLockup(glyphHref: string): string {\n return `

brand perception checkpowered by $\"\"$ Canonry

`\n}\n\nconst FOOTER_LINKS =\n 'npm i -g @canonry/canonryGitHub canonry.ai'\n\nfunction renderMain(model: BrandPerceptionViewModel): string {\n const glyphHref = assetUrl(DEFAULT_GLYPH_SRC, canonryGlyph)\n const globalNotice = (model.status === 'ready' ? model.notice : model.notice ?? statusCopy(model.status)) ?? undefined\n const perception = model.perception\n // Nothing has been checked yet, so a report header over two empty panels is\n // scaffolding around an absence. Lead with the one action instead.\n if (model.status === 'empty') {\n return `\n

\n \n

What does AI say about your brand?${renderInfoTip(LANDING_EXPLAINER)}

\n ${renderCheckForm(model, 'hero')}\n

\n ${renderLoadingView()}\n

\n \n

`\n }\n return `\n

\n \n

${escapeHtml(model.domain)}

\n ${renderNotice(globalNotice)}\n

\n ${\n perception\n ? `${renderVerdictSnapshot(perception)}${renderAnswers(perception)}${renderConcerns(perception)}${\n renderSourceTypes(perception)\n }`\n : '

No brand perception result

Start a check to see what an answer engine says about this brand.

