` per row opens every verified sentence, the concerns,\n the typed sources, the searches the engine ran, and the full answer.\n3. **Concerns raised** — phrase plus \"in N of M answers\". An empty list is STATED, not omitted: \"no concern was raised\"\n is a finding, and a missing section reads as a broken page.\n4. **Sources the engine attributed** — by kind, counted once per answer, with the share and the unattributed remainder\n stated separately.\n\nOther rules the tests hold:\n\n- **Heavy explanation lives in tooltips, not inline prose.** Each section heading carries a CSS-only `info-tip`: a real\n `${\n escapeHtml(copy)\n }`\n}\n\n/**\n * One tone vocabulary for the whole page. The badge and the KPI cell read the\n * SAME `verdictTone`, so the colour of \"Cautions\" cannot be rose in one place\n * and amber in the other — which is what happens when a renderer decides tone\n * a second time.\n */\nconst VERDICT_TONE_CLASS = {\n positive: 'signal-positive',\n negative: 'signal-negative',\n caution: 'signal-caution',\n neutral: 'signal-neutral',\n} as const\n\nconst VERDICT_GLYPH = { recommends: '✓', cautions: '!', mixed: '~', none: '−' } as const\n\n/** A verdict badge, never a score. An unmeasured row is dimmed, not toned. */\nfunction verdictBadge(answer: PerceptionAnswerViewModel): string {\n const glyph = answer.verdict === null ? '?' : VERDICT_GLYPH[answer.verdict]\n const className = answer.verdict === null ? 'signal-unavailable' : VERDICT_TONE_CLASS[answer.verdictTone]\n return `${glyph}${\n escapeHtml(answer.verdictLabel)\n }`\n}\n\n/**\n * The headline cell.\n *\n * A measured verdict quotes the answer's own first verified sentence. `none`\n * gets a statement of what happened, and an unmeasured row gets the reason it\n * was not measured — the row already says \"Not measured\", and the question a\n * reader then asks is \"why\".\n */\nfunction answerHeadlineCell(answer: PerceptionAnswerViewModel): string {\n if (answer.verdict === null) {\n return `${escapeHtml(answer.error ?? 'This answer was not measured.')}`\n }\n if (answer.headline) {\n return `${escapeHtml(answer.headline)}`\n }\n return 'The answer described the brand without taking a position.'\n}\n\nfunction renderSource(source: PerceptionSourceViewModel): string {\n const url = safeUrl(source.url)\n const title = source.title?.trim() || (url ? safeHost(url) : 'Unavailable source')\n const host = url ? safeHost(url) : source.domain\n const meta = `${escapeHtml(host ?? 'Unattributed host')} · ${escapeHtml(source.typeLabel)}`\n if (!url) {\n return `

${escapeHtml(title)}${meta}

`\n }\n return `

${\n escapeHtml(title)\n }${meta}

`\n}\n\nfunction renderAnswerDetails(answer: PerceptionAnswerViewModel): string {\n const quotes = answer.evidenceSentences.length\n ? `

What the answer said

${escapeHtml(sentence)}

`\n : `

What the answer said

${\n answer.verdict === null\n ? 'This answer was not measured, so nothing was read out of it.'\n : 'No sentence in this answer took a position on the brand.'\n }

`\n const concerns = answer.concerns.length\n ? `

Concerns this answer raised

${escapeHtml(concern)}

`\n : ''\n const sources = answer.sources.length\n ? `

${answer.sources.map(renderSource).join('')}`\n : `

${\n answer.verdict === null\n ? 'This answer was not measured, so no source was attributed to it.'\n : 'The engine attributed no source to this answer.'\n }

`\n const searches = answer.searchQueries.length\n ? `

Searches the engine ran${\n escapeHtml(answer.searchQueries.join(', '))\n }

`\n : ''\n const models = [\n answer.requestedModel ? `Requested: ${escapeHtml(answer.requestedModel)}` : '',\n answer.servedModel ? `Served: ${escapeHtml(answer.servedModel)}` : '',\n answer.completedAt && formatTime(answer.completedAt)\n ? `Completed: ${escapeHtml(formatTime(answer.completedAt)!)}`\n : '',\n ].filter(Boolean).join('')\n const answerText = answer.answerText\n ? `

Full answer

${\n escapeHtml(clip(answer.answerText))\n }

`\n : '

Answer text was not retained for this result.

'\n const error = answer.error\n ? `

Not measured${escapeHtml(answer.error)}

`\n : ''\n return `\n

View evidence

${models}

\n ${quotes}${concerns}${error}\n

Sources

${sources}

\n ${searches}\n ${answerText}\n

`\n}\n\n/**\n * The headline row.\n *\n * Flat KPI cells, never progress bars: \"2 of 3 answers\" has no target to fill,\n * and a bar would invent one. The denominator is written under every number\n * rather than once at the top, because the number and the bound it rests on\n * have to be read together.\n */\nfunction renderVerdictSnapshot(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const checkedAt = formatTime(perception.checkedAt)\n const cells = perception.verdicts.map((verdict) =>\n `

${escapeHtml(verdict.label)}

${\n measured === 0\n ? '

Not measured

'\n : `

${verdict.count}

`\n }${\n measured === 0 ? 'No answer was measured' : `of ${measured} ${plural(measured, 'answer', 'answers')}`\n }

`\n ).join('')\n return `\n

Verdict snapshot${renderInfoTip(VERDICT_TIP)}

\n ${checkedAt ? `

Checked ${escapeHtml(checkedAt)}

` : ''}\n

${perception.requestedAnswers} branded ${\n plural(perception.requestedAnswers, 'question', 'questions')\n }Gemini${measured} measured

${cells}\n

`\n}\n\nfunction renderAnswers(perception: PerceptionViewModel): string {\n const rows = perception.answers.map((answer) => `\n \n ${escapeHtml(answer.query)}\n ${verdictBadge(answer)}\n ${answerHeadlineCell(answer)}\n ${\n // An unmeasured answer has no sources because there is no answer, not\n // because the engine attributed none. A 0 here would be a measured zero.\n answer.verdict === null\n ? 'not measured'\n : answer.sources.length\n }\n ${renderAnswerDetails(answer)}\n `).join('')\n const empty =\n '

No answers were recorded

Answers appear once the engine replies to a branded question.

'\n return `\n

Answers${renderInfoTip(ANSWERS_TIP)}

\n ${perception.notice ? renderNotice(perception.notice) : ''}\n ${\n perception.answers.length\n ? `

${rows}

Branded question	Verdict	What the answer said	Sources	Evidence

`\n : empty\n }\n

`\n}\n\nfunction renderConcerns(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const body = perception.concerns.length\n ? `

${escapeHtml(concern.phrase)}in ${concern.answers} of ${measured} ${\n plural(measured, 'answer', 'answers')\n }

`\n : `

${\n measured === 0\n ? 'No answer was measured, so no concern could be read out of one.'\n : `No concern was raised in the ${measured} ${plural(measured, 'answer', 'answers')} measured.`\n }

`\n return `\n

Concerns raised${\n renderInfoTip(CONCERNS_TIP)\n }

\n ${body}\n

`\n}\n\nfunction renderSourceTypes(perception: PerceptionViewModel): string {\n const share = perception.sourceTypes\n const body = share\n ? `

${\n share.entries.map((entry) =>\n ``\n ).join('')\n }

Kind of source	Answers	Share
${escapeHtml(entry.label)}	${entry.answers} of ${share.measuredAnswers}	${entry.percent}%

${\n share.unattributedAnswers > 0\n ? `

${share.unattributedAnswers} measured ${\n plural(share.unattributedAnswers, 'answer', 'answers')\n } attributed no source at all, and ${\n plural(share.unattributedAnswers, 'is', 'are')\n } excluded from the share.

