` per row opens every verified sentence, the concerns,\n the typed sources, the searches the engine ran, and the full answer.\n3. **Concerns raised** — phrase plus \"in N of M answers\". An empty list is STATED, not omitted: \"no concern was raised\"\n is a finding, and a missing section reads as a broken page.\n4. **Sources the engine attributed** — by kind, counted once per answer, with the share and the unattributed remainder\n stated separately.\n\nOther rules the tests hold:\n\n- **Heavy explanation lives in tooltips, not inline prose.** Each section heading carries a CSS-only `info-tip`: a real\n `${\n escapeHtml(copy)\n }`\n}\n\n/**\n * One tone vocabulary for the whole page. The badge and the KPI cell read the\n * SAME `verdictTone`, so the colour of \"Cautions\" cannot be rose in one place\n * and amber in the other — which is what happens when a renderer decides tone\n * a second time.\n */\nconst VERDICT_TONE_CLASS = {\n positive: 'signal-positive',\n negative: 'signal-negative',\n caution: 'signal-caution',\n neutral: 'signal-neutral',\n} as const\n\nconst VERDICT_GLYPH = { recommends: '✓', cautions: '!', mixed: '~', none: '−' } as const\n\n/** A verdict badge, never a score. An unmeasured row is dimmed, not toned. */\nfunction verdictBadge(answer: PerceptionAnswerViewModel): string {\n const glyph = answer.verdict === null ? '?' : VERDICT_GLYPH[answer.verdict]\n const className = answer.verdict === null ? 'signal-unavailable' : VERDICT_TONE_CLASS[answer.verdictTone]\n return `${glyph}${\n escapeHtml(answer.verdictLabel)\n }`\n}\n\n/**\n * The headline cell.\n *\n * A measured verdict quotes the answer's own first verified sentence. `none`\n * gets a statement of what happened, and an unmeasured row gets the reason it\n * was not measured — the row already says \"Not measured\", and the question a\n * reader then asks is \"why\".\n */\nfunction answerHeadlineCell(answer: PerceptionAnswerViewModel): string {\n if (answer.verdict === null) {\n return `${escapeHtml(answer.error ?? 'This answer was not measured.')}`\n }\n if (answer.headline) {\n return `${escapeHtml(answer.headline)}`\n }\n return 'The answer described the brand without taking a position.'\n}\n\nfunction renderSource(source: PerceptionSourceViewModel): string {\n const url = safeUrl(source.url)\n const title = source.title?.trim() || (url ? safeHost(url) : 'Unavailable source')\n const host = url ? safeHost(url) : source.domain\n const meta = `${escapeHtml(host ?? 'Unattributed host')} · ${escapeHtml(source.typeLabel)}`\n if (!url) {\n return `

${escapeHtml(title)}${meta}

`\n }\n return `

${\n escapeHtml(title)\n }${meta}

`\n}\n\nfunction renderAnswerDetails(answer: PerceptionAnswerViewModel): string {\n const quotes = answer.evidenceSentences.length\n ? `

What the answer said

${escapeHtml(sentence)}

`\n : `

What the answer said

${\n answer.verdict === null\n ? 'This answer was not measured, so nothing was read out of it.'\n : 'No sentence in this answer took a position on the brand.'\n }

`\n const concerns = answer.concerns.length\n ? `

Concerns this answer raised

${escapeHtml(concern)}

`\n : ''\n const sources = answer.sources.length\n ? `

${answer.sources.map(renderSource).join('')}`\n : `

${\n answer.verdict === null\n ? 'This answer was not measured, so no source was attributed to it.'\n : 'The engine attributed no source to this answer.'\n }

`\n const searches = answer.searchQueries.length\n ? `

Searches the engine ran${\n escapeHtml(answer.searchQueries.join(', '))\n }

`\n : ''\n const models = [\n answer.requestedModel ? `Requested: ${escapeHtml(answer.requestedModel)}` : '',\n answer.servedModel ? `Served: ${escapeHtml(answer.servedModel)}` : '',\n answer.completedAt && formatTime(answer.completedAt)\n ? `Completed: ${escapeHtml(formatTime(answer.completedAt)!)}`\n : '',\n ].filter(Boolean).join('')\n const answerText = answer.answerText\n ? `

Full answer

${\n escapeHtml(clip(answer.answerText))\n }

`\n : '

Answer text was not retained for this result.

'\n const error = answer.error\n ? `

Not measured${escapeHtml(answer.error)}

`\n : ''\n return `\n

View evidence

${models}

\n ${quotes}${concerns}${error}\n

Sources

${sources}

\n ${searches}\n ${answerText}\n

`\n}\n\n/**\n * The headline row.\n *\n * Flat KPI cells, never progress bars: \"2 of 3 answers\" has no target to fill,\n * and a bar would invent one. The denominator is written under every number\n * rather than once at the top, because the number and the bound it rests on\n * have to be read together.\n */\nfunction renderVerdictSnapshot(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const checkedAt = formatTime(perception.checkedAt)\n const cells = perception.verdicts.map((verdict) =>\n `

${escapeHtml(verdict.label)}

${\n measured === 0\n ? '

Not measured

'\n : `

${verdict.count}

`\n }${\n measured === 0 ? 'No answer was measured' : `of ${measured} ${plural(measured, 'answer', 'answers')}`\n }

`\n ).join('')\n return `\n

Verdict snapshot${renderInfoTip(VERDICT_TIP)}

\n ${checkedAt ? `

Checked ${escapeHtml(checkedAt)}

` : ''}\n

${perception.requestedAnswers} branded ${\n plural(perception.requestedAnswers, 'question', 'questions')\n }Gemini${measured} measured

${cells}\n

`\n}\n\nfunction renderAnswers(perception: PerceptionViewModel): string {\n const rows = perception.answers.map((answer) => `\n \n ${escapeHtml(answer.query)}\n ${verdictBadge(answer)}\n ${answerHeadlineCell(answer)}\n ${\n // An unmeasured answer has no sources because there is no answer, not\n // because the engine attributed none. A 0 here would be a measured zero.\n answer.verdict === null\n ? 'not measured'\n : answer.sources.length\n }\n ${renderAnswerDetails(answer)}\n `).join('')\n const empty =\n '

No answers were recorded

Answers appear once the engine replies to a branded question.