'\n }\n

\n \n

`\n}\n\n/** Returns a complete document so the runtime can use it as an HTTP response body. */\nexport function renderBrandPerception(model: BrandPerceptionViewModel): string {\n const title = `${model.displayName} | ${PRODUCT_NAME}`\n return `\n\n \n \n \n \n ${escapeHtml(title)}\n \n \n \n \n \n \n ${\n model.form?.turnstileSiteKey && (model.form.verificationStatus ?? 'ready') === 'ready'\n ? ''\n : ''\n }\n \n ${renderMain(model)}\n`\n}\n\n/** Useful for a host that owns the outer document or wants an embedded fragment. */\nexport function renderBrandPerceptionBody(model: BrandPerceptionViewModel): string {\n return renderMain(model)\n}\n",[],[168,278,288],"240f901b-5542-496b-9b40-286484e09595","index.ts","ef885f02-a7bd-11f1-b787-1607ee4eb77e",28,["D",1788474100506],"export { createPublicCheckForm } from './check-form.ts'\nexport { brandPerceptionClientScript, QUERY_HINT_SUFFIX } from './client.ts'\nexport { emptyLandingViewModel, toBrandPerceptionViewModel } from './from-check-record.ts'\nexport type { CheckRecordViewOptions } from './from-check-record.ts'\nexport { assetUrl, PRODUCT_NAME, renderBrandPerception, renderBrandPerceptionBody } from './render.ts'\nexport { brandPerceptionStyles } from './styles.ts'\nexport { canonryGlyph, canonryMark } from 'npm:@canonry/val-kit@0.2.0/ui'\nexport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n ConcernViewModel,\n DemoUiStatus,\n PerceptionAnswerViewModel,\n PerceptionSourceViewModel,\n PerceptionViewModel,\n SourceTypeEntryViewModel,\n SourceTypeViewModel,\n UiAction,\n UiNotice,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n",[],[168,278,296],"6b9685aa-3d18-4d29-8716-5bdde5e9fad7","from-check-record.ts","ef63417c-a7bd-11f1-b229-1607ee4eb77e",39,["D",1788474100718],"import {\n type CheckRecord,\n PUBLIC_CHECK_UNAVAILABLE,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type {\n PerceptionEvidence,\n PerceptionReport,\n PerceptionVerdict,\n SourceType,\n} from 'npm:@canonry/val-kit@0.2.0/perception'\nimport type { PerceptionCheckResult } from '../runtime/check-result.ts'\nimport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n PerceptionAnswerViewModel,\n PerceptionViewModel,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n\nexport interface CheckRecordViewOptions {\n form?: CheckFormViewModel\n displayName?: string\n title?: string\n}\n\nconst LOCAL_READY_FORM: CheckFormViewModel = {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n verificationStatus: 'not-required',\n submitLabel: 'Check a brand',\n}\n\n/**\n * The verdict vocabulary, written once.\n *\n * `none` is a POSITION — the answer described the brand and took none — so it\n * gets a neutral tone and a label that says what happened, never \"no data\".\n * `null` is the absence of a measurement and is handled separately, because\n * collapsing the two would turn an outage into a finding.\n */\nconst VERDICT_COPY: Readonly> = {\n recommends: { label: 'Recommends', tone: 'positive' },\n cautions: { label: 'Cautions', tone: 'negative' },\n mixed: { label: 'Mixed', tone: 'caution' },\n none: { label: 'Took no position', tone: 'neutral' },\n}\n\n/** What KIND of place, in the reader's words. Never \"where opinions come from\". */\nconst SOURCE_TYPE_LABELS: Readonly> = {\n official: 'The brand’s own site',\n community: 'Community',\n review: 'Review site',\n news: 'News',\n other: 'Other',\n}\n\n/**\n * Converts a sanitized, durable public-check record into the narrow UI model.\n * It deliberately never turns an unmeasured answer into a neutral verdict.\n */\nexport function toBrandPerceptionViewModel(\n record: CheckRecord | null,\n options: CheckRecordViewOptions = {},\n): BrandPerceptionViewModel {\n const domain = record?.domain ?? ''\n const result = record?.result ?? null\n const status = record ? mapStatus(record) : 'empty'\n const resultDomain = result?.domain || domain\n\n return {\n status,\n title: options.title,\n displayName: options.displayName ?? nameFromDomain(resultDomain || 'Brand'),\n domain: resultDomain,\n form: { ...LOCAL_READY_FORM, ...options.form },\n perception: result?.perception ? mapPerception(result.perception) : undefined,\n notice: buildNotice(record, result),\n }\n}\n\n/**\n * Did anything in this check actually fail?\n *\n * `record.status` is decided once, when the check runs, and stored, which makes\n * it the wrong thing to warn a reader off: correcting the rule behind it never\n * reaches a record already written, so a shared link keeps showing the old\n * verdict for its whole 24h life. The evidence is right here in the result, so\n * read it instead of the flag.\n */\nfunction hasFailedWork(record: CheckRecord): boolean {\n const result = record.result\n if (!result) return false\n if (result.errors.length > 0) return true\n return (result.perception?.evidence ?? []).some((row) => row.verdict === null)\n}\n\nfunction mapStatus(record: CheckRecord): BrandPerceptionViewModel['status'] {\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) return 'rate-limited'\n switch (record.status) {\n case 'queued':\n case 'running':\n return 'loading'\n case 'partial':\n // A stored `partial` is only worth a caution when something in the result\n // actually failed. See `hasFailedWork`.\n return hasFailedWork(record) ? 'partial' : 'ready'\n case 'failed':\n return 'error'\n case 'complete':\n return 'ready'\n }\n}\n\nfunction mapPerception(report: PerceptionReport): PerceptionViewModel {\n const failed = report.summary.failedChecks\n const sourceTypes = report.summary.sourceTypes\n return {\n requestedAt: report.startedAt,\n checkedAt: report.completedAt,\n measuredAnswers: report.summary.successfulChecks,\n requestedAnswers: report.evidence.length,\n failedAnswers: failed,\n // Fixed order, so the row reads the same on every check and a count that\n // happens to be zero keeps its column rather than shuffling the others.\n verdicts: (['recommends', 'cautions', 'mixed', 'none'] as const).map((key): VerdictCountViewModel => ({\n key,\n label: VERDICT_COPY[key].label,\n tone: VERDICT_COPY[key].tone,\n count: report.summary.verdicts[key],\n })),\n concerns: report.summary.concerns.map((concern) => ({ phrase: concern.phrase, answers: concern.answers })),\n // Percentages round for display only; the shares they come from sum to 1.\n sourceTypes: sourceTypes\n ? {\n measuredAnswers: sourceTypes.measuredAnswers,\n unattributedAnswers: sourceTypes.unattributedAnswers,\n totalAppearances: sourceTypes.totalAppearances,\n entries: sourceTypes.entries.map((entry) => ({\n type: entry.type,\n label: SOURCE_TYPE_LABELS[entry.type],\n answers: entry.answers,\n percent: Math.round(entry.share * 100),\n })),\n }\n : undefined,\n answers: report.evidence.map(mapAnswer),\n notice: failed > 0\n ? {\n tone: 'caution',\n title: `${failed} ${failed === 1 ? 'answer' : 'answers'} unavailable`,\n // The reason leads, because that is what a row reading \"Not measured\"\n // makes someone ask. It is only stated when the failures agree on one;\n // with several the banner would have to pick one and be wrong about the\n // rest, so it defers to the per-row evidence instead.\n detail: `${failureReason(report.evidence) ?? ''}Every count uses the answers that were measured.`,\n }\n : undefined,\n }\n}\n\n/** The one reason every unmeasured answer shares, or null when they disagree. */\nfunction failureReason(evidence: readonly PerceptionEvidence[]): string | null {\n const reasons = new Set(\n evidence.filter((row) => row.verdict === null)\n .map((row) => row.error)\n // The generic sentence is the ABSENCE of a reason. Leading with it\n // produces \"1 answer unavailable. This answer-engine check was\n // unavailable.\" — the banner restating its own title.\n .filter((error): error is string => Boolean(error) && error !== PUBLIC_CHECK_UNAVAILABLE),\n )\n if (reasons.size !== 1) return null\n const [reason] = [...reasons]\n return reason ? `${reason} ` : null\n}\n\nfunction mapAnswer(row: PerceptionEvidence): PerceptionAnswerViewModel {\n const copy = row.verdict === null ? null : VERDICT_COPY[row.verdict]\n return {\n id: `${row.provider}:${row.query}:${row.completedAt}`,\n query: row.query,\n verdict: row.verdict,\n verdictLabel: copy?.label ?? 'Not measured',\n verdictTone: copy?.tone ?? 'neutral',\n // The answer's own first sentence, or nothing. A verdict of 'none' carries\n // no evidence by construction, and inventing a line to fill the cell would\n // put words in an answer that did not write them.\n headline: row.evidenceSentences[0] ?? null,\n evidenceSentences: row.evidenceSentences,\n concerns: row.concerns,\n sources: row.sources.map((source) => ({\n url: source.url,\n title: source.title,\n domain: source.domain,\n typeLabel: SOURCE_TYPE_LABELS[source.type],\n })),\n searchQueries: row.searchQueries,\n answerText: row.answerText,\n requestedModel: row.requestedModel,\n servedModel: row.servedModel,\n completedAt: row.completedAt,\n error: row.error,\n }\n}\n\nfunction buildNotice(\n record: CheckRecord | null,\n result: PerceptionCheckResult | null,\n): BrandPerceptionViewModel['notice'] {\n if (!record) return undefined\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) {\n return {\n tone: 'caution',\n title: 'Check limit reached',\n detail: record.errorMessage ?? 