`\n : ''\n }`\n : `

${\n perception.measuredAnswers === 0\n ? 'No answer was measured, so no source could be attributed.'\n : 'No measured answer attributed a source.'\n }

`\n return `\n

Sources the engine attributed${\n renderInfoTip(SOURCES_TIP)\n }

\n ${body}\n

`\n}\n\n/**\n * The waiting state, revealed by script when a check is submitted.\n *\n * A check takes about 45 seconds and execution is request-bound, so a native\n * form POST leaves the browser blocked on a navigation for the whole time with\n * nothing on screen but a disabled button. The work still happens inside one\n * request; this just stops that request being the thing the browser is painting.\n *\n * It claims only what is knowable while waiting. The domain and any questions\n * the visitor typed are theirs already, and elapsed time is counted rather than\n * guessed. There is ONE track, not a list of phases: this runner really is\n * sequential — plan, then probe, then read the answers back — but the server\n * reports no phase, so naming three of them would tell the reader which one is\n * running when nothing knows that.\n */\nfunction renderLoadingView(): string {\n return `\n `\n}\n\n/**\n * The form does two different jobs, so it gets two treatments.\n *\n * On the landing page it is the ONLY thing to do, so it is the hero: a full\n * headline, a large field, and the scope note underneath. On a result page the\n * reader already has what they came for, so it shrinks into the header as a\n * secondary action and drops the onboarding copy.\n */\nfunction renderCheckForm(model: BrandPerceptionViewModel, variant: 'hero' | 'compact' = 'compact'): string {\n if (!model.form) return ''\n const value = model.status === 'empty' ? '' : model.domain\n const verificationStatus = model.form.verificationStatus ?? (model.form.turnstileSiteKey ? 'ready' : 'not-required')\n const hasTurnstile = Boolean(model.form.turnstileSiteKey && verificationStatus === 'ready')\n const disabled = verificationStatus === 'unavailable'\n // interaction-only: the challenge still runs on load, so a token is ready at\n // submit, but the widget is drawn only if the visitor has to do something.\n const verification = hasTurnstile\n ? `

`\n : verificationStatus === 'unavailable'\n ? `

!${\n escapeHtml(\n model.form.verificationUnavailableMessage ?? 'Human verification is unavailable. Public checks are disabled.',\n )\n }

`\n : ''\n const verificationSlot = verification\n ? `

${verification}

`\n : ''\n const hero = variant === 'hero'\n const submitLabel = model.form.submitLabel ?? 'Check a brand'\n return `\n `\n}\n\nfunction brandLockup(glyphHref: string): string {\n return `

brand perception checkpowered by $\"\"$ Canonry

`\n}\n\nconst FOOTER_LINKS =\n 'npm i -g @canonry/canonryGitHub canonry.ai'\n\nfunction renderMain(model: BrandPerceptionViewModel): string {\n const glyphHref = assetUrl(DEFAULT_GLYPH_SRC, canonryGlyph)\n const globalNotice = (model.status === 'ready' ? model.notice : model.notice ?? statusCopy(model.status)) ?? undefined\n const perception = model.perception\n // Nothing has been checked yet, so a report header over two empty panels is\n // scaffolding around an absence. Lead with the one action instead.\n if (model.status === 'empty') {\n return `\n

\n \n

What does AI say about your brand?${renderInfoTip(LANDING_EXPLAINER)}

\n ${renderCheckForm(model, 'hero')}\n

\n ${renderLoadingView()}\n

\n \n

`\n }\n return `\n

\n \n

${escapeHtml(model.domain)}

\n ${renderNotice(globalNotice)}\n

\n ${\n perception\n ? `${renderVerdictSnapshot(perception)}${renderAnswers(perception)}${renderConcerns(perception)}${\n renderSourceTypes(perception)\n }`\n : '

No brand perception result

Start a check to see what an answer engine says about this brand.