'\n return `\n

Answers${renderInfoTip(ANSWERS_TIP)}

\n ${perception.notice ? renderNotice(perception.notice) : ''}\n ${\n perception.answers.length\n ? `

${rows}

Branded question	Verdict	What the answer said	Sources	Evidence

`\n : empty\n }\n

`\n}\n\nfunction renderConcerns(perception: PerceptionViewModel): string {\n const measured = perception.measuredAnswers\n const body = perception.concerns.length\n ? `

${escapeHtml(concern.phrase)}in ${concern.answers} of ${measured} ${\n plural(measured, 'answer', 'answers')\n }

`\n : `

${\n measured === 0\n ? 'No answer was measured, so no concern could be read out of one.'\n : `No concern was raised in the ${measured} ${plural(measured, 'answer', 'answers')} measured.`\n }

`\n return `\n

Concerns raised${\n renderInfoTip(CONCERNS_TIP)\n }

\n ${body}\n

`\n}\n\nfunction renderSourceTypes(perception: PerceptionViewModel): string {\n const share = perception.sourceTypes\n const body = share\n ? `

${\n share.entries.map((entry) =>\n ``\n ).join('')\n }

Kind of source	Answers	Share
${escapeHtml(entry.label)}	${entry.answers} of ${share.measuredAnswers}	${entry.percent}%

${\n share.unattributedAnswers > 0\n ? `

${share.unattributedAnswers} measured ${\n plural(share.unattributedAnswers, 'answer', 'answers')\n } attributed no source at all, and ${\n plural(share.unattributedAnswers, 'is', 'are')\n } excluded from the share.

`\n : ''\n }`\n : `

${\n perception.measuredAnswers === 0\n ? 'No answer was measured, so no source could be attributed.'\n : 'No measured answer attributed a source.'\n }

`\n return `\n

Sources the engine attributed${\n renderInfoTip(SOURCES_TIP)\n }

\n ${body}\n

`\n}\n\n/**\n * The waiting state, revealed by script when a check is submitted.\n *\n * A check takes about 45 seconds and execution is request-bound, so a native\n * form POST leaves the browser blocked on a navigation for the whole time with\n * nothing on screen but a disabled button. The work still happens inside one\n * request; this just stops that request being the thing the browser is painting.\n *\n * It claims only what is knowable while waiting. The domain and any questions\n * the visitor typed are theirs already, and elapsed time is counted rather than\n * guessed. There is ONE track, not a list of phases: this runner really is\n * sequential — plan, then probe, then read the answers back — but the server\n * reports no phase, so naming three of them would tell the reader which one is\n * running when nothing knows that.\n */\nfunction renderLoadingView(): string {\n return `\n `\n}\n\n/**\n * The form does two different jobs, so it gets two treatments.\n *\n * On the landing page it is the ONLY thing to do, so it is the hero: a full\n * headline, a large field, and the scope note underneath. On a result page the\n * reader already has what they came for, so it shrinks into the header as a\n * secondary action and drops the onboarding copy.\n */\nfunction renderCheckForm(model: BrandPerceptionViewModel, variant: 'hero' | 'compact' = 'compact'): string {\n if (!model.form) return ''\n const value = model.status === 'empty' ? '' : model.domain\n const verificationStatus = model.form.verificationStatus ?? (model.form.turnstileSiteKey ? 'ready' : 'not-required')\n const hasTurnstile = Boolean(model.form.turnstileSiteKey && verificationStatus === 'ready')\n const disabled = verificationStatus === 'unavailable'\n // interaction-only: the challenge still runs on load, so a token is ready at\n // submit, but the widget is drawn only if the visitor has to do something.\n const verification = hasTurnstile\n ? `

`\n : verificationStatus === 'unavailable'\n ? `

!${\n escapeHtml(\n model.form.verificationUnavailableMessage ?? 'Human verification is unavailable. Public checks are disabled.',\n )\n }

`\n : ''\n const verificationSlot = verification\n ? `

${verification}

`\n : ''\n const hero = variant === 'hero'\n const submitLabel = model.form.submitLabel ?? 'Check a brand'\n return `\n `\n}\n\nfunction brandLockup(glyphHref: string): string {\n return `

brand perception checkpowered by $\"\"$ Canonry

`\n}\n\nconst FOOTER_LINKS =\n 'npm i -g @canonry/canonryGitHub canonry.ai'\n\nfunction renderMain(model: BrandPerceptionViewModel): string {\n const glyphHref = assetUrl(DEFAULT_GLYPH_SRC, canonryGlyph)\n const globalNotice = (model.status === 'ready' ? model.notice : model.notice ?? statusCopy(model.status)) ?? undefined\n const perception = model.perception\n // Nothing has been checked yet, so a report header over two empty panels is\n // scaffolding around an absence. Lead with the one action instead.\n if (model.status === 'empty') {\n return `\n

\n \n

What does AI say about your brand?${renderInfoTip(LANDING_EXPLAINER)}

\n ${renderCheckForm(model, 'hero')}\n

\n ${renderLoadingView()}\n

\n \n

`\n }\n return `\n

\n \n

${escapeHtml(model.domain)}

\n ${renderNotice(globalNotice)}\n

\n ${\n perception\n ? `${renderVerdictSnapshot(perception)}${renderAnswers(perception)}${renderConcerns(perception)}${\n renderSourceTypes(perception)\n }`\n : '

No brand perception result

Start a check to see what an answer engine says about this brand.