'This public sample has reached its current limit. Try again later.',\n }\n }\n if (record.status === 'failed') {\n return {\n tone: 'negative',\n title: 'This check could not finish',\n detail: result?.errors[0]?.message ?? record.errorMessage ?? 'Try another public domain later.',\n }\n }\n const first = result?.errors[0]\n if (first) return { tone: 'caution', title: 'Brand perception was unavailable', detail: first.message }\n return undefined\n}\n\nfunction nameFromDomain(domain: string): string {\n const host = domain.replace(/^www\\./i, '').split('.')[0] ?? domain\n return host\n .replace(/[-_]+/g, ' ')\n .replace(/\\b\\w/g, (letter) => letter.toUpperCase())\n}\n\n/**\n * The landing view, shown before anything has been checked.\n *\n * It carries no `perception` because nothing has been measured yet. A fixture\n * here would be read as measurement by anyone who scrolled past the badge that\n * qualified it — and a fabricated verdict about a real brand is a worse lie\n * than a fabricated percentage. An empty state is the honest thing to show when\n * the answer is \"nothing yet\".\n */\nexport function emptyLandingViewModel(form: CheckFormViewModel): BrandPerceptionViewModel {\n return {\n status: 'empty',\n title: 'Brand Perception Check',\n displayName: 'Check a brand',\n domain: '',\n form,\n }\n}\n",[],[168,278,304],"19bf501c-ea6f-43f0-9f73-2295a95628cb","client.ts","ef6e34d8-a7bd-11f1-b787-1607ee4eb77e",15,["D",1788456963255],"/**\n * The one place the timing is written. The script below rewrites the query\n * hint's text on every keystroke, so a suffix left only in the server markup\n * would survive until the visitor types and then silently disappear.\n */\nexport const QUERY_HINT_SUFFIX = 'Takes about 45 seconds.'\n\n/** Client-side enhancement only. The page remains usable with native forms and details. */\nexport const brandPerceptionClientScript = `\n(() => {\n const queries = document.querySelector('[data-query-hint]');\n const queryInput = document.getElementById('queries-input');\n if (queries && queryInput) {\n const max = Number(queries.dataset.max || 3);\n const update = () => {\n const used = queryInput.value.split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).length;\n const kept = Math.min(used, max);\n const rest = max - kept;\n const counts = kept === 0\n ? 'Add up to ' + max + '. We generate the rest.'\n : rest === 0\n ? 'Using your ' + kept + '. We generate none.'\n : 'Using your ' + kept + '. We generate the other ' + rest + '.';\n // Interpolated at module load so the server markup and every rewrite of\n // this line read one constant.\n queries.textContent = counts + ' ' + ${JSON.stringify(QUERY_HINT_SUFFIX)};\n };\n queryInput.addEventListener('input', update);\n update();\n }\n\n const form = document.querySelector('[data-domain-check-form]');\n if (form) {\n const submit = form.querySelector('[data-domain-submit]');\n const busy = form.querySelector('[data-form-busy]');\n const checking = document.querySelector('[data-checking]');\n\n const markBusy = () => {\n form.setAttribute('aria-busy', 'true');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = true;\n submit.setAttribute('aria-disabled', 'true');\n submit.textContent = 'Starting…';\n }\n if (busy) {\n busy.hidden = false;\n busy.classList.remove('is-error');\n busy.textContent = 'Starting check…';\n }\n };\n\n // Without the waiting view there is nothing to enhance: fall back to the\n // native POST, which still works, just with a blocked browser.\n if (!checking) {\n form.addEventListener('submit', markBusy);\n } else {\n const elapsedEl = checking.querySelector('[data-checking-elapsed]');\n const domainEl = checking.querySelector('[data-checking-domain]');\n const queriesEl = checking.querySelector('[data-checking-queries]');\n const hero = document.querySelector('[data-hero]');\n\n const restore = (message) => {\n checking.hidden = true;\n if (hero) hero.hidden = false;\n form.removeAttribute('aria-busy');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = false;\n submit.removeAttribute('aria-disabled');\n submit.textContent = submit.dataset.label || 'Check a brand';\n }\n if (busy) {\n busy.hidden = false;\n // A failure and \"Starting check…\" must not be the same grey line, or\n // hiding the waiting view reads as the page bouncing back to the form\n // with nothing said, while the reason sits on screen unnoticed.\n busy.classList.add('is-error');\n busy.textContent = message;\n }\n // A Turnstile token is redeemed exactly once. The page is still here\n // after a failure, so the spent token has to be replaced before the\n // visitor can try again.\n if (window.turnstile && typeof window.turnstile.reset === 'function') {\n try { window.turnstile.reset(); } catch (_) { /* widget absent */ }\n }\n };\n\n form.addEventListener('submit', (event) => {\n const data = new FormData(form);\n const domain = String(data.get('domain') || '').trim();\n if (!domain) return;\n event.preventDefault();\n markBusy();\n\n if (domainEl) domainEl.textContent = domain;\n const typed = String(data.get('queries') || '')\n .split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).slice(0, 3);\n if (queriesEl) {\n queriesEl.textContent = '';\n for (const question of typed) {\n const item = document.createElement('li');\n item.textContent = question;\n queriesEl.appendChild(item);\n }\n queriesEl.hidden = typed.length === 0;\n }\n if (hero) hero.hidden = true;\n checking.hidden = false;\n\n const started = Date.now();\n const tick = setInterval(() => {\n if (elapsedEl) elapsedEl.textContent = Math.round((Date.now() - started) / 1000) + 's';\n }, 1000);\n\n fetch(form.dataset.jsonAction || '/api/checks', {\n method: 'POST',\n headers: { 'content-type': 'application/json', accept: 'application/json' },\n body: JSON.stringify({\n domain: domain,\n queries: typed,\n turnstileToken: data.get('cf-turnstile-response') || null,\n }),\n })\n .then((response) => response.json().then((body) => ({ ok: response.ok, body: body })))\n .then((result) => {\n clearInterval(tick);\n const id = result.body && result.body.check && result.body.check.id;\n if (result.ok && id) {\n location.href = '/?check=' + encodeURIComponent(id);\n return;\n }\n const error = result.body && result.body.error;\n restore((error && error.message) || 'The check could not be started. Try again.');\n })\n .catch(() => {\n clearInterval(tick);\n restore('The check could not be reached. Try again.');\n });\n });\n }\n }\n})();\n`\n",[],[168,278,312],"67b1c31f-10ed-422c-8d13-8e917295ccf4","check-form.ts","ef3bc3ea-a7bd-11f1-8727-1607ee4eb77e",["D",1788474100516],"import type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport type { CheckFormViewModel } from './types.ts'\n\ntype PublicCheckFormConfig = Pick<\n ValTownConfig,\n | 'publicChecksEnabled'\n | 'publicChecksUnavailableMessage'\n | 'humanVerificationStatus'\n | 'turnstileSiteKey'\n>\n\n/** Builds the public form from the complete admission capability, not CAPTCHA alone. */\nexport function createPublicCheckForm(config: PublicCheckFormConfig): CheckFormViewModel {\n const unavailable = !config.publicChecksEnabled\n return {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n turnstileSiteKey: unavailable ? null : config.turnstileSiteKey,\n turnstileAction: 'audit',\n verificationStatus: unavailable ? 'unavailable' : config.humanVerificationStatus,\n verificationUnavailableMessage: unavailable\n ? config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.'\n : 'Human verification is not configured. Public checks are disabled.',\n submitLabel: 'Check a brand',\n }\n}\n",[],[168,278,320],"ded814b2-e46f-462c-a9f1-97a00b7b4d1b",["D",1788456960982],[197,198,199,200,201,202,203],[168,278],"b1055b7a-88af-4680-b7c7-bc6dfa7ef335","check-result.ts","efb36968-a7bd-11f1-a791-1607ee4eb77e","ee30f538-a7bd-11f1-a791-1607ee4eb77e",33,["D",1788474102019],"/**\n * What THIS val's check produces, and the reuse namespace that retires it.\n *\n * `@canonry/val-kit` is opaque to both: a `CheckRecord`\n * carries this schema through the kit's admission, lease, quota, and storage\n * machinery without the kit ever reading inside it, and `checkFingerprint` takes\n * the namespace as its first argument rather than inventing one. That is what\n * lets this val and the AI Visibility Check val store entirely different results\n * in the same table without either serving the other's cached work.\n */\nimport type { PerceptionReport } from 'npm:@canonry/val-kit@0.2.0/perception'\n\n/**\n * The reuse namespace for this product. It is the FIRST field of every\n * fingerprint, which is both the 24h cache key and the one-active-check index.\n *\n * Bump it — and only it — when a change adds or removes a measured signal, so\n * records that lack the new signal stop satisfying new requests at the moment\n * the signal set changed rather than at their own TTL. Never bump another\n * product's namespace, and never reuse one: two products keyed alike would\n * serve each other's results as cache hits, and a perception check and a\n * visibility check for one domain measure entirely different things.