'\n }\n

\n \n

`\n}\n\n/** Returns a complete document so the runtime can use it as an HTTP response body. */\nexport function renderBrandPerception(model: BrandPerceptionViewModel): string {\n const title = `${model.displayName} | ${PRODUCT_NAME}`\n return `\n\n \n \n \n \n ${escapeHtml(title)}\n \n \n \n \n \n \n ${\n model.form?.turnstileSiteKey && (model.form.verificationStatus ?? 'ready') === 'ready'\n ? ''\n : ''\n }\n \n ${renderMain(model)}\n`\n}\n\n/** Useful for a host that owns the outer document or wants an embedded fragment. */\nexport function renderBrandPerceptionBody(model: BrandPerceptionViewModel): string {\n return renderMain(model)\n}\n",[],[186,300,310],"240f901b-5542-496b-9b40-286484e09595","index.ts","ef885f02-a7bd-11f1-b787-1607ee4eb77e",28,["D",1788474100506],"export { createPublicCheckForm } from './check-form.ts'\nexport { brandPerceptionClientScript, QUERY_HINT_SUFFIX } from './client.ts'\nexport { emptyLandingViewModel, toBrandPerceptionViewModel } from './from-check-record.ts'\nexport type { CheckRecordViewOptions } from './from-check-record.ts'\nexport { assetUrl, PRODUCT_NAME, renderBrandPerception, renderBrandPerceptionBody } from './render.ts'\nexport { brandPerceptionStyles } from './styles.ts'\nexport { canonryGlyph, canonryMark } from 'npm:@canonry/val-kit@0.2.0/ui'\nexport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n ConcernViewModel,\n DemoUiStatus,\n PerceptionAnswerViewModel,\n PerceptionSourceViewModel,\n PerceptionViewModel,\n SourceTypeEntryViewModel,\n SourceTypeViewModel,\n UiAction,\n UiNotice,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n",[],[186,300,318],"6b9685aa-3d18-4d29-8716-5bdde5e9fad7","from-check-record.ts","ef63417c-a7bd-11f1-b229-1607ee4eb77e",39,["D",1788474100718],"import {\n type CheckRecord,\n PUBLIC_CHECK_UNAVAILABLE,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type {\n PerceptionEvidence,\n PerceptionReport,\n PerceptionVerdict,\n SourceType,\n} from 'npm:@canonry/val-kit@0.2.0/perception'\nimport type { PerceptionCheckResult } from '../runtime/check-result.ts'\nimport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n PerceptionAnswerViewModel,\n PerceptionViewModel,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n\nexport interface CheckRecordViewOptions {\n form?: CheckFormViewModel\n displayName?: string\n title?: string\n}\n\nconst LOCAL_READY_FORM: CheckFormViewModel = {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n verificationStatus: 'not-required',\n submitLabel: 'Check a brand',\n}\n\n/**\n * The verdict vocabulary, written once.\n *\n * `none` is a POSITION — the answer described the brand and took none — so it\n * gets a neutral tone and a label that says what happened, never \"no data\".\n * `null` is the absence of a measurement and is handled separately, because\n * collapsing the two would turn an outage into a finding.\n */\nconst VERDICT_COPY: Readonly> = {\n recommends: { label: 'Recommends', tone: 'positive' },\n cautions: { label: 'Cautions', tone: 'negative' },\n mixed: { label: 'Mixed', tone: 'caution' },\n none: { label: 'Took no position', tone: 'neutral' },\n}\n\n/** What KIND of place, in the reader's words. Never \"where opinions come from\". */\nconst SOURCE_TYPE_LABELS: Readonly> = {\n official: 'The brand’s own site',\n community: 'Community',\n review: 'Review site',\n news: 'News',\n other: 'Other',\n}\n\n/**\n * Converts a sanitized, durable public-check record into the narrow UI model.\n * It deliberately never turns an unmeasured answer into a neutral verdict.\n */\nexport function toBrandPerceptionViewModel(\n record: CheckRecord | null,\n options: CheckRecordViewOptions = {},\n): BrandPerceptionViewModel {\n const domain = record?.domain ?? ''\n const result = record?.result ?? null\n const status = record ? mapStatus(record) : 'empty'\n const resultDomain = result?.domain || domain\n\n return {\n status,\n title: options.title,\n displayName: options.displayName ?? nameFromDomain(resultDomain || 'Brand'),\n domain: resultDomain,\n form: { ...LOCAL_READY_FORM, ...options.form },\n perception: result?.perception ? mapPerception(result.perception) : undefined,\n notice: buildNotice(record, result),\n }\n}\n\n/**\n * Did anything in this check actually fail?\n *\n * `record.status` is decided once, when the check runs, and stored, which makes\n * it the wrong thing to warn a reader off: correcting the rule behind it never\n * reaches a record already written, so a shared link keeps showing the old\n * verdict for its whole 24h life. The evidence is right here in the result, so\n * read it instead of the flag.\n */\nfunction hasFailedWork(record: CheckRecord): boolean {\n const result = record.result\n if (!result) return false\n if (result.errors.length > 0) return true\n return (result.perception?.evidence ?? []).some((row) => row.verdict === null)\n}\n\nfunction mapStatus(record: CheckRecord): BrandPerceptionViewModel['status'] {\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) return 'rate-limited'\n switch (record.status) {\n case 'queued':\n case 'running':\n return 'loading'\n case 'partial':\n // A stored `partial` is only worth a caution when something in the result\n // actually failed. See `hasFailedWork`.\n return hasFailedWork(record) ? 'partial' : 'ready'\n case 'failed':\n return 'error'\n case 'complete':\n return 'ready'\n }\n}\n\nfunction mapPerception(report: PerceptionReport): PerceptionViewModel {\n const failed = report.summary.failedChecks\n const sourceTypes = report.summary.sourceTypes\n return {\n requestedAt: report.startedAt,\n checkedAt: report.completedAt,\n measuredAnswers: report.summary.successfulChecks,\n requestedAnswers: report.evidence.length,\n failedAnswers: failed,\n // Fixed order, so the row reads the same on every check and a count that\n // happens to be zero keeps its column rather than shuffling the others.\n verdicts: (['recommends', 'cautions', 'mixed', 'none'] as const).map((key): VerdictCountViewModel => ({\n key,\n label: VERDICT_COPY[key].label,\n tone: VERDICT_COPY[key].tone,\n count: report.summary.verdicts[key],\n })),\n concerns: report.summary.concerns.map((concern) => ({ phrase: concern.phrase, answers: concern.answers })),\n // Percentages round for display only; the shares they come from sum to 1.\n sourceTypes: sourceTypes\n ? {\n measuredAnswers: sourceTypes.measuredAnswers,\n unattributedAnswers: sourceTypes.unattributedAnswers,\n totalAppearances: sourceTypes.totalAppearances,\n entries: sourceTypes.entries.map((entry) => ({\n type: entry.type,\n label: SOURCE_TYPE_LABELS[entry.type],\n answers: entry.answers,\n percent: Math.round(entry.share * 100),\n })),\n }\n : undefined,\n answers: report.evidence.map(mapAnswer),\n notice: failed > 0\n ? {\n tone: 'caution',\n title: `${failed} ${failed === 1 ? 'answer' : 'answers'} unavailable`,\n // The reason leads, because that is what a row reading \"Not measured\"\n // makes someone ask. It is only stated when the failures agree on one;\n // with several the banner would have to pick one and be wrong about the\n // rest, so it defers to the per-row evidence instead.\n detail: `${failureReason(report.evidence) ?? ''}Every count uses the answers that were measured.`,\n }\n : undefined,\n }\n}\n\n/** The one reason every unmeasured answer shares, or null when they disagree. */\nfunction failureReason(evidence: readonly PerceptionEvidence[]): string | null {\n const reasons = new Set(\n evidence.filter((row) => row.verdict === null)\n .map((row) => row.error)\n // The generic sentence is the ABSENCE of a reason. Leading with it\n // produces \"1 answer unavailable. This answer-engine check was\n // unavailable.\" — the banner restating its own title.\n .filter((error): error is string => Boolean(error) && error !== PUBLIC_CHECK_UNAVAILABLE),\n )\n if (reasons.size !== 1) return null\n const [reason] = [...reasons]\n return reason ? `${reason} ` : null\n}\n\nfunction mapAnswer(row: PerceptionEvidence): PerceptionAnswerViewModel {\n const copy = row.verdict === null ? null : VERDICT_COPY[row.verdict]\n return {\n id: `${row.provider}:${row.query}:${row.completedAt}`,\n query: row.query,\n verdict: row.verdict,\n verdictLabel: copy?.label ?? 'Not measured',\n verdictTone: copy?.tone ?? 'neutral',\n // The answer's own first sentence, or nothing. A verdict of 'none' carries\n // no evidence by construction, and inventing a line to fill the cell would\n // put words in an answer that did not write them.