'\n }\n

\n \n

`\n}\n\n/** Returns a complete document so the runtime can use it as an HTTP response body. */\nexport function renderBrandPerception(model: BrandPerceptionViewModel): string {\n const title = `${model.displayName} | ${PRODUCT_NAME}`\n return `\n\n \n \n \n \n ${escapeHtml(title)}\n \n \n \n \n \n \n ${\n model.form?.turnstileSiteKey && (model.form.verificationStatus ?? 'ready') === 'ready'\n ? ''\n : ''\n }\n \n ${renderMain(model)}\n`\n}\n\n/** Useful for a host that owns the outer document or wants an embedded fragment. */\nexport function renderBrandPerceptionBody(model: BrandPerceptionViewModel): string {\n return renderMain(model)\n}\n",[],[165,166,278],"240f901b-5542-496b-9b40-286484e09595","index.ts","ef885f02-a7bd-11f1-b787-1607ee4eb77e",28,["D",1788474100506],"export { createPublicCheckForm } from './check-form.ts'\nexport { brandPerceptionClientScript, QUERY_HINT_SUFFIX } from './client.ts'\nexport { emptyLandingViewModel, toBrandPerceptionViewModel } from './from-check-record.ts'\nexport type { CheckRecordViewOptions } from './from-check-record.ts'\nexport { assetUrl, PRODUCT_NAME, renderBrandPerception, renderBrandPerceptionBody } from './render.ts'\nexport { brandPerceptionStyles } from './styles.ts'\nexport { canonryGlyph, canonryMark } from 'npm:@canonry/val-kit@0.2.0/ui'\nexport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n ConcernViewModel,\n DemoUiStatus,\n PerceptionAnswerViewModel,\n PerceptionSourceViewModel,\n PerceptionViewModel,\n SourceTypeEntryViewModel,\n SourceTypeViewModel,\n UiAction,\n UiNotice,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n",[],[165,166,286],"6b9685aa-3d18-4d29-8716-5bdde5e9fad7","from-check-record.ts","ef63417c-a7bd-11f1-b229-1607ee4eb77e",39,["D",1788474100718],"import {\n type CheckRecord,\n PUBLIC_CHECK_UNAVAILABLE,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type {\n PerceptionEvidence,\n PerceptionReport,\n PerceptionVerdict,\n SourceType,\n} from 'npm:@canonry/val-kit@0.2.0/perception'\nimport type { PerceptionCheckResult } from '../runtime/check-result.ts'\nimport type {\n BrandPerceptionViewModel,\n CheckFormViewModel,\n PerceptionAnswerViewModel,\n PerceptionViewModel,\n UiTone,\n VerdictCountViewModel,\n} from './types.ts'\n\nexport interface CheckRecordViewOptions {\n form?: CheckFormViewModel\n displayName?: string\n title?: string\n}\n\nconst LOCAL_READY_FORM: CheckFormViewModel = {\n action: '/check',\n method: 'post',\n verificationFieldName: 'cf-turnstile-response',\n verificationStatus: 'not-required',\n submitLabel: 'Check a brand',\n}\n\n/**\n * The verdict vocabulary, written once.\n *\n * `none` is a POSITION — the answer described the brand and took none — so it\n * gets a neutral tone and a label that says what happened, never \"no data\".\n * `null` is the absence of a measurement and is handled separately, because\n * collapsing the two would turn an outage into a finding.\n */\nconst VERDICT_COPY: Readonly> = {\n recommends: { label: 'Recommends', tone: 'positive' },\n cautions: { label: 'Cautions', tone: 'negative' },\n mixed: { label: 'Mixed', tone: 'caution' },\n none: { label: 'Took no position', tone: 'neutral' },\n}\n\n/** What KIND of place, in the reader's words. Never \"where opinions come from\". */\nconst SOURCE_TYPE_LABELS: Readonly> = {\n official: 'The brand’s own site',\n community: 'Community',\n review: 'Review site',\n news: 'News',\n other: 'Other',\n}\n\n/**\n * Converts a sanitized, durable public-check record into the narrow UI model.\n * It deliberately never turns an unmeasured answer into a neutral verdict.\n */\nexport function toBrandPerceptionViewModel(\n record: CheckRecord | null,\n options: CheckRecordViewOptions = {},\n): BrandPerceptionViewModel {\n const domain = record?.domain ?? ''\n const result = record?.result ?? null\n const status = record ? mapStatus(record) : 'empty'\n const resultDomain = result?.domain || domain\n\n return {\n status,\n title: options.title,\n displayName: options.displayName ?? nameFromDomain(resultDomain || 'Brand'),\n domain: resultDomain,\n form: { ...LOCAL_READY_FORM, ...options.form },\n perception: result?.perception ? mapPerception(result.perception) : undefined,\n notice: buildNotice(record, result),\n }\n}\n\n/**\n * Did anything in this check actually fail?\n *\n * `record.status` is decided once, when the check runs, and stored, which makes\n * it the wrong thing to warn a reader off: correcting the rule behind it never\n * reaches a record already written, so a shared link keeps showing the old\n * verdict for its whole 24h life. The evidence is right here in the result, so\n * read it instead of the flag.\n */\nfunction hasFailedWork(record: CheckRecord): boolean {\n const result = record.result\n if (!result) return false\n if (result.errors.length > 0) return true\n return (result.perception?.evidence ?? []).some((row) => row.verdict === null)\n}\n\nfunction mapStatus(record: CheckRecord): BrandPerceptionViewModel['status'] {\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) return 'rate-limited'\n switch (record.status) {\n case 'queued':\n case 'running':\n return 'loading'\n case 'partial':\n // A stored `partial` is only worth a caution when something in the result\n // actually failed. See `hasFailedWork`.\n return hasFailedWork(record) ? 'partial' : 'ready'\n case 'failed':\n return 'error'\n case 'complete':\n return 'ready'\n }\n}\n\nfunction mapPerception(report: PerceptionReport): PerceptionViewModel {\n const failed = report.summary.failedChecks\n const sourceTypes = report.summary.sourceTypes\n return {\n requestedAt: report.startedAt,\n checkedAt: report.completedAt,\n measuredAnswers: report.summary.successfulChecks,\n requestedAnswers: report.evidence.length,\n failedAnswers: failed,\n // Fixed order, so the row reads the same on every check and a count that\n // happens to be zero keeps its column rather than shuffling the others.\n verdicts: (['recommends', 'cautions', 'mixed', 'none'] as const).map((key): VerdictCountViewModel => ({\n key,\n label: VERDICT_COPY[key].label,\n tone: VERDICT_COPY[key].tone,\n count: report.summary.verdicts[key],\n })),\n concerns: report.summary.concerns.map((concern) => ({ phrase: concern.phrase, answers: concern.answers })),\n // Percentages round for display only; the shares they come from sum to 1.