\n */\nexport const CHECK_FINGERPRINT_NAMESPACE = 'perception-v1'\n\nexport const CHECK_RESULT_SCHEMA_VERSION = '1.0' as const\n\nexport interface PerceptionCheckResult {\n schemaVersion: typeof CHECK_RESULT_SCHEMA_VERSION\n domain: string\n generatedAt: string\n /** Null when the one phase produced nothing at all. */\n perception: PerceptionReport | null\n errors: Array<{ area: 'perception'; message: string }>\n}\n",[],[168,339,331],"runtime","4f9d45fe-bb61-49dc-95e1-7721ed13d71e",4,["D",1788456961187],[195],[168,339],"a7f7a1ac-d0e9-403f-83a6-decfb8e0de07","tools.ts","efe97300-a7bd-11f1-90c1-1607ee4eb77e","ee403354-a7bd-11f1-adc2-1607ee4eb77e",35,["D",1788474102392],"/**\n * The MCP tool surface: reads over checks this val has already run, plus the\n * bundled skills for clients that do not implement MCP resources.\n *\n * Every tool but `start_check` is a read, and `start_check` runs the host's full\n * admission path — same global daily cap, same single execution lease, same\n * cache reuse — differing only in that it skips Turnstile, which an agent cannot\n * solve, and spends from its own tighter per-caller bucket. The global cap is\n * what bounds the bill; Turnstile bounds fairness, so this widens who may spend\n * the budget without widening the budget.\n *\n * Results are JSON in a text block rather than `structuredContent`, because\n * every client across both protocol eras renders text content, while typed\n * output is newer and unevenly implemented.\n */\nimport { type CheckRecord, checkFingerprint, type CheckStore, isCheckExpired } from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type { PerceptionEvidence } from 'npm:@canonry/val-kit@0.2.0/perception'\nimport { readSkillResource } from 'npm:@canonry/val-kit@0.2.0/mcp'\nimport { normalizePublicDomain, PublicUrlError } from 'npm:@canonry/val-kit@0.2.0/security'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\n/**\n * The one sentence that keeps this instrument out of the other one's table.\n *\n * Every question here NAMES the brand, so the engine was always going to talk\n * about it: a mention rate over this basket would read ~100% and mean nothing.\n * AI Visibility asks non-brand questions, where placement is actually decided.\n * The two never share a denominator, so the scope travels with every number.\n */\nconst BRANDED_SCOPE_NOTE =\n 'These are branded questions — the brand is named in each one — so the engine was always going to discuss it. ' +\n 'The finding is what it SAID, never whether it appeared. Never compare these figures to an AI Visibility ' +\n 'mention or citation rate: those are measured on non-brand queries and share no denominator with this.'\n\nexport interface McpToolDefinition {\n name: string\n title: string\n description: string\n inputSchema: Record\n}\n\nexport interface McpToolResult {\n content: Array<{ type: 'text'; text: string }>\n isError?: boolean\n}\n\n/** Runs the host's full admission path; absent when the host disables MCP starts. */\nexport type StartCheckFn = (\n domain: string,\n remoteIp: string | null,\n queries: readonly string[],\n) => Promise<{ record: CheckRecord; reused: boolean }>\n\nexport interface McpToolContext {\n store: CheckStore\n now: () => Date\n startCheck?: StartCheckFn\n /** Edge-provided caller identity, used only as the quota subject. */\n remoteIp?: string | null\n}\n\nfunction ok(payload: unknown): McpToolResult {\n return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] }\n}\n\nfunction fail(message: string, hint?: string): McpToolResult {\n return {\n content: [{ type: 'text', text: JSON.stringify(hint ? { error: message, hint } : { error: message }, null, 2) }],\n isError: true,\n }\n}\n\nconst TARGET_SCHEMA = {\n type: 'object',\n properties: {\n checkId: { type: 'string', description: 'A check ID returned by a previous tool call or shown in the web UI.' },\n domain: {\n type: 'string',\n description:\n 'A domain such as \"example.com\". Resolves the most recent cached check; it never starts one. Use start_check ' +\n 'to run a fresh check.',\n },\n },\n additionalProperties: false,\n} as const\n\n/**\n * Resolve either addressing mode to a readable record.\n *\n * A domain lookup only ever finds work the val already did — it never starts a\n * check — so a miss is reported as a miss rather than quietly queuing paid work\n * the caller did not ask for.\n */\nasync function resolveCheck(\n context: McpToolContext,\n args: Record,\n): Promise<{ record: CheckRecord } | { error: McpToolResult }> {\n const checkId = typeof args.checkId === 'string' ? args.checkId.trim() : ''\n const domain = typeof args.domain === 'string' ? args.domain.trim() : ''\n\n if (!checkId && !domain) return { error: fail('Provide either \"checkId\" or \"domain\".') }\n\n const now = context.now()\n\n if (checkId) {\n if (!CHECK_ID.test(checkId)) return { error: fail(`\"${checkId}\" is not a valid check ID.`) }\n const record = await context.store.get(checkId)\n if (!record || isCheckExpired(record, now)) {\n return {\n error: fail(`No check found for ID \"${checkId}\".`, 'Public checks expire; run a new one from the web UI.'),\n }\n }\n return { record }\n }\n\n let normalized: string\n try {\n normalized = normalizePublicDomain(domain).domain\n } catch (error) {\n return { error: fail(error instanceof PublicUrlError ? error.message : 'Enter a valid public domain.') }\n }\n\n const record = await context.store.findReusable(\n checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, normalized),\n now.toISOString(),\n )\n if (!record) {\n return {\n error: fail(\n `No cached check for \"${normalized}\".`,\n 'Run one with start_check, or from the web UI, then read it here.',\n ),\n }\n }\n return { record }\n}\n\n/** Shared envelope so every tool reports status and freshness the same way. */\nfunction recordEnvelope(record: CheckRecord) {\n return {\n checkId: record.id,\n domain: record.domain,\n status: record.status,\n createdAt: record.createdAt,\n updatedAt: record.updatedAt,\n expiresAt: record.expiresAt,\n error: record.errorCode ? { code: record.errorCode, message: record.errorMessage } : null,\n }\n}\n\n/**\n * The headline numbers, passed straight through from the record.\n *\n * Never recomputed here. The summary is what the instrument measured over the\n * rows it wrote; deriving it a second time on the read path is how a tool\n * payload starts disagreeing with the page and with itself.\n */\nfunction perceptionSummary(record: CheckRecord) {\n const perception = record.result?.perception\n if (!perception) return { measured: false as const }\n return {\n measured: true as const,\n scope: 'branded' as const,\n scopeNote: BRANDED_SCOPE_NOTE,\n brandNames: perception.brandNames,\n successfulChecks: perception.summary.successfulChecks,\n failedChecks: perception.summary.failedChecks,\n verdicts: perception.summary.verdicts,\n verdictNote:\n 'Counts are over successful checks only and sum to successfulChecks. \"none\" means the answer took no position, ' +\n 'which is a finding; a failed check has a null verdict and is in no denominator.',\n concerns: perception.summary.concerns,\n sourceTypes: perception.summary.sourceTypes,\n sourceNote:\n 'Sources the answer engine attributed for these answers, typed. A type counts once per answer, and an answer ' +\n 'that attributed nothing is stated as unattributedAnswers rather than folded into the denominator.',\n startedAt: perception.startedAt,\n completedAt: perception.completedAt,\n }\n}\n\nfunction evidenceRow(evidence: PerceptionEvidence) {\n return {\n query: evidence.query,\n provider: evidence.provider,\n servedModel: evidence.servedModel,\n completedAt: evidence.completedAt,\n // Null means this check produced no verdict — a failed probe or a failed\n // extraction. It is never 'none', which says the answer took no position.\n verdict: evidence.verdict,\n // Copied out of the answer and verified present in it, word for word.\n evidenceSentences: evidence.evidenceSentences,\n concerns: evidence.concerns,\n sources: evidence.sources,\n searchQueries: evidence.searchQueries,\n retrievalStatus: evidence.retrievalStatus,\n answerText: evidence.answerText,\n error: evidence.error,\n }\n}\n\n/**\n * The conversion path. An agent that has just shown a user what an engine says\n * about their brand is exactly where \"how do I get this properly\" gets asked,\n * and without this it would have to guess at an install command.