\n headline: row.evidenceSentences[0] ?? null,\n evidenceSentences: row.evidenceSentences,\n concerns: row.concerns,\n sources: row.sources.map((source) => ({\n url: source.url,\n title: source.title,\n domain: source.domain,\n typeLabel: SOURCE_TYPE_LABELS[source.type],\n })),\n searchQueries: row.searchQueries,\n answerText: row.answerText,\n requestedModel: row.requestedModel,\n servedModel: row.servedModel,\n completedAt: row.completedAt,\n error: row.error,\n }\n}\n\nfunction buildNotice(\n record: CheckRecord | null,\n result: PerceptionCheckResult | null,\n): BrandPerceptionViewModel['notice'] {\n if (!record) return undefined\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) {\n return {\n tone: 'caution',\n title: 'Check limit reached',\n detail: record.errorMessage ?? 'This public sample has reached its current limit. Try again later.',\n }\n }\n if (record.status === 'failed') {\n return {\n tone: 'negative',\n title: 'This check could not finish',\n detail: result?.errors[0]?.message ?? record.errorMessage ?? 'Try another public domain later.',\n }\n }\n const first = result?.errors[0]\n if (first) return { tone: 'caution', title: 'Brand perception was unavailable', detail: first.message }\n return undefined\n}\n\nfunction nameFromDomain(domain: string): string {\n const host = domain.replace(/^www\\./i, '').split('.')[0] ?? domain\n return host\n .replace(/[-_]+/g, ' ')\n .replace(/\\b\\w/g, (letter) => letter.toUpperCase())\n}\n\n/**\n * The landing view, shown before anything has been checked.\n *\n * It carries no `perception` because nothing has been measured yet. A fixture\n * here would be read as measurement by anyone who scrolled past the badge that\n * qualified it — and a fabricated verdict about a real brand is a worse lie\n * than a fabricated percentage. An empty state is the honest thing to show when\n * the answer is \"nothing yet\".\n */\nexport function emptyLandingViewModel(form: CheckFormViewModel): BrandPerceptionViewModel {\n return {\n status: 'empty',\n title: 'Brand Perception Check',\n displayName: 'Check a brand',\n domain: '',\n form,\n }\n}\n",[],[186,300,326],"19bf501c-ea6f-43f0-9f73-2295a95628cb","client.ts","ef6e34d8-a7bd-11f1-b787-1607ee4eb77e",15,["D",1788456963255],"/**\n * The one place the timing is written. The script below rewrites the query\n * hint's text on every keystroke, so a suffix left only in the server markup\n * would survive until the visitor types and then silently disappear.\n */\nexport const QUERY_HINT_SUFFIX = 'Takes about 45 seconds.'\n\n/** Client-side enhancement only. The page remains usable with native forms and details. */\nexport const brandPerceptionClientScript = `\n(() => {\n const queries = document.querySelector('[data-query-hint]');\n const queryInput = document.getElementById('queries-input');\n if (queries && queryInput) {\n const max = Number(queries.dataset.max || 3);\n const update = () => {\n const used = queryInput.value.split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).length;\n const kept = Math.min(used, max);\n const rest = max - kept;\n const counts = kept === 0\n ? 'Add up to ' + max + '. We generate the rest.'\n : rest === 0\n ? 'Using your ' + kept + '. We generate none.'\n : 'Using your ' + kept + '. We generate the other ' + rest + '.';\n // Interpolated at module load so the server markup and every rewrite of\n // this line read one constant.\n queries.textContent = counts + ' ' + ${JSON.stringify(QUERY_HINT_SUFFIX)};\n };\n queryInput.addEventListener('input', update);\n update();\n }\n\n const form = document.querySelector('[data-domain-check-form]');\n if (form) {\n const submit = form.querySelector('[data-domain-submit]');\n const busy = form.querySelector('[data-form-busy]');\n const checking = document.querySelector('[data-checking]');\n\n const markBusy = () => {\n form.setAttribute('aria-busy', 'true');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = true;\n submit.setAttribute('aria-disabled', 'true');\n submit.textContent = 'Starting…';\n }\n if (busy) {\n busy.hidden = false;\n busy.classList.remove('is-error');\n busy.textContent = 'Starting check…';\n }\n };\n\n // Without the waiting view there is nothing to enhance: fall back to the\n // native POST, which still works, just with a blocked browser.\n if (!checking) {\n form.addEventListener('submit', markBusy);\n } else {\n const elapsedEl = checking.querySelector('[data-checking-elapsed]');\n const domainEl = checking.querySelector('[data-checking-domain]');\n const queriesEl = checking.querySelector('[data-checking-queries]');\n const hero = document.querySelector('[data-hero]');\n\n const restore = (message) => {\n checking.hidden = true;\n if (hero) hero.hidden = false;\n form.removeAttribute('aria-busy');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = false;\n submit.removeAttribute('aria-disabled');\n submit.textContent = submit.dataset.label || 'Check a brand';\n }\n if (busy) {\n busy.hidden = false;\n // A failure and \"Starting check…\" must not be the same grey line, or\n // hiding the waiting view reads as the page bouncing back to the form\n // with nothing said, while the reason sits on screen unnoticed.\n busy.classList.add('is-error');\n busy.textContent = message;\n }\n // A Turnstile token is redeemed exactly once. The page is still here\n // after a failure, so the spent token has to be replaced before the\n // visitor can try again.\n if (window.turnstile && typeof window.turnstile.reset === 'function') {\n try { window.turnstile.reset(); } catch (_) { /* widget absent */ }\n }\n };\n\n form.addEventListener('submit', (event) => {\n const data = new FormData(form);\n const domain = String(data.get('domain') || '').trim();\n if (!domain) return;\n event.preventDefault();\n markBusy();\n\n if (domainEl) domainEl.textContent = domain;\n const typed = String(data.get('queries') || '')\n .split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).slice(0, 3);\n if (queriesEl) {\n queriesEl.textContent = '';\n for (const question of typed) {\n const item = document.createElement('li');\n item.textContent = question;\n queriesEl.appendChild(item);\n }\n queriesEl.hidden = typed.length === 0;\n }\n if (hero) hero.hidden = true;\n checking.hidden = false;\n\n const started = Date.now();\n const tick = setInterval(() => {\n if (elapsedEl) elapsedEl.textContent = Math.round((Date.now() - started) / 1000) + 's';\n }, 1000);\n\n fetch(form.dataset.jsonAction || '/api/checks', {\n method: 'POST',\n headers: { 'content-type': 'application/json', accept: 'application/json' },\n body: JSON.stringify({\n domain: domain,\n queries: typed,\n turnstileToken: data.get('cf-turnstile-response') || null,\n }),\n })\n .then((response) => response.json().then((body) => ({ ok: response.ok, body: body })))\n .then((result) => {\n clearInterval(tick);\n const id = result.body && result.body.check && result.body.check.id;\n if (result.ok && id) {\n location.href = '/?check=' + encodeURIComponent(id);\n return;\n }\n const error = result.body && result.body.error;\n restore((error && error.message) || 'The check could not be started. Try again.');\n })\n .catch(() => {\n clearInterval(tick);\n restore('The check could not be reached. Try again.');\n });\n });\n }\n }\n})();\n`\n",[],[186,300,334],"67b1c31f-10ed-422c-8d13-8e917295ccf4","check-form.ts","ef3bc3ea-a7bd-11f1-8727-1607ee4eb77e",["D",1788474100516],"import type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport type { CheckFormViewModel } from './types.ts'\n\ntype PublicCheckFormConfig = Pick<\n ValTownConfig,\n | 'publicChecksEnabled'\n | 'publicChecksUnavailableMessage'\n | 'humanVerificationStatus'\n | 'turnstileSiteKey'\n>\n\n/** Builds the public form from the complete admission capability, not CAPTCHA alone. */\nexport function createPublicCheckForm(config: PublicCheckFormConfig): CheckFormViewModel {\n const unavailable = !config.publicChecksEnabled\n return {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n turnstileSiteKey: unavailable ? null : config.turnstileSiteKey,\n turnstileAction: 'audit',\n verificationStatus: unavailable ? 'unavailable' : config.humanVerificationStatus,\n verificationUnavailableMessage: unavailable\n ? config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.'\n : 'Human verification is not configured. Public checks are disabled.',\n submitLabel: 'Check a brand',\n }\n}\n",[],[186,300,342],"ded814b2-e46f-462c-a9f1-97a00b7b4d1b",["D",1788456960982],[219,220,221,222,223,224,225],[186,300],"b1055b7a-88af-4680-b7c7-bc6dfa7ef335","check-result.ts","efb36968-a7bd-11f1-a791-1607ee4eb77e","ee30f538-a7bd-11f1-a791-1607ee4eb77e",33,["D",1788474102019],"/**\n * What THIS val's check produces, and the reuse namespace that retires it.