\n sourceTypes: sourceTypes\n ? {\n measuredAnswers: sourceTypes.measuredAnswers,\n unattributedAnswers: sourceTypes.unattributedAnswers,\n totalAppearances: sourceTypes.totalAppearances,\n entries: sourceTypes.entries.map((entry) => ({\n type: entry.type,\n label: SOURCE_TYPE_LABELS[entry.type],\n answers: entry.answers,\n percent: Math.round(entry.share * 100),\n })),\n }\n : undefined,\n answers: report.evidence.map(mapAnswer),\n notice: failed > 0\n ? {\n tone: 'caution',\n title: `${failed} ${failed === 1 ? 'answer' : 'answers'} unavailable`,\n // The reason leads, because that is what a row reading \"Not measured\"\n // makes someone ask. It is only stated when the failures agree on one;\n // with several the banner would have to pick one and be wrong about the\n // rest, so it defers to the per-row evidence instead.\n detail: `${failureReason(report.evidence) ?? ''}Every count uses the answers that were measured.`,\n }\n : undefined,\n }\n}\n\n/** The one reason every unmeasured answer shares, or null when they disagree. */\nfunction failureReason(evidence: readonly PerceptionEvidence[]): string | null {\n const reasons = new Set(\n evidence.filter((row) => row.verdict === null)\n .map((row) => row.error)\n // The generic sentence is the ABSENCE of a reason. Leading with it\n // produces \"1 answer unavailable. This answer-engine check was\n // unavailable.\" — the banner restating its own title.\n .filter((error): error is string => Boolean(error) && error !== PUBLIC_CHECK_UNAVAILABLE),\n )\n if (reasons.size !== 1) return null\n const [reason] = [...reasons]\n return reason ? `${reason} ` : null\n}\n\nfunction mapAnswer(row: PerceptionEvidence): PerceptionAnswerViewModel {\n const copy = row.verdict === null ? null : VERDICT_COPY[row.verdict]\n return {\n id: `${row.provider}:${row.query}:${row.completedAt}`,\n query: row.query,\n verdict: row.verdict,\n verdictLabel: copy?.label ?? 'Not measured',\n verdictTone: copy?.tone ?? 'neutral',\n // The answer's own first sentence, or nothing. A verdict of 'none' carries\n // no evidence by construction, and inventing a line to fill the cell would\n // put words in an answer that did not write them.\n headline: row.evidenceSentences[0] ?? null,\n evidenceSentences: row.evidenceSentences,\n concerns: row.concerns,\n sources: row.sources.map((source) => ({\n url: source.url,\n title: source.title,\n domain: source.domain,\n typeLabel: SOURCE_TYPE_LABELS[source.type],\n })),\n searchQueries: row.searchQueries,\n answerText: row.answerText,\n requestedModel: row.requestedModel,\n servedModel: row.servedModel,\n completedAt: row.completedAt,\n error: row.error,\n }\n}\n\nfunction buildNotice(\n record: CheckRecord | null,\n result: PerceptionCheckResult | null,\n): BrandPerceptionViewModel['notice'] {\n if (!record) return undefined\n if (record.errorCode === PUBLIC_RATE_LIMITED_ERROR_CODE) {\n return {\n tone: 'caution',\n title: 'Check limit reached',\n detail: record.errorMessage ?? 'This public sample has reached its current limit. Try again later.',\n }\n }\n if (record.status === 'failed') {\n return {\n tone: 'negative',\n title: 'This check could not finish',\n detail: result?.errors[0]?.message ?? record.errorMessage ?? 'Try another public domain later.',\n }\n }\n const first = result?.errors[0]\n if (first) return { tone: 'caution', title: 'Brand perception was unavailable', detail: first.message }\n return undefined\n}\n\nfunction nameFromDomain(domain: string): string {\n const host = domain.replace(/^www\\./i, '').split('.')[0] ?? domain\n return host\n .replace(/[-_]+/g, ' ')\n .replace(/\\b\\w/g, (letter) => letter.toUpperCase())\n}\n\n/**\n * The landing view, shown before anything has been checked.\n *\n * It carries no `perception` because nothing has been measured yet. A fixture\n * here would be read as measurement by anyone who scrolled past the badge that\n * qualified it — and a fabricated verdict about a real brand is a worse lie\n * than a fabricated percentage. An empty state is the honest thing to show when\n * the answer is \"nothing yet\".\n */\nexport function emptyLandingViewModel(form: CheckFormViewModel): BrandPerceptionViewModel {\n return {\n status: 'empty',\n title: 'Brand Perception Check',\n displayName: 'Check a brand',\n domain: '',\n form,\n }\n}\n",[],[165,166,294],"19bf501c-ea6f-43f0-9f73-2295a95628cb","client.ts","ef6e34d8-a7bd-11f1-b787-1607ee4eb77e",15,["D",1788456963255],"/**\n * The one place the timing is written. The script below rewrites the query\n * hint's text on every keystroke, so a suffix left only in the server markup\n * would survive until the visitor types and then silently disappear.\n */\nexport const QUERY_HINT_SUFFIX = 'Takes about 45 seconds.'\n\n/** Client-side enhancement only. The page remains usable with native forms and details. */\nexport const brandPerceptionClientScript = `\n(() => {\n const queries = document.querySelector('[data-query-hint]');\n const queryInput = document.getElementById('queries-input');\n if (queries && queryInput) {\n const max = Number(queries.dataset.max || 3);\n const update = () => {\n const used = queryInput.value.split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).length;\n const kept = Math.min(used, max);\n const rest = max - kept;\n const counts = kept === 0\n ? 'Add up to ' + max + '. We generate the rest.'\n : rest === 0\n ? 'Using your ' + kept + '. We generate none.'\n : 'Using your ' + kept + '. We generate the other ' + rest + '.';\n // Interpolated at module load so the server markup and every rewrite of\n // this line read one constant.\n queries.textContent = counts + ' ' + ${JSON.stringify(QUERY_HINT_SUFFIX)};\n };\n queryInput.addEventListener('input', update);\n update();\n }\n\n const form = document.querySelector('[data-domain-check-form]');\n if (form) {\n const submit = form.querySelector('[data-domain-submit]');\n const busy = form.querySelector('[data-form-busy]');\n const checking = document.querySelector('[data-checking]');\n\n const markBusy = () => {\n form.setAttribute('aria-busy', 'true');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = true;\n submit.setAttribute('aria-disabled', 'true');\n submit.textContent = 'Starting…';\n }\n if (busy) {\n busy.hidden = false;\n busy.classList.remove('is-error');\n busy.textContent = 'Starting check…';\n }\n };\n\n // Without the waiting view there is nothing to enhance: fall back to the\n // native POST, which still works, just with a blocked browser.