\n */\nconst SELF_HOST_TOOL: McpToolDefinition = {\n name: 'self_host',\n title: 'How to self-host Canonry',\n description:\n 'How to run the full Canonry platform instead of this bounded sample: install command, repository, docs, and ' +\n 'what self-hosting adds over this endpoint. Call it when the user asks for more engines, scheduled tracking, ' +\n 'more questions, their own data, or how any of this actually works.',\n inputSchema: { type: 'object', properties: {}, additionalProperties: false },\n}\n\nconst START_CHECK_TOOL: McpToolDefinition = {\n name: 'start_check',\n title: 'Run a new brand perception check',\n description:\n 'Run a fresh check for a domain: three grounded Gemini answers to BRANDED questions about the brand, each read ' +\n 'back for the position it takes. Blocks until the check finishes, up to about 45 seconds, and returns the same ' +\n 'shape as get_check. A domain checked in the last 24 hours with the same questions returns the cached result ' +\n 'immediately and costs nothing. Daily limits apply.',\n inputSchema: {\n type: 'object',\n properties: {\n domain: { type: 'string', description: 'A domain such as \"example.com\".' },\n queries: {\n type: 'array',\n items: { type: 'string' },\n maxItems: 3,\n description:\n 'Optional. Up to 3 questions to put to the answer engine, used verbatim. Any remaining slots are filled ' +\n 'with branded questions generated for the brand, so supplying none generates all three.',\n },\n },\n required: ['domain'],\n additionalProperties: false,\n },\n}\n\nconst READ_TOOLS: readonly McpToolDefinition[] = [\n SELF_HOST_TOOL,\n {\n name: 'get_check',\n title: 'Get a brand perception check',\n description:\n 'Status and headline numbers for one brand check: how many answers recommend, caution, are mixed, or took no ' +\n 'position, the concerns those answers raised, and the mix of source types the engine attributed. Address it by ' +\n 'checkId or by domain. Every figure is scoped to BRANDED questions and is never comparable to an AI Visibility ' +\n 'mention or citation rate. Reads existing work only — it never starts a new check.',\n inputSchema: TARGET_SCHEMA,\n },\n {\n name: 'get_brand_perception',\n title: 'Get brand perception evidence',\n description:\n 'Per answer evidence for one check. Every row carries the verdict the answer gave, the sentences copied out of ' +\n 'that answer word for word which carry it, the concerns it wrote, the typed sources the engine attributed, and ' +\n 'the full answer text. A null verdict means that check produced none and was not measured — it is never \"none\", ' +\n 'which says the answer took no position. Branded scope; not comparable to AI Visibility rates.',\n inputSchema: TARGET_SCHEMA,\n },\n {\n name: 'read_skill',\n title: 'Read a Canonry skill document',\n description: 'Read one bundled canonry (operator) or aero (analyst) skill document as markdown. Accepts a ' +\n 'canonry-skill:// URI or a path such as \"aero/references/regression-playbook.md\". The full index is served as ' +\n 'MCP resources: call resources/list for every available URI, starting with the two SKILL.md entry points.',\n inputSchema: {\n type: 'object',\n properties: {\n uri: { type: 'string', description: 'A canonry-skill:// URI, or \"/\", or a bare reference path.' },\n },\n required: ['uri'],\n additionalProperties: false,\n },\n },\n]\n\n/** The advertised catalog. `start_check` appears only when the host can honour it. */\nexport function mcpTools(context: McpToolContext): readonly McpToolDefinition[] {\n return context.startCheck ? [...READ_TOOLS, START_CHECK_TOOL] : READ_TOOLS\n}\n\nexport async function callMcpTool(\n context: McpToolContext,\n name: string,\n args: Record,\n): Promise {\n switch (name) {\n case 'get_check': {\n const resolved = await resolveCheck(context, args)\n if ('error' in resolved) return resolved.error\n return ok({\n ...recordEnvelope(resolved.record),\n brandPerception: perceptionSummary(resolved.record),\n partialErrors: resolved.record.result?.errors ?? [],\n })\n }\n\n case 'get_brand_perception': {\n const resolved = await resolveCheck(context, args)\n if ('error' in resolved) return resolved.error\n const perception = resolved.record.result?.perception\n if (!perception) {\n return ok({\n ...recordEnvelope(resolved.record),\n measured: false,\n reason: resolved.record.status === 'queued' || resolved.record.status === 'running'\n ? 'The check is still running.'\n : 'This check has no brand perception result.',\n })\n }\n return ok({\n ...recordEnvelope(resolved.record),\n scope: 'branded',\n scopeNote: BRANDED_SCOPE_NOTE,\n summary: perceptionSummary(resolved.record),\n evidence: perception.evidence.map(evidenceRow),\n })\n }\n\n case 'start_check': {\n if (!context.startCheck) return fail('Starting a check is not enabled on this endpoint.')\n const domain = typeof args.domain === 'string' ? args.domain.trim() : ''\n if (!domain) return fail('Provide a \"domain\".')\n try {\n const queries = Array.isArray(args.queries) ? args.queries : []\n const { record, reused } = await context.startCheck(domain, context.remoteIp ?? null, queries)\n return ok({\n ...recordEnvelope(record),\n reused,\n brandPerception: perceptionSummary(record),\n partialErrors: record.result?.errors ?? [],\n })\n } catch (error) {\n // The host throws typed admission failures (quota, capacity, invalid\n // domain). Their messages are already caller-safe and actionable.\n return fail(error instanceof Error ? error.message : 'The check could not be started.')\n }\n }\n\n case 'self_host':\n return ok({\n summary:\n 'This endpoint is a bounded sample. Canonry is the full platform it samples: open source, self-hosted, ' +\n 'agent-first, with your own data in local SQLite.',\n install: 'npm install -g @canonry/canonry',\n quickstart: [\n 'npm install -g @canonry/canonry',\n 'canonry init',\n 'canonry project create my-site --domain example.com --country US --language en',\n 'canonry query add my-site \"best example widgets\"',\n 'canonry run my-site',\n 'canonry visibility-stats my-site',\n ],\n repository: 'https://github.com/Canonry/canonry',\n website: 'https://canonry.ai',\n package: 'https://www.npmjs.com/package/@canonry/canonry',\n license: 'FSL-1.1-ALv2',\n whatSelfHostingAdds: [\n 'All four answer engines — Gemini, ChatGPT, Claude, Perplexity — not Gemini alone.',\n 'Unlimited tracked questions and scheduled sweeps, instead of 3 branded questions on demand.',\n 'History, so you can see a verdict or a concern appear, spread, or go away.',\n 'Non-brand tracking as well: mention and citation coverage on the questions that decide placement.',\n 'Competitor mention share, regression insights, and a downloadable client report.',\n 'Google Search Console, GA4, Bing, Business Profile, and server-side traffic joined to the same view.',\n 'Your own MCP server (canonry-mcp, 188 tools) and the built-in Aero analyst agent.',\n 'Your data stays in your own SQLite database.',\n ],\n skills: 'The canonry and aero skill documents served by this endpoint are the same playbooks a local install ' +\n 'ships. Read canonry-skill://canonry/SKILL.md to operate the CLI.',\n })\n\n case 'read_skill': {\n const uri = typeof args.uri === 'string' ? args.uri.trim() : ''\n if (!uri) return fail('Provide a skill document \"uri\".')\n const contents = readSkillResource(uri)\n if (!contents) {\n return fail(`No skill document matches \"${uri}\".`, 'Call resources/list for the available URIs.')\n }\n return { content: [{ type: 'text', text: contents.text }] }\n }\n\n default:\n return null\n }\n}\n",[],[168,354,346],"mcp","a805ad1f-5e63-4ad1-a5d8-6c09069e902e","server.ts","efd79752-a7bd-11f1-ad99-1607ee4eb77e",34,["D",1788474102328],"/**\n * MCP method dispatch and the HTTP handler for the `/mcp` endpoint.\n *\n * The endpoint is anonymous, which is a deliberate consequence of what it\n * exposes: checks on this val are already public — the web UI serves any of\n * them from `/api/checks/:id` without a credential — and the skills ship in a\n * public npm package. A token would gate nothing already unreachable, while\n * making the endpoint useless as something an agent is simply pointed at.\n *\n * `start_check` is the one tool that spends. It is admitted by per-caller\n * quota rather than by a credential, under the same global daily cap as the\n * browser, so an anonymous caller can consume its share of the day's budget\n * but never enlarge it.\n */\nimport {\n isAllowedOrigin,\n jsonRpcError,\n JsonRpcErrorCodes,\n type JsonRpcResponse,\n jsonRpcResult,\n listSkillResources,\n type ParsedMcpRequest,\n parseMcpRequest,\n readSkillResource,\n SUPPORTED_PROTOCOL_VERSIONS,\n} from 'npm:@canonry/val-kit@0.2.0/mcp'\nimport { callMcpTool, type McpToolContext, mcpTools, type StartCheckFn } from './tools.ts'\n\n/** Version of this MCP surface, not of the Canonry package the val samples. */\nexport const MCP_SERVER_VERSION = '1.0.0'\n\nconst MAX_BODY_BYTES = 262_144\n\n// Named for what this endpoint is, not for the platform it samples. Calling it\n// `canonry` would tell an agent it had the whole product, when it has three\n// branded questions to one engine. The slug is the identifier a client keys\n// off; the display name lives in `title`, which is where a human reads it.