\n *\n * `@canonry/val-kit` is opaque to both: a `CheckRecord`\n * carries this schema through the kit's admission, lease, quota, and storage\n * machinery without the kit ever reading inside it, and `checkFingerprint` takes\n * the namespace as its first argument rather than inventing one. That is what\n * lets this val and the AI Visibility Check val store entirely different results\n * in the same table without either serving the other's cached work.\n */\nimport type { PerceptionReport } from 'npm:@canonry/val-kit@0.2.0/perception'\n\n/**\n * The reuse namespace for this product. It is the FIRST field of every\n * fingerprint, which is both the 24h cache key and the one-active-check index.\n *\n * Bump it — and only it — when a change adds or removes a measured signal, so\n * records that lack the new signal stop satisfying new requests at the moment\n * the signal set changed rather than at their own TTL. Never bump another\n * product's namespace, and never reuse one: two products keyed alike would\n * serve each other's results as cache hits, and a perception check and a\n * visibility check for one domain measure entirely different things.\n */\nexport const CHECK_FINGERPRINT_NAMESPACE = 'perception-v1'\n\nexport const CHECK_RESULT_SCHEMA_VERSION = '1.0' as const\n\nexport interface PerceptionCheckResult {\n schemaVersion: typeof CHECK_RESULT_SCHEMA_VERSION\n domain: string\n generatedAt: string\n /** Null when the one phase produced nothing at all. */\n perception: PerceptionReport | null\n errors: Array<{ area: 'perception'; message: string }>\n}\n",[],[186,361,353],"runtime","4f9d45fe-bb61-49dc-95e1-7721ed13d71e",4,["D",1788456961187],[217],[186,361],["D",1788474102392],[],[186,98,81],["D",1788474102328],[],[186,98,67],["D",1788456961282],[214,215],[186,98],"8095e465-176e-46c9-93c3-c168a95fb230","perception-check.ts","eff3ae6a-a7bd-11f1-bcaa-1607ee4eb77e","ee5205ca-a7bd-11f1-adc2-1607ee4eb77e",32,["D",1788474101787],"import {\n type CheckStore,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_CHECK_UNAVAILABLE,\n type PublicCheckDispatchOptions,\n type PublicCheckRunner,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type {\n PerceptionEvidence,\n PerceptionProbePort,\n PerceptionReport,\n PerceptionSummary,\n} from 'npm:@canonry/val-kit@0.2.0/perception'\nimport { safeProviderErrorMessage } from 'npm:@canonry/val-kit@0.2.0/visibility'\nimport { CHECK_RESULT_SCHEMA_VERSION, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\n/**\n * Ceiling for one check's provider work.\n *\n * There is ONE phase here, and it runs three deadlines in sequence: the branded\n * planner, one wave of probes, and the verdict extraction. `perception-budget.test.ts`\n * is the only thing that connects those numbers to this one.\n */\nexport const PUBLIC_CHECK_WORK_BUDGET_MS = 45_000\n\nconst PERCEPTION_GENERIC_ERROR = 'The brand perception check could not complete.'\nconst PERCEPTION_TIMEOUT_ERROR = 'The brand perception check timed out.'\nconst PERCEPTION_NOT_CONFIGURED_ERROR = 'The brand perception check is not configured for this demo.'\n\n/**\n * Why one branded question could not be measured, in the visitor's words.\n *\n * The probe runner already classifies a failure into a small closed set of\n * strings, and none of them carry a provider body, a request id, or a\n * credential. They are translated rather than passed through for two reasons.\n * The upstream wording says \"provider\", which is not a word this page uses. And\n * a sanitizer must not trust its input: an adapter that one day puts a transport\n * dump in `message` falls through to the generic sentence instead of publishing\n * it.\n */\nconst PUBLIC_PROBE_ERRORS = new Map([\n ['The provider request timed out.', 'The answer engine did not respond in time.'],\n ['The provider request was cancelled.', 'This check was cancelled before the answer engine replied.'],\n ['The provider rate-limited this request.', 'The answer engine rate-limited this check.'],\n ['The provider was temporarily unavailable.', 'The answer engine was temporarily unavailable.'],\n ['The provider credentials were rejected.', 'This check could not be authorized with the answer engine.'],\n ['The provider response contained no answer text.', 'The answer engine returned no answer text.'],\n ['The provider answer was cut off at the length limit.', 'The answer engine ran out of room mid-answer.'],\n ['The provider declined to answer this query.', 'The answer engine declined to answer this question.'],\n [\n 'The provider stopped the answer to avoid reciting a source.',\n 'The answer engine stopped short to avoid quoting a source.',\n ],\n ['The provider does not support the language of this query.', 'The answer engine does not support this language.'],\n ['The provider ended the answer on an internal tool error.', 'The answer engine hit an internal error mid-answer.'],\n [\n 'The provider ended the answer without writing anything.',\n 'The answer engine finished without saying anything for this question.',\n ],\n ['The provider stopped the answer for an unstated reason.', 'The answer engine stopped without giving a reason.'],\n ['The provider response has an invalid requested model.', 'The answer engine reported an unusable model.'],\n ['The provider request failed.', 'The answer engine did not return an answer.'],\n])\n\n/** Exported for the test that pins every runner failure to a public sentence. */\nexport function publicProbeError(message: string | null): string | null {\n if (message === null) return null\n return PUBLIC_PROBE_ERRORS.get(message) ?? PUBLIC_CHECK_UNAVAILABLE\n}\n\n/**\n * Why the whole PHASE could not run, as opposed to why one question failed.\n *\n * A phase throw is a planning failure or a provider failure thrown before a\n * single probe ran, and both arrive as an Error whose message the classifier\n * below already reduces to a closed set. Anything it does not recognize becomes\n * the generic sentence, so an unbounded provider message can never reach the\n * durable public record.\n */\nconst PUBLIC_PERCEPTION_PHASE_ERRORS = new Map([\n ['The provider rate-limited this request.', 'The answer engine rate-limited this check.'],\n ['The provider was temporarily unavailable.', 'The answer engine was temporarily unavailable.'],\n ['The provider credentials were rejected.', 'This check could not be authorized with the answer engine.'],\n ['The provider request timed out.', 'The answer engine did not respond in time.'],\n])\n\n/** Exported for the test that pins every phase failure to a public sentence. */\nexport function perceptionPhaseError(error: unknown): string {\n if (isTimeout(error)) return PERCEPTION_TIMEOUT_ERROR\n if (!(error instanceof Error)) return PERCEPTION_GENERIC_ERROR\n\n const classified = PUBLIC_PERCEPTION_PHASE_ERRORS.get(safeProviderErrorMessage(error))\n if (classified) return classified\n\n // A planning failure is the val's own string, not a provider body, and it is\n // a fact about the BRAND rather than about the engine: nothing could be asked\n // because nothing could be asked ABOUT. That is the difference between \"try\n // again\" and \"this will not work\".\n if (/perception planner/i.test(error.message)) {\n return 'Branded questions could not be generated for this brand.'\n }\n return PERCEPTION_GENERIC_ERROR\n}\n\nexport class PublicQuotaError extends Error {\n override name = 'PublicQuotaError'\n constructor(readonly scope: 'client' | 'global') {\n super(scope === 'client' ? 'Daily check limit reached.' : 'The public check is at capacity. Try again tomorrow.')\n }\n}\n\nexport interface PerceptionCheckRunnerOptions {\n store: CheckStore\n perceptionProbe: PerceptionProbePort | null\n ttlMs: number\n now?: () => Date\n}\n\nexport function createPerceptionCheckRunner(options: PerceptionCheckRunnerOptions): PublicCheckRunner {\n const now = options.now ?? (() => new Date())\n return {\n async run(checkId, dispatchOptions: PublicCheckDispatchOptions = {}) {\n const owner = dispatchOptions.executionLeaseOwner ?? crypto.randomUUID()\n const started = now()\n const jobLeaseUntil = new Date(started.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n // A supplied reservation must be released even when the durable job\n // vanished before this request-bound runner could claim it.\n let shouldReleaseExecutionLease = dispatchOptions.executionLeaseOwner !