\n if (!checking) {\n form.addEventListener('submit', markBusy);\n } else {\n const elapsedEl = checking.querySelector('[data-checking-elapsed]');\n const domainEl = checking.querySelector('[data-checking-domain]');\n const queriesEl = checking.querySelector('[data-checking-queries]');\n const hero = document.querySelector('[data-hero]');\n\n const restore = (message) => {\n checking.hidden = true;\n if (hero) hero.hidden = false;\n form.removeAttribute('aria-busy');\n if (submit instanceof HTMLButtonElement) {\n submit.disabled = false;\n submit.removeAttribute('aria-disabled');\n submit.textContent = submit.dataset.label || 'Check a brand';\n }\n if (busy) {\n busy.hidden = false;\n // A failure and \"Starting check…\" must not be the same grey line, or\n // hiding the waiting view reads as the page bouncing back to the form\n // with nothing said, while the reason sits on screen unnoticed.\n busy.classList.add('is-error');\n busy.textContent = message;\n }\n // A Turnstile token is redeemed exactly once. The page is still here\n // after a failure, so the spent token has to be replaced before the\n // visitor can try again.\n if (window.turnstile && typeof window.turnstile.reset === 'function') {\n try { window.turnstile.reset(); } catch (_) { /* widget absent */ }\n }\n };\n\n form.addEventListener('submit', (event) => {\n const data = new FormData(form);\n const domain = String(data.get('domain') || '').trim();\n if (!domain) return;\n event.preventDefault();\n markBusy();\n\n if (domainEl) domainEl.textContent = domain;\n const typed = String(data.get('queries') || '')\n .split('\\\\n').map((line) => line.trim()).filter((line) => line.length >= 3).slice(0, 3);\n if (queriesEl) {\n queriesEl.textContent = '';\n for (const question of typed) {\n const item = document.createElement('li');\n item.textContent = question;\n queriesEl.appendChild(item);\n }\n queriesEl.hidden = typed.length === 0;\n }\n if (hero) hero.hidden = true;\n checking.hidden = false;\n\n const started = Date.now();\n const tick = setInterval(() => {\n if (elapsedEl) elapsedEl.textContent = Math.round((Date.now() - started) / 1000) + 's';\n }, 1000);\n\n fetch(form.dataset.jsonAction || '/api/checks', {\n method: 'POST',\n headers: { 'content-type': 'application/json', accept: 'application/json' },\n body: JSON.stringify({\n domain: domain,\n queries: typed,\n turnstileToken: data.get('cf-turnstile-response') || null,\n }),\n })\n .then((response) => response.json().then((body) => ({ ok: response.ok, body: body })))\n .then((result) => {\n clearInterval(tick);\n const id = result.body && result.body.check && result.body.check.id;\n if (result.ok && id) {\n location.href = '/?check=' + encodeURIComponent(id);\n return;\n }\n const error = result.body && result.body.error;\n restore((error && error.message) || 'The check could not be started. Try again.');\n })\n .catch(() => {\n clearInterval(tick);\n restore('The check could not be reached. Try again.');\n });\n });\n }\n }\n})();\n`\n",[],[165,166,302],["D",1788474100516],[],[165,166,64],"ded814b2-e46f-462c-a9f1-97a00b7b4d1b","edf99f8e-a7bd-11f1-a791-1607ee4eb77e",["D",1788456960982],"directory",[189,190,191,192,193,194,195],[165,166],"b1055b7a-88af-4680-b7c7-bc6dfa7ef335","check-result.ts","efb36968-a7bd-11f1-a791-1607ee4eb77e","ee30f538-a7bd-11f1-a791-1607ee4eb77e",33,["D",1788474102019],"/**\n * What THIS val's check produces, and the reuse namespace that retires it.\n *\n * `@canonry/val-kit` is opaque to both: a `CheckRecord`\n * carries this schema through the kit's admission, lease, quota, and storage\n * machinery without the kit ever reading inside it, and `checkFingerprint` takes\n * the namespace as its first argument rather than inventing one. That is what\n * lets this val and the AI Visibility Check val store entirely different results\n * in the same table without either serving the other's cached work.\n */\nimport type { PerceptionReport } from 'npm:@canonry/val-kit@0.2.0/perception'\n\n/**\n * The reuse namespace for this product. It is the FIRST field of every\n * fingerprint, which is both the 24h cache key and the one-active-check index.\n *\n * Bump it — and only it — when a change adds or removes a measured signal, so\n * records that lack the new signal stop satisfying new requests at the moment\n * the signal set changed rather than at their own TTL. Never bump another\n * product's namespace, and never reuse one: two products keyed alike would\n * serve each other's results as cache hits, and a perception check and a\n * visibility check for one domain measure entirely different things.\n */\nexport const CHECK_FINGERPRINT_NAMESPACE = 'perception-v1'\n\nexport const CHECK_RESULT_SCHEMA_VERSION = '1.0' as const\n\nexport interface PerceptionCheckResult {\n schemaVersion: typeof CHECK_RESULT_SCHEMA_VERSION\n domain: string\n generatedAt: string\n /** Null when the one phase produced nothing at all. */\n perception: PerceptionReport | null\n errors: Array<{ area: 'perception'; message: string }>\n}\n",[],[165,327,319],"runtime","4f9d45fe-bb61-49dc-95e1-7721ed13d71e",4,["D",1788456961187],[187],[165,327],"a7f7a1ac-d0e9-403f-83a6-decfb8e0de07","tools.ts","efe97300-a7bd-11f1-90c1-1607ee4eb77e","ee403354-a7bd-11f1-adc2-1607ee4eb77e",35,["D",1788474102392],"/**\n * The MCP tool surface: reads over checks this val has already run, plus the\n * bundled skills for clients that do not implement MCP resources.\n *\n * Every tool but `start_check` is a read, and `start_check` runs the host's full\n * admission path — same global daily cap, same single execution lease, same\n * cache reuse — differing only in that it skips Turnstile, which an agent cannot\n * solve, and spends from its own tighter per-caller bucket. The global cap is\n * what bounds the bill; Turnstile bounds fairness, so this widens who may spend\n * the budget without widening the budget.