\nconst SERVER_INFO = {\n name: 'brand-perception-check',\n title: 'Brand Perception Check (by Canonry)',\n version: MCP_SERVER_VERSION,\n} as const\n\nconst INSTRUCTIONS = [\n 'Brand Perception Check is a free, bounded sample of Canonry. It measures how an AI answer engine CHARACTERISES a',\n 'brand when it is asked about that brand directly. One check is 3 branded questions against Gemini, each answer',\n 'read back for the position it takes: enough to see what is being said, not enough to monitor it. Canonry itself is',\n 'open source, self-hosted, tracks Gemini, ChatGPT, Claude and Perplexity on a schedule, and has no such limits.',\n 'Call self_host for that.',\n '',\n 'Every question here NAMES the brand, so the engine was always going to discuss it. These figures are therefore',\n 'never comparable to an AI Visibility mention or citation rate, which are measured on non-brand questions and share',\n 'no denominator with this. Do not pool them and do not present one as the other.',\n '',\n 'A verdict is one of recommends, cautions, mixed, or none, and it is kept only when sentences copied WORD FOR WORD',\n 'out of that answer carry it. \"none\" means the answer took no position, which is a finding. A null verdict means',\n 'the check produced none and was not measured — it is not a neutral answer, and it is in no denominator. Nothing',\n 'here is a sentiment score; there is no such number and inventing one would misreport what was measured.',\n '',\n 'Sources are the ones the engine attributed for these answers, typed as official, community, review, news, or',\n 'other. They are not a claim about where opinions about the brand come from on the web.',\n '',\n 'Read the bundled skills with resources/list and read_skill: the aero entry point covers how to interpret and',\n 'report on this, the canonry entry point covers how to operate the CLI. Then use get_check for the headline',\n 'counts and get_brand_perception for the per-answer evidence behind them.',\n '',\n 'get_check and get_brand_perception read existing checks and never spend. start_check runs a fresh one, blocks for',\n 'up to about 45 seconds, and is subject to daily limits; a domain checked in the last 24 hours returns from cache',\n 'at no cost. Prefer reading before starting.',\n].join('\\n')\n\nexport interface McpHandlerOptions {\n store: McpToolContext['store']\n now?: () => Date\n /** Omit to keep the endpoint strictly read-only. */\n startCheck?: StartCheckFn\n}\n\nfunction jsonResponse(body: JsonRpcResponse, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },\n })\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const declared = Number(request.headers.get('content-length'))\n if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) return null\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n return null\n }\n chunks.push(next.value)\n }\n const merged = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n merged.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(merged)\n}\n\n/**\n * Val injects `cf-connecting-ip`. `x-forwarded-for` is caller-controlled on a\n * public val and is deliberately ignored, so a caller cannot mint a fresh\n * quota identity per request.\n */\nfunction edgeIp(request: Request): string | null {\n const value = request.headers.get('cf-connecting-ip')?.trim()\n return value && value.length <= 128 ? value : null\n}\n\n/** Dispatch one parsed message. Returns null for a notification, which gets 202. */\nasync function dispatch(\n context: McpToolContext,\n request: ParsedMcpRequest,\n): Promise<{ response: JsonRpcResponse; status: number } | null> {\n const { message, protocolVersion } = request\n const id = message.id ?? null\n const params = message.params ?? {}\n\n switch (message.method) {\n case 'initialize': {\n // Echo a version the caller asked for when it is one we speak, so a\n // legacy client stays in its own era instead of being pushed forward\n // into rules it does not implement. A client that declared its version\n // only in the `MCP-Protocol-Version` header and omitted it from params\n // still gets its own era back, because `protocolVersion` carries what\n // the envelope declared; falling through to the newest version would\n // answer a 2025 client with 2026 rules it has no code for.\n const requested = typeof params.protocolVersion === 'string' ? params.protocolVersion : null\n const negotiated = requested && (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(requested)\n ? requested\n : protocolVersion\n return {\n status: 200,\n response: jsonRpcResult(id, {\n protocolVersion: negotiated,\n capabilities: { tools: { listChanged: false }, resources: { listChanged: false, subscribe: false } },\n serverInfo: SERVER_INFO,\n instructions: INSTRUCTIONS,\n }),\n }\n }\n\n // Accepted so a legacy handshake completes. There is no session to advance.\n case 'notifications/initialized':\n case 'notifications/cancelled':\n return null\n\n case 'ping':\n return { status: 200, response: jsonRpcResult(id, {}) }\n\n case 'tools/list':\n return { status: 200, response: jsonRpcResult(id, { tools: mcpTools(context) }) }\n\n case 'tools/call': {\n const name = typeof params.name === 'string' ? params.name : ''\n const args = params.arguments && typeof params.arguments === 'object' && !Array.isArray(params.arguments)\n ? params.arguments as Record\n : {}\n if (!name) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, 'tools/call requires a \"name\".'),\n }\n }\n const result = await callMcpTool(context, name, args)\n if (!result) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, `Unknown tool \"${name}\".`),\n }\n }\n return { status: 200, response: jsonRpcResult(id, result) }\n }\n\n case 'resources/list':\n return { status: 200, response: jsonRpcResult(id, { resources: listSkillResources() }) }\n\n // Answered rather than refused: several clients probe both during startup,\n // and a method-not-found there reads as a broken server.\n case 'resources/templates/list':\n return { status: 200, response: jsonRpcResult(id, { resourceTemplates: [] }) }\n\n case 'prompts/list':\n return { status: 200, response: jsonRpcResult(id, { prompts: [] }) }\n\n case 'resources/read': {\n const uri = typeof params.uri === 'string' ? params.uri : ''\n const contents = uri ? readSkillResource(uri) : null\n if (!contents) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, `Resource not found: \"${uri}\".`),\n }\n }\n return { status: 200, response: jsonRpcResult(id, { contents: [contents] }) }\n }\n\n default:\n // A notification (no id) must never be answered, even for an unknown\n // method: returning null yields the 202 no-body the handler sends for\n // notifications. A roots-capable client's notifications/roots/list_changed\n // would otherwise get a 404 it can read as \"endpoint gone\".\n if (request.isNotification) return null\n // Streamable HTTP pairs an unknown request with 404, which is how a client\n // tells a modern server apart from a legacy endpoint that lacks this route.\n return {\n status: 404,\n response: jsonRpcError(id, JsonRpcErrorCodes.methodNotFound, `Unknown method \"${message.method}\".`),\n }\n }\n}\n\n/** Handle one POST to the MCP endpoint. */\nexport function createMcpHandler(options: McpHandlerOptions): (request: Request) => Promise {\n const base: McpToolContext = {\n store: options.store,\n now: options.now ?? (() => new Date()),\n startCheck: options.startCheck,\n }\n\n return async (request: Request): Promise => {\n if (request.method !== 'POST') {\n // The modern revision removed the GET stream and DELETE teardown.\n return jsonResponse(\n jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'The MCP endpoint accepts POST only.'),\n 405,\n )\n }\n\n if (!isAllowedOrigin(request.headers, request.url)) {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'Origin not allowed.'), 403)\n }\n\n const raw = await readLimitedBody(request)\n if (raw === null) {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'Request body is too large.'), 413)\n }\n\n let body: unknown\n try {\n body = JSON.parse(raw)\n } catch {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.parseError, 'Request body is not valid JSON.'), 400)\n }\n\n const parsed = parseMcpRequest(request.headers, body)\n if (!parsed.ok) return jsonResponse(parsed.response, parsed.status)\n\n let outcome: Awaited>\n try {\n outcome = await dispatch({ ...base, remoteIp: edgeIp(request) }, parsed.request)\n } catch {\n // Never surface an internal message; a store failure can carry\n // deployment detail that does not belong on a public endpoint.\n return jsonResponse(\n jsonRpcError(parsed.request.message.id ?? null, JsonRpcErrorCodes.internalError, 'Internal error.'),\n 200,\n )\n }\n\n if (!outcome) {\n if (!parsed.request.isNotification) {\n // A request that dispatched as a notification would otherwise hang the\n // caller waiting for a response that is never coming.\n return jsonResponse(\n jsonRpcError(\n parsed.request.message.id ?? null,\n JsonRpcErrorCodes.invalidRequest,\n `\"${parsed.request.message.method}\" is a notification and must be sent without an \"id\".