== undefined\n\n try {\n const record = await options.store.claimJob(checkId, owner, started.toISOString(), jobLeaseUntil)\n if (!record) return 'ignored'\n\n // Renew an admission reservation (or claim a direct-run lease) after\n // the durable job claim. A slow admission must never reach provider\n // work on a reservation that has expired in the meantime.\n const renewalAt = now()\n const executionLeaseUntil = new Date(renewalAt.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const hasExecutionLease = await options.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n owner,\n renewalAt.toISOString(),\n executionLeaseUntil,\n )\n if (!hasExecutionLease) {\n // A transient capacity race, not a failed check. Persist it back to\n // the queue so a later request can safely claim it.\n return (await options.store.requeueJob(checkId, owner, now().toISOString())) ? 'busy' : 'ignored'\n }\n shouldReleaseExecutionLease = true\n\n const signal = AbortSignal.timeout(PUBLIC_CHECK_WORK_BUDGET_MS)\n const errors: PerceptionCheckResult['errors'] = []\n let perception: PerceptionReport | null = null\n try {\n if (!options.perceptionProbe) throw new PerceptionNotConfiguredError()\n perception = sanitizePerception(\n await options.perceptionProbe.probe({\n domain: record.domain,\n userQueries: record.userQueries,\n maxProbeCalls: 3,\n signal,\n }),\n )\n } catch (error) {\n errors.push({\n area: 'perception',\n message: error instanceof PerceptionNotConfiguredError\n ? PERCEPTION_NOT_CONFIGURED_ERROR\n : perceptionPhaseError(error),\n })\n }\n\n const completedAt = now()\n const result: PerceptionCheckResult = {\n schemaVersion: CHECK_RESULT_SCHEMA_VERSION,\n domain: record.domain,\n generatedAt: completedAt.toISOString(),\n perception,\n errors,\n }\n // A report where nothing was measured produced no finding at all: every\n // denominator below it would be zero, so the record is a failure rather\n // than a result with empty sections. Reaching a configured ceiling is\n // never a failure here — there is no ceiling to reach, only questions\n // that were answered or were not.\n const status = perception === null || perception.summary.successfulChecks === 0\n ? 'failed'\n : perception.summary.failedChecks > 0 || errors.length > 0\n ? 'partial'\n : 'complete'\n await options.store.finalizeJob(checkId, owner, {\n status,\n updatedAt: completedAt.toISOString(),\n // Failed checks are never reused, but they still need a TTL so their\n // public capability URL and durable row do not live forever.\n expiresAt: new Date(completedAt.getTime() + options.ttlMs).toISOString(),\n result,\n errorCode: status === 'failed' ? 'check-failed' : null,\n errorMessage: status === 'failed' ? 'The public check could not complete.' : null,\n })\n return 'completed'\n } finally {\n if (shouldReleaseExecutionLease) {\n await options.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, owner)\n }\n }\n },\n }\n}\n\n/** Distinguishes \"no credential on this deployment\" from \"the engine failed\". */\nclass PerceptionNotConfiguredError extends Error {\n override name = 'PerceptionNotConfiguredError'\n}\n\n/**\n * Bound every string and array before the report becomes a durable public\n * record. The instrument already clips inside its own limits; this is the\n * boundary that does not trust it, and it is where the visitor's wording\n * replaces the provider's.\n */\nfunction sanitizePerception(report: PerceptionReport): PerceptionReport {\n return {\n schemaVersion: report.schemaVersion,\n domain: clip(report.domain, 253),\n brandNames: report.brandNames.slice(0, 20).map((name) => clip(name, 128)),\n startedAt: report.startedAt,\n completedAt: report.completedAt,\n summary: sanitizeSummary(report.summary),\n evidence: report.evidence.slice(0, 3).map(sanitizeEvidence),\n }\n}\n\n/**\n * Clipped and coerced, never RECOMPUTED. The summary is what the instrument\n * measured; deriving it a second time here would let a headline disagree with\n * the rows the reader is shown.\n */\nfunction sanitizeSummary(summary: PerceptionSummary): PerceptionSummary {\n return {\n successfulChecks: finiteCount(summary.successfulChecks),\n failedChecks: finiteCount(summary.failedChecks),\n verdicts: {\n recommends: finiteCount(summary.verdicts.recommends),\n cautions: finiteCount(summary.verdicts.cautions),\n mixed: finiteCount(summary.verdicts.mixed),\n none: finiteCount(summary.verdicts.none),\n },\n concerns: summary.concerns.slice(0, 24).map((concern) => ({\n phrase: clip(concern.phrase, 64),\n answers: finiteCount(concern.answers),\n })),\n sourceTypes: summary.sourceTypes === null ? null : {\n measuredAnswers: finiteCount(summary.sourceTypes.measuredAnswers),\n unattributedAnswers: finiteCount(summary.sourceTypes.unattributedAnswers),\n totalAppearances: finiteCount(summary.sourceTypes.totalAppearances),\n entries: summary.sourceTypes.entries.slice(0, 5).map((entry) => ({\n type: entry.type,\n answers: finiteCount(entry.answers),\n share: finiteRate(entry.share),\n })),\n },\n }\n}\n\nfunction sanitizeEvidence(evidence: PerceptionEvidence): PerceptionEvidence {\n return {\n query: clip(evidence.query, 300),\n provider: clip(evidence.provider, 80),\n requestedModel: clip(evidence.requestedModel, 160),\n servedModel: nullableClip(evidence.servedModel, 160),\n completedAt: evidence.completedAt,\n answerText: nullableClip(evidence.answerText, 4_000),\n verdict: evidence.verdict,\n // Already verified to be written in the answer, so these are the answer's\n // own words. Bounded anyway, like every other array on this record.\n evidenceSentences: evidence.evidenceSentences.slice(0, 3).map((sentence) => clip(sentence, 240)),\n concerns: evidence.concerns.slice(0, 8).map((concern) => clip(concern, 64)),\n sources: evidence.sources.slice(0, 12).map((source) => ({\n url: clip(source.url, 2_048),\n domain: source.domain === null ? null : clip(source.domain, 253),\n title: nullableClip(source.title, 300),\n type: source.type,\n })),\n searchQueries: evidence.searchQueries.slice(0, 12).map((query) => clip(query, 300)),\n retrievalStatus: evidence.retrievalStatus,\n // Provider adapters may include transport diagnostics, so only a known\n // classification survives; anything else becomes the generic sentence.\n error: publicProbeError(evidence.error),\n }\n}\n\nfunction finiteCount(value: number): number {\n return Number.isFinite(value) && value >= 0 ? Math.floor(value) : 0\n}\n\nfunction finiteRate(value: number): number {\n return Number.isFinite(value) ? Math.max(0, Math.min(1, value)) : 0\n}\n\nfunction nullableClip(value: string | null, max: number): string | null {\n return value == null ? null : clip(value, max)\n}\n\nfunction isTimeout(error: unknown): boolean {\n return error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError')\n}\n\nfunction clip(value: string, max: number): string {\n return value.length <= max ? value : `${value.slice(0, Math.max(0, max - 1))}…`\n}\n",[],[186,385,377],"jobs","ebf126d5-0f4e-4391-8a29-d0cf0edb41da",6,["D",1788456961408],[212],[186,385],"4f817035-aa37-4dfa-9636-dc05d001c627","app.ts","ef9ec922-a7bd-11f1-ba16-1607ee4eb77e","ee205a2a-a7bd-11f1-a3ef-1607ee4eb77e",27,["D",1788474100495],"import { Hono } from 'npm:hono@4.12.25'\nimport type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport {\n type CheckRecord,\n checkFingerprint,\n type CheckStore,\n isCheckExpired,\n type JobDispatcher,\n newCheckRecord,\n normalizeUserQueries,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport {\n HumanVerificationError,\n normalizePublicDomain,\n PublicUrlError,\n utcDay,\n} from 'npm:@canonry/val-kit@0.2.0/security'\nimport { PublicQuotaError } from '../jobs/perception-check.ts'\nimport { createMcpHandler } from '../mcp/server.ts'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst MAX_BODY_BYTES = 4_096\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\nexport interface PageAssets {\n styles: string\n script: string\n /** Plated logo, used as the favicon. */\n mark: string\n /** Bare glyph, used inline in the brand lockup. */\n glyph: string\n}\n\nexport interface ValTownAppDependencies {\n store: CheckStore\n config: ValTownConfig\n dispatcher: JobDispatcher\n /** The UI is injected so this host stays independent from the renderer implementation. */\n renderPage: (record: CheckRecord | null) => string\n assets: PageAssets\n now?: () => Date\n}\n\nexport class PublicCheckUnavailableError extends Error {\n override name = 'PublicCheckUnavailableError'\n}\n\nclass PublicCheckAdmissionBusyError extends Error {\n override name = 'PublicCheckAdmissionBusyError'\n constructor() {\n super('Another request for this domain is being accepted. Try again shortly.')