\n *\n * Results are JSON in a text block rather than `structuredContent`, because\n * every client across both protocol eras renders text content, while typed\n * output is newer and unevenly implemented.\n */\nimport { type CheckRecord, checkFingerprint, type CheckStore, isCheckExpired } from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type { PerceptionEvidence } from 'npm:@canonry/val-kit@0.2.0/perception'\nimport { readSkillResource } from 'npm:@canonry/val-kit@0.2.0/mcp'\nimport { normalizePublicDomain, PublicUrlError } from 'npm:@canonry/val-kit@0.2.0/security'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\n/**\n * The one sentence that keeps this instrument out of the other one's table.\n *\n * Every question here NAMES the brand, so the engine was always going to talk\n * about it: a mention rate over this basket would read ~100% and mean nothing.\n * AI Visibility asks non-brand questions, where placement is actually decided.\n * The two never share a denominator, so the scope travels with every number.\n */\nconst BRANDED_SCOPE_NOTE =\n 'These are branded questions — the brand is named in each one — so the engine was always going to discuss it. ' +\n 'The finding is what it SAID, never whether it appeared. Never compare these figures to an AI Visibility ' +\n 'mention or citation rate: those are measured on non-brand queries and share no denominator with this.'\n\nexport interface McpToolDefinition {\n name: string\n title: string\n description: string\n inputSchema: Record\n}\n\nexport interface McpToolResult {\n content: Array<{ type: 'text'; text: string }>\n isError?: boolean\n}\n\n/** Runs the host's full admission path; absent when the host disables MCP starts. */\nexport type StartCheckFn = (\n domain: string,\n remoteIp: string | null,\n queries: readonly string[],\n) => Promise<{ record: CheckRecord; reused: boolean }>\n\nexport interface McpToolContext {\n store: CheckStore\n now: () => Date\n startCheck?: StartCheckFn\n /** Edge-provided caller identity, used only as the quota subject. */\n remoteIp?: string | null\n}\n\nfunction ok(payload: unknown): McpToolResult {\n return { content: [{ type: 'text', text: JSON.stringify(payload, null, 2) }] }\n}\n\nfunction fail(message: string, hint?: string): McpToolResult {\n return {\n content: [{ type: 'text', text: JSON.stringify(hint ? { error: message, hint } : { error: message }, null, 2) }],\n isError: true,\n }\n}\n\nconst TARGET_SCHEMA = {\n type: 'object',\n properties: {\n checkId: { type: 'string', description: 'A check ID returned by a previous tool call or shown in the web UI.' },\n domain: {\n type: 'string',\n description:\n 'A domain such as \"example.com\". Resolves the most recent cached check; it never starts one. Use start_check ' +\n 'to run a fresh check.',\n },\n },\n additionalProperties: false,\n} as const\n\n/**\n * Resolve either addressing mode to a readable record.\n *\n * A domain lookup only ever finds work the val already did — it never starts a\n * check — so a miss is reported as a miss rather than quietly queuing paid work\n * the caller did not ask for.\n */\nasync function resolveCheck(\n context: McpToolContext,\n args: Record,\n): Promise<{ record: CheckRecord } | { error: McpToolResult }> {\n const checkId = typeof args.checkId === 'string' ? args.checkId.trim() : ''\n const domain = typeof args.domain === 'string' ? args.domain.trim() : ''\n\n if (!checkId && !domain) return { error: fail('Provide either \"checkId\" or \"domain\".') }\n\n const now = context.now()\n\n if (checkId) {\n if (!CHECK_ID.test(checkId)) return { error: fail(`\"${checkId}\" is not a valid check ID.`) }\n const record = await context.store.get(checkId)\n if (!record || isCheckExpired(record, now)) {\n return {\n error: fail(`No check found for ID \"${checkId}\".`, 'Public checks expire; run a new one from the web UI.'),\n }\n }\n return { record }\n }\n\n let normalized: string\n try {\n normalized = normalizePublicDomain(domain).domain\n } catch (error) {\n return { error: fail(error instanceof PublicUrlError ? error.message : 'Enter a valid public domain.') }\n }\n\n const record = await context.store.findReusable(\n checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, normalized),\n now.toISOString(),\n )\n if (!record) {\n return {\n error: fail(\n `No cached check for \"${normalized}\".`,\n 'Run one with start_check, or from the web UI, then read it here.',\n ),\n }\n }\n return { record }\n}\n\n/** Shared envelope so every tool reports status and freshness the same way. */\nfunction recordEnvelope(record: CheckRecord) {\n return {\n checkId: record.id,\n domain: record.domain,\n status: record.status,\n createdAt: record.createdAt,\n updatedAt: record.updatedAt,\n expiresAt: record.expiresAt,\n error: record.errorCode ? { code: record.errorCode, message: record.errorMessage } : null,\n }\n}\n\n/**\n * The headline numbers, passed straight through from the record.\n *\n * Never recomputed here. The summary is what the instrument measured over the\n * rows it wrote; deriving it a second time on the read path is how a tool\n * payload starts disagreeing with the page and with itself.\n */\nfunction perceptionSummary(record: CheckRecord) {\n const perception = record.result?.perception\n if (!perception) return { measured: false as const }\n return {\n measured: true as const,\n scope: 'branded' as const,\n scopeNote: BRANDED_SCOPE_NOTE,\n brandNames: perception.brandNames,\n successfulChecks: perception.summary.successfulChecks,\n failedChecks: perception.summary.failedChecks,\n verdicts: perception.summary.verdicts,\n verdictNote:\n 'Counts are over successful checks only and sum to successfulChecks. \"none\" means the answer took no position, ' +\n 'which is a finding; a failed check has a null verdict and is in no denominator.',\n concerns: perception.summary.concerns,\n sourceTypes: perception.summary.sourceTypes,\n sourceNote:\n 'Sources the answer engine attributed for these answers, typed. A type counts once per answer, and an answer ' +\n 'that attributed nothing is stated as unattributedAnswers rather than folded into the denominator.',\n startedAt: perception.startedAt,\n completedAt: perception.completedAt,\n }\n}\n\nfunction evidenceRow(evidence: PerceptionEvidence) {\n return {\n query: evidence.query,\n provider: evidence.provider,\n servedModel: evidence.servedModel,\n completedAt: evidence.completedAt,\n // Null means this check produced no verdict — a failed probe or a failed\n // extraction. It is never 'none', which says the answer took no position.