`,\n ),\n 400,\n )\n }\n return new Response(null, { status: 202, headers: { 'cache-control': 'no-store' } })\n }\n\n return jsonResponse(outcome.response, outcome.status)\n }\n}\n",[],[168,354,356],"943197cc-b06b-4946-9882-f880ef9fb6c8",["D",1788456961282],[192,193],[168,354],["D",1788474101787],[],[168,80,65],["D",1788456961408],[190],[168,80],"4f817035-aa37-4dfa-9636-dc05d001c627","app.ts","ef9ec922-a7bd-11f1-ba16-1607ee4eb77e","ee205a2a-a7bd-11f1-a3ef-1607ee4eb77e",27,["D",1788474100495],"import { Hono } from 'npm:hono@4.12.25'\nimport type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport {\n type CheckRecord,\n checkFingerprint,\n type CheckStore,\n isCheckExpired,\n type JobDispatcher,\n newCheckRecord,\n normalizeUserQueries,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport {\n HumanVerificationError,\n normalizePublicDomain,\n PublicUrlError,\n utcDay,\n} from 'npm:@canonry/val-kit@0.2.0/security'\nimport { PublicQuotaError } from '../jobs/perception-check.ts'\nimport { createMcpHandler } from '../mcp/server.ts'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst MAX_BODY_BYTES = 4_096\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\nexport interface PageAssets {\n styles: string\n script: string\n /** Plated logo, used as the favicon. */\n mark: string\n /** Bare glyph, used inline in the brand lockup. */\n glyph: string\n}\n\nexport interface ValTownAppDependencies {\n store: CheckStore\n config: ValTownConfig\n dispatcher: JobDispatcher\n /** The UI is injected so this host stays independent from the renderer implementation. */\n renderPage: (record: CheckRecord | null) => string\n assets: PageAssets\n now?: () => Date\n}\n\nexport class PublicCheckUnavailableError extends Error {\n override name = 'PublicCheckUnavailableError'\n}\n\nclass PublicCheckAdmissionBusyError extends Error {\n override name = 'PublicCheckAdmissionBusyError'\n constructor() {\n super('Another request for this domain is being accepted. Try again shortly.')\n }\n}\n\nclass PublicCheckCapacityError extends Error {\n override name = 'PublicCheckCapacityError'\n constructor() {\n super('The public check is at capacity. Try again shortly.')\n }\n}\n\nexport function createValTownApp(deps: ValTownAppDependencies): Hono {\n const app = new Hono()\n const now = deps.now ?? (() => new Date())\n\n app.use('*', async (context, next) => {\n const turnstileAllowed = deps.config.publicChecksEnabled &&\n deps.config.humanVerificationStatus === 'ready' && Boolean(deps.config.turnstileSiteKey)\n context.header('Content-Security-Policy', contentSecurityPolicy(turnstileAllowed))\n context.header('X-Content-Type-Options', 'nosniff')\n context.header('Referrer-Policy', 'strict-origin-when-cross-origin')\n context.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()')\n context.header('Cross-Origin-Opener-Policy', 'same-origin')\n await next()\n })\n\n app.get('/healthz', (context) => context.json({ ok: true }))\n\n // Anonymous, read-only MCP over Streamable HTTP. It shares this app's store\n // so an agent reads exactly the checks the UI shows, and it owns its own\n // method/origin/envelope handling — including the 405 for a non-POST, which\n // is why it is registered for every method rather than POST alone.\n const mcp = createMcpHandler({\n store: deps.store,\n now,\n startCheck: deps.config.mcpStartChecksEnabled\n ? async (domain, remoteIp, queries) => {\n const outcome = await submitCheck(deps, {\n domain,\n queries,\n token: null,\n remoteIp,\n now: now(),\n admission: 'mcp',\n })\n return { record: (await deps.store.get(outcome.record.id)) ?? outcome.record, reused: outcome.reused }\n }\n : undefined,\n })\n app.all('/mcp', (context) => mcp(context.req.raw))\n // Immutable: the document references these with a content hash, so a changed\n // asset arrives under a new URL rather than waiting out a TTL.\n app.get('/assets/canonry-ui.css', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.styles, 200, { 'content-type': 'text/css; charset=utf-8' })\n })\n app.get('/assets/canonry-ui.js', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.script, 200, { 'content-type': 'application/javascript; charset=utf-8' })\n })\n app.get('/assets/canonry-mark.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.mark, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n app.get('/assets/canonry-glyph.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.glyph, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n\n app.get('/', async (context) => {\n const requestedId = context.req.query('check')\n const stored = requestedId && CHECK_ID.test(requestedId) ? await deps.store.get(requestedId) : null\n const record = stored && !isCheckExpired(stored, now()) ? stored : null\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(record))\n })\n\n app.get('/api/checks/:id', async (context) => {\n const id = context.req.param('id')\n if (!CHECK_ID.test(id)) return apiError(context, 404, 'not-found', 'Check not found.')\n const record = await deps.store.get(id)\n if (!record || isCheckExpired(record, now())) return apiError(context, 404, 'not-found', 'Check not found.')\n context.header('Cache-Control', 'no-store')\n return context.json({ check: publicCheckRecord(record) })\n })\n\n app.post('/api/checks', async (context) => {\n const payload = await parseJsonBody(context.req.raw)\n const outcome = await submitCheck(deps, {\n domain: payload.domain,\n queries: payload.queries,\n token: typeof payload.turnstileToken === 'string' ? payload.turnstileToken : null,\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n context.header('Cache-Control', 'no-store')\n if (outcome.dispatch === 'busy') {\n return apiError(context, 503, 'busy', 'The public check is at capacity. Try again shortly.')\n }\n return context.json(\n { check: publicCheckRecord(outcome.record), reused: outcome.reused },\n outcome.record.status === 'queued' || outcome.record.status === 'running' ? 202 : 200,\n )\n })\n\n app.post('/check', async (context) => {\n let submittedDomain: unknown = null\n try {\n const form = await parseFormBody(context.req.raw)\n submittedDomain = form.get('domain')\n const outcome = await submitCheck(deps, {\n domain: submittedDomain,\n queries: form.get('queries'),\n token: form.get('cf-turnstile-response'),\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n if (outcome.dispatch === 'busy') throw new PublicCheckCapacityError()\n return context.redirect(`/?check=${encodeURIComponent(outcome.record.id)}`, 303)\n } catch (error) {\n const failure = formFailureRecord(submittedDomain, now(), error)\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(failure), formFailureStatus(error))\n }\n })\n\n app.notFound((context) => apiError(context, 404, 'not-found', 'Not found.'))\n app.onError((error, context) => {\n if (error instanceof PublicUrlError) return apiError(context, 400, 'invalid-domain', error.message)\n if (error instanceof HumanVerificationError) {\n const status = error.code === 'unavailable' || error.code === 'transport' ? 503 : 403\n return apiError(context, status, `human-verification-${error.code}`, error.message)\n }\n if (error instanceof PublicQuotaError) return apiError(context, 429, `${error.scope}-quota`, error.message)\n if (error instanceof PublicCheckAdmissionBusyError) return apiError(context, 503, 'admission-busy', error.message)\n if (error instanceof PublicCheckCapacityError) return apiError(context, 503, 'busy', error.message)\n if (error instanceof PublicCheckUnavailableError) return apiError(context, 503, 'unavailable', error.message)\n if (error instanceof BodyTooLargeError) {\n return apiError(context, 413, 'body-too-large', 'Request body is too large.')\n }\n if (error instanceof InvalidBodyError) return apiError(context, 400, 'invalid-body', error.message)\n return apiError(context, 500, 'internal-error', 'The public check could not be started.')\n })\n\n return app\n}\n\ninterface CheckSubmission {\n record: CheckRecord\n reused: boolean\n dispatch: 'completed' | 'busy' | 'ignored'\n}\n\ninterface SubmitInput {\n domain: unknown\n /** Raw caller input; normalized here, never trusted as given. */\n queries?: unknown\n token: string | null\n remoteIp: string | null\n now: Date\n /**\n * Which admission rules apply. `mcp` skips human verification, which an\n * agent cannot perform, and spends from a separate, tighter daily bucket so\n * it cannot consume the browser allowance. Every other control — the global\n * daily cap, the single execution lease, cache reuse — is identical.\n */\n admission?: 'browser' | 'mcp'\n}\n\nasync function submitCheck(\n deps: ValTownAppDependencies,\n input: SubmitInput,\n): Promise {\n if (!deps.config.publicChecksEnabled) {\n throw new PublicCheckUnavailableError(\n deps.config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.',\n )\n }\n const target = normalizePublicDomain(input.domain)\n const userQueries = normalizeUserQueries(input.queries)\n const viaMcp = input.admission === 'mcp'\n if (!viaMcp) await deps.config.humanVerifier.verify({ token: input.token, remoteIp: input.remoteIp })\n // The questions join the reuse key. They change what the check measures, so\n // a second caller asking different questions about the same domain must not\n // be handed the first caller's answers.\n const fingerprint = checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, target.domain, userQueries)\n const timestamp = input.now.toISOString()\n\n // Cached and already-active work is useful without consuming the one global\n // execution slot. This keeps same-domain retries quota- and capacity-free.\n const reusable = await deps.store.findReusable(fingerprint, timestamp)\n if (reusable) return dispatchExistingCheck(deps, reusable)\n\n const hashedClient = await hashQuotaSubject(deps.config.quotaSalt, input.remoteIp ?? 