\n }\n}\n\nclass PublicCheckCapacityError extends Error {\n override name = 'PublicCheckCapacityError'\n constructor() {\n super('The public check is at capacity. Try again shortly.')\n }\n}\n\nexport function createValTownApp(deps: ValTownAppDependencies): Hono {\n const app = new Hono()\n const now = deps.now ?? (() => new Date())\n\n app.use('*', async (context, next) => {\n const turnstileAllowed = deps.config.publicChecksEnabled &&\n deps.config.humanVerificationStatus === 'ready' && Boolean(deps.config.turnstileSiteKey)\n context.header('Content-Security-Policy', contentSecurityPolicy(turnstileAllowed))\n context.header('X-Content-Type-Options', 'nosniff')\n context.header('Referrer-Policy', 'strict-origin-when-cross-origin')\n context.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()')\n context.header('Cross-Origin-Opener-Policy', 'same-origin')\n await next()\n })\n\n app.get('/healthz', (context) => context.json({ ok: true }))\n\n // Anonymous, read-only MCP over Streamable HTTP. It shares this app's store\n // so an agent reads exactly the checks the UI shows, and it owns its own\n // method/origin/envelope handling — including the 405 for a non-POST, which\n // is why it is registered for every method rather than POST alone.\n const mcp = createMcpHandler({\n store: deps.store,\n now,\n startCheck: deps.config.mcpStartChecksEnabled\n ? async (domain, remoteIp, queries) => {\n const outcome = await submitCheck(deps, {\n domain,\n queries,\n token: null,\n remoteIp,\n now: now(),\n admission: 'mcp',\n })\n return { record: (await deps.store.get(outcome.record.id)) ?? outcome.record, reused: outcome.reused }\n }\n : undefined,\n })\n app.all('/mcp', (context) => mcp(context.req.raw))\n // Immutable: the document references these with a content hash, so a changed\n // asset arrives under a new URL rather than waiting out a TTL.\n app.get('/assets/canonry-ui.css', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.styles, 200, { 'content-type': 'text/css; charset=utf-8' })\n })\n app.get('/assets/canonry-ui.js', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.script, 200, { 'content-type': 'application/javascript; charset=utf-8' })\n })\n app.get('/assets/canonry-mark.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.mark, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n app.get('/assets/canonry-glyph.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.glyph, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n\n app.get('/', async (context) => {\n const requestedId = context.req.query('check')\n const stored = requestedId && CHECK_ID.test(requestedId) ? await deps.store.get(requestedId) : null\n const record = stored && !isCheckExpired(stored, now()) ? stored : null\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(record))\n })\n\n app.get('/api/checks/:id', async (context) => {\n const id = context.req.param('id')\n if (!CHECK_ID.test(id)) return apiError(context, 404, 'not-found', 'Check not found.')\n const record = await deps.store.get(id)\n if (!record || isCheckExpired(record, now())) return apiError(context, 404, 'not-found', 'Check not found.')\n context.header('Cache-Control', 'no-store')\n return context.json({ check: publicCheckRecord(record) })\n })\n\n app.post('/api/checks', async (context) => {\n const payload = await parseJsonBody(context.req.raw)\n const outcome = await submitCheck(deps, {\n domain: payload.domain,\n queries: payload.queries,\n token: typeof payload.turnstileToken === 'string' ? payload.turnstileToken : null,\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n context.header('Cache-Control', 'no-store')\n if (outcome.dispatch === 'busy') {\n return apiError(context, 503, 'busy', 'The public check is at capacity. Try again shortly.')\n }\n return context.json(\n { check: publicCheckRecord(outcome.record), reused: outcome.reused },\n outcome.record.status === 'queued' || outcome.record.status === 'running' ? 202 : 200,\n )\n })\n\n app.post('/check', async (context) => {\n let submittedDomain: unknown = null\n try {\n const form = await parseFormBody(context.req.raw)\n submittedDomain = form.get('domain')\n const outcome = await submitCheck(deps, {\n domain: submittedDomain,\n queries: form.get('queries'),\n token: form.get('cf-turnstile-response'),\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n if (outcome.dispatch === 'busy') throw new PublicCheckCapacityError()\n return context.redirect(`/?check=${encodeURIComponent(outcome.record.id)}`, 303)\n } catch (error) {\n const failure = formFailureRecord(submittedDomain, now(), error)\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(failure), formFailureStatus(error))\n }\n })\n\n app.notFound((context) => apiError(context, 404, 'not-found', 'Not found.'))\n app.onError((error, context) => {\n if (error instanceof PublicUrlError) return apiError(context, 400, 'invalid-domain', error.message)\n if (error instanceof HumanVerificationError) {\n const status = error.code === 'unavailable' || error.code === 'transport' ? 503 : 403\n return apiError(context, status, `human-verification-${error.code}`, error.message)\n }\n if (error instanceof PublicQuotaError) return apiError(context, 429, `${error.scope}-quota`, error.message)\n if (error instanceof PublicCheckAdmissionBusyError) return apiError(context, 503, 'admission-busy', error.message)\n if (error instanceof PublicCheckCapacityError) return apiError(context, 503, 'busy', error.message)\n if (error instanceof PublicCheckUnavailableError) return apiError(context, 503, 'unavailable', error.message)\n if (error instanceof BodyTooLargeError) {\n return apiError(context, 413, 'body-too-large', 'Request body is too large.')\n }\n if (error instanceof InvalidBodyError) return apiError(context, 400, 'invalid-body', error.message)\n return apiError(context, 500, 'internal-error', 'The public check could not be started.')\n })\n\n return app\n}\n\ninterface CheckSubmission {\n record: CheckRecord\n reused: boolean\n dispatch: 'completed' | 'busy' | 'ignored'\n}\n\ninterface SubmitInput {\n domain: unknown\n /** Raw caller input; normalized here, never trusted as given. */\n queries?: unknown\n token: string | null\n remoteIp: string | null\n now: Date\n /**\n * Which admission rules apply. `mcp` skips human verification, which an\n * agent cannot perform, and spends from a separate, tighter daily bucket so\n * it cannot consume the browser allowance. Every other control — the global\n * daily cap, the single execution lease, cache reuse — is identical.\n */\n admission?: 'browser' | 'mcp'\n}\n\nasync function submitCheck(\n deps: ValTownAppDependencies,\n input: SubmitInput,\n): Promise {\n if (!deps.config.publicChecksEnabled) {\n throw new PublicCheckUnavailableError(\n deps.config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.',\n )\n }\n const target = normalizePublicDomain(input.domain)\n const userQueries = normalizeUserQueries(input.queries)\n const viaMcp = input.admission === 'mcp'\n if (!viaMcp) await deps.config.humanVerifier.verify({ token: input.token, remoteIp: input.remoteIp })\n // The questions join the reuse key. They change what the check measures, so\n // a second caller asking different questions about the same domain must not\n // be handed the first caller's answers.\n const fingerprint = checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, target.domain, userQueries)\n const timestamp = input.now.toISOString()\n\n // Cached and already-active work is useful without consuming the one global\n // execution slot. This keeps same-domain retries quota- and capacity-free.\n const reusable = await deps.store.findReusable(fingerprint, timestamp)\n if (reusable) return dispatchExistingCheck(deps, reusable)\n\n const hashedClient = await hashQuotaSubject(deps.config.quotaSalt, input.remoteIp ?? 'unknown')\n // A distinct subject rather than a distinct scope: `CheckQuotaClaim.scope` is\n // a closed union, and prefixing keeps the two buckets disjoint without\n // widening a durable contract.\n const clientSubject = viaMcp ? `mcp:${hashedClient}` : hashedClient\n const clientMax = viaMcp ? deps.config.mcpPerClientDailyLimit : deps.config.perClientDailyLimit\n const day = utcDay(input.now)\n const executionLeaseOwner = crypto.randomUUID()\n const executionLeaseUntil = new Date(input.now.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const capacityAvailable = await deps.