\n verdict: evidence.verdict,\n // Copied out of the answer and verified present in it, word for word.\n evidenceSentences: evidence.evidenceSentences,\n concerns: evidence.concerns,\n sources: evidence.sources,\n searchQueries: evidence.searchQueries,\n retrievalStatus: evidence.retrievalStatus,\n answerText: evidence.answerText,\n error: evidence.error,\n }\n}\n\n/**\n * The conversion path. An agent that has just shown a user what an engine says\n * about their brand is exactly where \"how do I get this properly\" gets asked,\n * and without this it would have to guess at an install command.\n */\nconst SELF_HOST_TOOL: McpToolDefinition = {\n name: 'self_host',\n title: 'How to self-host Canonry',\n description:\n 'How to run the full Canonry platform instead of this bounded sample: install command, repository, docs, and ' +\n 'what self-hosting adds over this endpoint. Call it when the user asks for more engines, scheduled tracking, ' +\n 'more questions, their own data, or how any of this actually works.',\n inputSchema: { type: 'object', properties: {}, additionalProperties: false },\n}\n\nconst START_CHECK_TOOL: McpToolDefinition = {\n name: 'start_check',\n title: 'Run a new brand perception check',\n description:\n 'Run a fresh check for a domain: three grounded Gemini answers to BRANDED questions about the brand, each read ' +\n 'back for the position it takes. Blocks until the check finishes, up to about 45 seconds, and returns the same ' +\n 'shape as get_check. A domain checked in the last 24 hours with the same questions returns the cached result ' +\n 'immediately and costs nothing. Daily limits apply.',\n inputSchema: {\n type: 'object',\n properties: {\n domain: { type: 'string', description: 'A domain such as \"example.com\".' },\n queries: {\n type: 'array',\n items: { type: 'string' },\n maxItems: 3,\n description:\n 'Optional. Up to 3 questions to put to the answer engine, used verbatim. Any remaining slots are filled ' +\n 'with branded questions generated for the brand, so supplying none generates all three.',\n },\n },\n required: ['domain'],\n additionalProperties: false,\n },\n}\n\nconst READ_TOOLS: readonly McpToolDefinition[] = [\n SELF_HOST_TOOL,\n {\n name: 'get_check',\n title: 'Get a brand perception check',\n description:\n 'Status and headline numbers for one brand check: how many answers recommend, caution, are mixed, or took no ' +\n 'position, the concerns those answers raised, and the mix of source types the engine attributed. Address it by ' +\n 'checkId or by domain. Every figure is scoped to BRANDED questions and is never comparable to an AI Visibility ' +\n 'mention or citation rate. Reads existing work only — it never starts a new check.',\n inputSchema: TARGET_SCHEMA,\n },\n {\n name: 'get_brand_perception',\n title: 'Get brand perception evidence',\n description:\n 'Per answer evidence for one check. Every row carries the verdict the answer gave, the sentences copied out of ' +\n 'that answer word for word which carry it, the concerns it wrote, the typed sources the engine attributed, and ' +\n 'the full answer text. A null verdict means that check produced none and was not measured — it is never \"none\", ' +\n 'which says the answer took no position. Branded scope; not comparable to AI Visibility rates.',\n inputSchema: TARGET_SCHEMA,\n },\n {\n name: 'read_skill',\n title: 'Read a Canonry skill document',\n description: 'Read one bundled canonry (operator) or aero (analyst) skill document as markdown. Accepts a ' +\n 'canonry-skill:// URI or a path such as \"aero/references/regression-playbook.md\". The full index is served as ' +\n 'MCP resources: call resources/list for every available URI, starting with the two SKILL.md entry points.',\n inputSchema: {\n type: 'object',\n properties: {\n uri: { type: 'string', description: 'A canonry-skill:// URI, or \"/\", or a bare reference path.' },\n },\n required: ['uri'],\n additionalProperties: false,\n },\n },\n]\n\n/** The advertised catalog. `start_check` appears only when the host can honour it. */\nexport function mcpTools(context: McpToolContext): readonly McpToolDefinition[] {\n return context.startCheck ? [...READ_TOOLS, START_CHECK_TOOL] : READ_TOOLS\n}\n\nexport async function callMcpTool(\n context: McpToolContext,\n name: string,\n args: Record,\n): Promise {\n switch (name) {\n case 'get_check': {\n const resolved = await resolveCheck(context, args)\n if ('error' in resolved) return resolved.error\n return ok({\n ...recordEnvelope(resolved.record),\n brandPerception: perceptionSummary(resolved.record),\n partialErrors: resolved.record.result?.errors ?? [],\n })\n }\n\n case 'get_brand_perception': {\n const resolved = await resolveCheck(context, args)\n if ('error' in resolved) return resolved.error\n const perception = resolved.record.result?.perception\n if (!perception) {\n return ok({\n ...recordEnvelope(resolved.record),\n measured: false,\n reason: resolved.record.status === 'queued' || resolved.record.status === 'running'\n ? 'The check is still running.'\n : 'This check has no brand perception result.',\n })\n }\n return ok({\n ...recordEnvelope(resolved.record),\n scope: 'branded',\n scopeNote: BRANDED_SCOPE_NOTE,\n summary: perceptionSummary(resolved.record),\n evidence: perception.evidence.map(evidenceRow),\n })\n }\n\n case 'start_check': {\n if (!context.startCheck) return fail('Starting a check is not enabled on this endpoint.')\n const domain = typeof args.domain === 'string' ? args.domain.trim() : ''\n if (!domain) return fail('Provide a \"domain\".')\n try {\n const queries = Array.isArray(args.queries) ? args.queries : []\n const { record, reused } = await context.startCheck(domain, context.remoteIp ?? null, queries)\n return ok({\n ...recordEnvelope(record),\n reused,\n brandPerception: perceptionSummary(record),\n partialErrors: record.result?.errors ?? [],\n })\n } catch (error) {\n // The host throws typed admission failures (quota, capacity, invalid\n // domain). Their messages are already caller-safe and actionable.