'unknown')\n // A distinct subject rather than a distinct scope: `CheckQuotaClaim.scope` is\n // a closed union, and prefixing keeps the two buckets disjoint without\n // widening a durable contract.\n const clientSubject = viaMcp ? `mcp:${hashedClient}` : hashedClient\n const clientMax = viaMcp ? deps.config.mcpPerClientDailyLimit : deps.config.perClientDailyLimit\n const day = utcDay(input.now)\n const executionLeaseOwner = crypto.randomUUID()\n const executionLeaseUntil = new Date(input.now.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const capacityAvailable = await deps.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n executionLeaseOwner,\n timestamp,\n executionLeaseUntil,\n )\n if (!capacityAvailable) throw new PublicCheckCapacityError()\n\n let capacityHeld = true\n let dispatchOwnsCapacity = false\n const releaseCapacity = async () => {\n if (!capacityHeld) return\n await deps.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, executionLeaseOwner)\n capacityHeld = false\n }\n\n try {\n const admission = await deps.store.admit({\n candidate: newCheckRecord({\n id: crypto.randomUUID(),\n fingerprint,\n domain: target.domain,\n userQueries,\n now: input.now,\n }),\n now: timestamp,\n clientQuota: { scope: 'client', subject: clientSubject, day, max: clientMax },\n globalQuota: { scope: 'global', subject: 'all', day, max: deps.config.globalDailyLimit },\n })\n if (admission.kind === 'quota-exhausted') throw new PublicQuotaError(admission.scope)\n if (admission.kind === 'busy') throw new PublicCheckAdmissionBusyError()\n\n if (admission.kind === 'reused') {\n // A concurrent same-domain admission won. It must not inherit capacity\n // reserved by this request, so it goes through ordinary reuse dispatch.\n await releaseCapacity()\n return dispatchExistingCheck(deps, admission.record)\n }\n\n let dispatch: 'completed' | 'busy' | 'ignored' = 'ignored'\n if (admission.record.status === 'queued') {\n // Request-bound dispatch takes responsibility for this owner as soon as\n // it receives the promise. Its runner releases even a lost job claim.\n const dispatched = deps.dispatcher.dispatch(admission.record.id, { executionLeaseOwner })\n dispatchOwnsCapacity = true\n dispatch = await dispatched\n }\n return {\n record: (await deps.store.get(admission.record.id)) ?? admission.record,\n reused: admission.kind !== 'created',\n dispatch,\n }\n } finally {\n // The runner owns capacity only after dispatch receives the owner. The app\n // releases every admission, reuse, quota, and pre-dispatch error path.\n if (!dispatchOwnsCapacity) await releaseCapacity()\n }\n}\n\nasync function dispatchExistingCheck(\n deps: ValTownAppDependencies,\n record: CheckRecord,\n): Promise {\n const dispatch = record.status === 'queued' ? await deps.dispatcher.dispatch(record.id) : 'ignored'\n return {\n record: (await deps.store.get(record.id)) ?? record,\n reused: true,\n dispatch,\n }\n}\n\nfunction publicCheckRecord(\n record: CheckRecord,\n): Omit, 'fingerprint' | 'leaseOwner' | 'leaseUntil'> {\n const { fingerprint: _fingerprint, leaseOwner: _leaseOwner, leaseUntil: _leaseUntil, ...safe } = record\n return safe\n}\n\nfunction apiError(\n context: { json: (body: unknown, status?: number) => Response; header: (name: string, value: string) => void },\n status: number,\n code: string,\n message: string,\n): Response {\n context.header('Cache-Control', 'no-store')\n return context.json({ error: { code, message } }, status)\n}\n\nclass BodyTooLargeError extends Error {}\nclass InvalidBodyError extends Error {}\n\nasync function parseJsonBody(request: Request): Promise> {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/json')) {\n throw new InvalidBodyError('Expected a JSON request body.')\n }\n const text = await readLimitedBody(request)\n try {\n const parsed = JSON.parse(text)\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error()\n return parsed as Record\n } catch {\n throw new InvalidBodyError('Request body must be a JSON object.')\n }\n}\n\nasync function parseFormBody(request: Request): Promise {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/x-www-form-urlencoded')) {\n throw new InvalidBodyError('Expected a form submission.')\n }\n return new URLSearchParams(await readLimitedBody(request))\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const contentLength = Number(request.headers.get('content-length'))\n if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) throw new BodyTooLargeError()\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n throw new BodyTooLargeError()\n }\n chunks.push(next.value)\n }\n const output = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n output.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(output)\n}\n\nfunction remoteIp(request: Request): string | null {\n // Val injects this edge header. `x-forwarded-for` is caller-controlled on a\n // public val, so it is deliberately ignored for quota identity.\n const cf = request.headers.get('cf-connecting-ip')?.trim()\n if (cf && cf.length <= 128) return cf\n return null\n}\n\nasync function hashQuotaSubject(salt: string, value: string): Promise {\n const bytes = new TextEncoder().encode(`${salt}\\u0000${value}`)\n const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))\n return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * `frame-ancestors` allows Val Town because the val's own page previews the\n * deployed site in an iframe, and `'none'` renders that preview blank — the\n * first thing anyone arriving from val.town sees. The allowance is exactly the\n * hosting platform and nothing else, so ordinary clickjacking is still blocked.\n * There is little to hijack regardless: no session, no credential, and the only\n * action is submitting a public domain.\n */\nconst FRAME_ANCESTORS = [\"'self'\", 'https://www.val.town', 'https://val.town'].join(' ')\n\n/**\n * Geist is served from jsDelivr because a Val cannot ship the font itself:\n * woff2 is binary and Val Town refuses to push binary files. It is the same\n * package and version the dashboard bundles (`@fontsource-variable/geist`), so\n * the two surfaces render in the same typeface rather than this one silently\n * falling back to a system font, which is what it did before.\n */\nconst FONT_CDN = 'https://cdn.jsdelivr.net'\n\nfunction contentSecurityPolicy(turnstileAllowed: boolean): string {\n const turnstile = turnstileAllowed ? ' https://challenges.cloudflare.com' : ''\n return [\n \"default-src 'self'\",\n \"base-uri 'none'\",\n \"object-src 'none'\",\n `frame-ancestors ${FRAME_ANCESTORS}`,\n \"form-action 'self'\",\n `script-src 'self'${turnstile}`,\n `style-src 'self' ${FONT_CDN}`,\n `font-src ${FONT_CDN}`,\n `connect-src 'self'${turnstile}`,\n `frame-src${turnstile || \" 'none'\"}`,\n \"img-src 'self' data: https:\",\n ].join('; ')\n}\n\nfunction formFailureRecord(domain: unknown, now: Date, error: unknown): CheckRecord {\n const displayDomain = typeof domain === 'string' ? domain.trim().slice(0, 253) : ''\n const timestamp = now.toISOString()\n return {\n id: crypto.randomUUID(),\n fingerprint: '',\n domain: displayDomain,\n userQueries: [],\n status: 'failed',\n createdAt: timestamp,\n updatedAt: timestamp,\n expiresAt: null,\n result: null,\n errorCode: error instanceof PublicQuotaError ? PUBLIC_RATE_LIMITED_ERROR_CODE : 'form-submission-failed',\n errorMessage: formFailureMessage(error),\n leaseOwner: null,\n leaseUntil: null,\n }\n}\n\nfunction formFailureMessage(error: unknown): string {\n if (\n error instanceof PublicUrlError || error instanceof PublicQuotaError || error instanceof HumanVerificationError ||\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return error.message\n if (error instanceof BodyTooLargeError) return 'The submission was too large. Enter only a domain.'\n if (error instanceof InvalidBodyError) return 'The form could not be read. Try again.'\n return 'The public check could not be started. Try again later.'\n}\n\nfunction formFailureStatus(error: unknown): 400 | 403 | 413 | 429 | 503 {\n if (error instanceof PublicUrlError || error instanceof InvalidBodyError) return 400\n if (error instanceof BodyTooLargeError) return 413\n if (error instanceof PublicQuotaError) return 429\n if (\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return 503\n if (error instanceof HumanVerificationError) return error.code === 'invalid' ? 403 : 503\n return 503\n}\n",[],[168,382,374],"app","3d119210-fb81-4a4a-9cbb-b0eaa18880b4",3,["D",1788456961083],[188],[168,382],"c1a9a2b8-0174-4415-b76e-49d63d23fbdd",["D",1788456960824],[187,189,191,194,196],[168],["D",1788456812405],["D",1789501263826],{"_11":12,"_137":70},{"_11":12,"_132":133,"_69":70,"_31":-5,"_134":135,"_136":30},{"_40":123,"_13":16,"_34":37,"_124":83,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":14,"_131":12},"ctx",{"_53":-5,"_156":430,"_431":432,"_433":434,"_435":30,"_436":30,"_437":30,"_438":24,"_439":-5,"_440":-7,"_441":-7,"_442":26,"_443":30,"_444":30,"_445":-5,"_446":30,"_447":30,"_448":30,"_449":-5},"ENV",{"_401":402,"_403":404,"_405":16,"_406":407,"_408":409,"_410":411,"_412":413,"_414":415,"_416":417,"_418":419,"_420":421,"_422":423,"_424":425,"_426":427,"_428":429},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · jobs