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n executionLeaseOwner,\n timestamp,\n executionLeaseUntil,\n )\n if (!capacityAvailable) throw new PublicCheckCapacityError()\n\n let capacityHeld = true\n let dispatchOwnsCapacity = false\n const releaseCapacity = async () => {\n if (!capacityHeld) return\n await deps.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, executionLeaseOwner)\n capacityHeld = false\n }\n\n try {\n const admission = await deps.store.admit({\n candidate: newCheckRecord({\n id: crypto.randomUUID(),\n fingerprint,\n domain: target.domain,\n userQueries,\n now: input.now,\n }),\n now: timestamp,\n clientQuota: { scope: 'client', subject: clientSubject, day, max: clientMax },\n globalQuota: { scope: 'global', subject: 'all', day, max: deps.config.globalDailyLimit },\n })\n if (admission.kind === 'quota-exhausted') throw new PublicQuotaError(admission.scope)\n if (admission.kind === 'busy') throw new PublicCheckAdmissionBusyError()\n\n if (admission.kind === 'reused') {\n // A concurrent same-domain admission won. It must not inherit capacity\n // reserved by this request, so it goes through ordinary reuse dispatch.\n await releaseCapacity()\n return dispatchExistingCheck(deps, admission.record)\n }\n\n let dispatch: 'completed' | 'busy' | 'ignored' = 'ignored'\n if (admission.record.status === 'queued') {\n // Request-bound dispatch takes responsibility for this owner as soon as\n // it receives the promise. Its runner releases even a lost job claim.\n const dispatched = deps.dispatcher.dispatch(admission.record.id, { executionLeaseOwner })\n dispatchOwnsCapacity = true\n dispatch = await dispatched\n }\n return {\n record: (await deps.store.get(admission.record.id)) ?? admission.record,\n reused: admission.kind !== 'created',\n dispatch,\n }\n } finally {\n // The runner owns capacity only after dispatch receives the owner. The app\n // releases every admission, reuse, quota, and pre-dispatch error path.\n if (!dispatchOwnsCapacity) await releaseCapacity()\n }\n}\n\nasync function dispatchExistingCheck(\n deps: ValTownAppDependencies,\n record: CheckRecord,\n): Promise {\n const dispatch = record.status === 'queued' ? await deps.dispatcher.dispatch(record.id) : 'ignored'\n return {\n record: (await deps.store.get(record.id)) ?? record,\n reused: true,\n dispatch,\n }\n}\n\nfunction publicCheckRecord(\n record: CheckRecord,\n): Omit, 'fingerprint' | 'leaseOwner' | 'leaseUntil'> {\n const { fingerprint: _fingerprint, leaseOwner: _leaseOwner, leaseUntil: _leaseUntil, ...safe } = record\n return safe\n}\n\nfunction apiError(\n context: { json: (body: unknown, status?: number) => Response; header: (name: string, value: string) => void },\n status: number,\n code: string,\n message: string,\n): Response {\n context.header('Cache-Control', 'no-store')\n return context.json({ error: { code, message } }, status)\n}\n\nclass BodyTooLargeError extends Error {}\nclass InvalidBodyError extends Error {}\n\nasync function parseJsonBody(request: Request): Promise> {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/json')) {\n throw new InvalidBodyError('Expected a JSON request body.')\n }\n const text = await readLimitedBody(request)\n try {\n const parsed = JSON.parse(text)\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error()\n return parsed as Record\n } catch {\n throw new InvalidBodyError('Request body must be a JSON object.')\n }\n}\n\nasync function parseFormBody(request: Request): Promise {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/x-www-form-urlencoded')) {\n throw new InvalidBodyError('Expected a form submission.')\n }\n return new URLSearchParams(await readLimitedBody(request))\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const contentLength = Number(request.headers.get('content-length'))\n if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) throw new BodyTooLargeError()\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n throw new BodyTooLargeError()\n }\n chunks.push(next.value)\n }\n const output = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n output.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(output)\n}\n\nfunction remoteIp(request: Request): string | null {\n // Val injects this edge header. `x-forwarded-for` is caller-controlled on a\n // public val, so it is deliberately ignored for quota identity.\n const cf = request.headers.get('cf-connecting-ip')?.trim()\n if (cf && cf.length <= 128) return cf\n return null\n}\n\nasync function hashQuotaSubject(salt: string, value: string): Promise {\n const bytes = new TextEncoder().encode(`${salt}\\u0000${value}`)\n const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))\n return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * `frame-ancestors` allows Val Town because the val's own page previews the\n * deployed site in an iframe, and `'none'` renders that preview blank — the\n * first thing anyone arriving from val.town sees. The allowance is exactly the\n * hosting platform and nothing else, so ordinary clickjacking is still blocked.\n * There is little to hijack regardless: no session, no credential, and the only\n * action is submitting a public domain.\n */\nconst FRAME_ANCESTORS = [\"'self'\", 'https://www.val.town', 'https://val.town'].join(' ')\n\n/**\n * Geist is served from jsDelivr because a Val cannot ship the font itself:\n * woff2 is binary and Val Town refuses to push binary files. It is the same\n * package and version the dashboard bundles (`@fontsource-variable/geist`), so\n * the two surfaces render in the same typeface rather than this one silently\n * falling back to a system font, which is what it did before.\n */\nconst FONT_CDN = 'https://cdn.jsdelivr.net'\n\nfunction contentSecurityPolicy(turnstileAllowed: boolean): string {\n const turnstile = turnstileAllowed ? ' https://challenges.cloudflare.com' : ''\n return [\n \"default-src 'self'\",\n \"base-uri 'none'\",\n \"object-src 'none'\",\n `frame-ancestors ${FRAME_ANCESTORS}`,\n \"form-action 'self'\",\n `script-src 'self'${turnstile}`,\n `style-src 'self' ${FONT_CDN}`,\n `font-src ${FONT_CDN}`,\n `connect-src 'self'${turnstile}`,\n `frame-src${turnstile || \" 'none'\"}`,\n \"img-src 'self' data: https:\",\n ].join('; ')\n}\n\nfunction formFailureRecord(domain: unknown, now: Date, error: unknown): CheckRecord {\n const displayDomain = typeof domain === 'string' ? domain.trim().slice(0, 253) : ''\n const timestamp = now.toISOString()\n return {\n id: crypto.randomUUID(),\n fingerprint: '',\n domain: displayDomain,\n userQueries: [],\n status: 'failed',\n createdAt: timestamp,\n updatedAt: timestamp,\n expiresAt: null,\n result: null,\n errorCode: error instanceof PublicQuotaError ? PUBLIC_RATE_LIMITED_ERROR_CODE : 'form-submission-failed',\n errorMessage: formFailureMessage(error),\n leaseOwner: null,\n leaseUntil: null,\n }\n}\n\nfunction formFailureMessage(error: unknown): string {\n if (\n error instanceof PublicUrlError || error instanceof PublicQuotaError || error instanceof HumanVerificationError ||\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return error.message\n if (error instanceof BodyTooLargeError) return 'The submission was too large. Enter only a domain.'\n if (error instanceof InvalidBodyError) return 'The form could not be read. Try again.'\n return 'The public check could not be started. Try again later.'\n}\n\nfunction formFailureStatus(error: unknown): 400 | 403 | 413 | 429 | 503 {\n if (error instanceof PublicUrlError || error instanceof InvalidBodyError) return 400\n if (error instanceof BodyTooLargeError) return 413\n if (error instanceof PublicQuotaError) return 429\n if (\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return 503\n if (error instanceof HumanVerificationError) return error.code === 'invalid' ? 403 : 503\n return 503\n}\n",[],[186,400,392],"app","3d119210-fb81-4a4a-9cbb-b0eaa18880b4",3,["D",1788456961083],[210],[186,400],"c1a9a2b8-0174-4415-b76e-49d63d23fbdd",["D",1788456960824],[209,211,213,216,218],[186],["D",1788456812405],["D",1789501263826],{"_11":12,"_155":72},{"_11":12,"_150":151,"_71":72,"_31":-5,"_152":153,"_154":30},{"_42":141,"_13":16,"_36":39,"_142":101,"_143":-5,"_144":-5,"_145":-5,"_146":-5,"_147":-5,"_148":14,"_149":12},"ctx",{"_55":-5,"_174":448,"_449":450,"_451":452,"_453":30,"_454":30,"_455":30,"_456":24,"_457":-5,"_458":-7,"_459":-7,"_460":26,"_461":30,"_462":30,"_463":-5,"_464":30,"_465":30,"_466":30,"_467":-5},"ENV",{"_419":420,"_421":422,"_423":16,"_424":425,"_426":427,"_428":429,"_430":431,"_432":433,"_434":435,"_436":437,"_438":439,"_440":441,"_442":443,"_444":445,"_446":447},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · mcp