\n return fail(error instanceof Error ? error.message : 'The check could not be started.')\n }\n }\n\n case 'self_host':\n return ok({\n summary:\n 'This endpoint is a bounded sample. Canonry is the full platform it samples: open source, self-hosted, ' +\n 'agent-first, with your own data in local SQLite.',\n install: 'npm install -g @canonry/canonry',\n quickstart: [\n 'npm install -g @canonry/canonry',\n 'canonry init',\n 'canonry project create my-site --domain example.com --country US --language en',\n 'canonry query add my-site \"best example widgets\"',\n 'canonry run my-site',\n 'canonry visibility-stats my-site',\n ],\n repository: 'https://github.com/Canonry/canonry',\n website: 'https://canonry.ai',\n package: 'https://www.npmjs.com/package/@canonry/canonry',\n license: 'FSL-1.1-ALv2',\n whatSelfHostingAdds: [\n 'All four answer engines — Gemini, ChatGPT, Claude, Perplexity — not Gemini alone.',\n 'Unlimited tracked questions and scheduled sweeps, instead of 3 branded questions on demand.',\n 'History, so you can see a verdict or a concern appear, spread, or go away.',\n 'Non-brand tracking as well: mention and citation coverage on the questions that decide placement.',\n 'Competitor mention share, regression insights, and a downloadable client report.',\n 'Google Search Console, GA4, Bing, Business Profile, and server-side traffic joined to the same view.',\n 'Your own MCP server (canonry-mcp, 188 tools) and the built-in Aero analyst agent.',\n 'Your data stays in your own SQLite database.',\n ],\n skills: 'The canonry and aero skill documents served by this endpoint are the same playbooks a local install ' +\n 'ships. Read canonry-skill://canonry/SKILL.md to operate the CLI.',\n })\n\n case 'read_skill': {\n const uri = typeof args.uri === 'string' ? args.uri.trim() : ''\n if (!uri) return fail('Provide a skill document \"uri\".')\n const contents = readSkillResource(uri)\n if (!contents) {\n return fail(`No skill document matches \"${uri}\".`, 'Call resources/list for the available URIs.')\n }\n return { content: [{ type: 'text', text: contents.text }] }\n }\n\n default:\n return null\n }\n}\n",[],[165,342,334],"mcp","a805ad1f-5e63-4ad1-a5d8-6c09069e902e","server.ts","efd79752-a7bd-11f1-ad99-1607ee4eb77e",34,["D",1788474102328],"/**\n * MCP method dispatch and the HTTP handler for the `/mcp` endpoint.\n *\n * The endpoint is anonymous, which is a deliberate consequence of what it\n * exposes: checks on this val are already public — the web UI serves any of\n * them from `/api/checks/:id` without a credential — and the skills ship in a\n * public npm package. A token would gate nothing already unreachable, while\n * making the endpoint useless as something an agent is simply pointed at.\n *\n * `start_check` is the one tool that spends. It is admitted by per-caller\n * quota rather than by a credential, under the same global daily cap as the\n * browser, so an anonymous caller can consume its share of the day's budget\n * but never enlarge it.\n */\nimport {\n isAllowedOrigin,\n jsonRpcError,\n JsonRpcErrorCodes,\n type JsonRpcResponse,\n jsonRpcResult,\n listSkillResources,\n type ParsedMcpRequest,\n parseMcpRequest,\n readSkillResource,\n SUPPORTED_PROTOCOL_VERSIONS,\n} from 'npm:@canonry/val-kit@0.2.0/mcp'\nimport { callMcpTool, type McpToolContext, mcpTools, type StartCheckFn } from './tools.ts'\n\n/** Version of this MCP surface, not of the Canonry package the val samples. */\nexport const MCP_SERVER_VERSION = '1.0.0'\n\nconst MAX_BODY_BYTES = 262_144\n\n// Named for what this endpoint is, not for the platform it samples. Calling it\n// `canonry` would tell an agent it had the whole product, when it has three\n// branded questions to one engine. The slug is the identifier a client keys\n// off; the display name lives in `title`, which is where a human reads it.\nconst SERVER_INFO = {\n name: 'brand-perception-check',\n title: 'Brand Perception Check (by Canonry)',\n version: MCP_SERVER_VERSION,\n} as const\n\nconst INSTRUCTIONS = [\n 'Brand Perception Check is a free, bounded sample of Canonry. It measures how an AI answer engine CHARACTERISES a',\n 'brand when it is asked about that brand directly. One check is 3 branded questions against Gemini, each answer',\n 'read back for the position it takes: enough to see what is being said, not enough to monitor it. Canonry itself is',\n 'open source, self-hosted, tracks Gemini, ChatGPT, Claude and Perplexity on a schedule, and has no such limits.',\n 'Call self_host for that.',\n '',\n 'Every question here NAMES the brand, so the engine was always going to discuss it. These figures are therefore',\n 'never comparable to an AI Visibility mention or citation rate, which are measured on non-brand questions and share',\n 'no denominator with this. Do not pool them and do not present one as the other.',\n '',\n 'A verdict is one of recommends, cautions, mixed, or none, and it is kept only when sentences copied WORD FOR WORD',\n 'out of that answer carry it. \"none\" means the answer took no position, which is a finding. A null verdict means',\n 'the check produced none and was not measured — it is not a neutral answer, and it is in no denominator. Nothing',\n 'here is a sentiment score; there is no such number and inventing one would misreport what was measured.',\n '',\n 'Sources are the ones the engine attributed for these answers, typed as official, community, review, news, or',\n 'other. They are not a claim about where opinions about the brand come from on the web.',\n '',\n 'Read the bundled skills with resources/list and read_skill: the aero entry point covers how to interpret and',\n 'report on this, the canonry entry point covers how to operate the CLI. Then use get_check for the headline',\n 'counts and get_brand_perception for the per-answer evidence behind them.',\n '',\n 'get_check and get_brand_perception read existing checks and never spend. start_check runs a fresh one, blocks for',\n 'up to about 45 seconds, and is subject to daily limits; a domain checked in the last 24 hours returns from cache',\n 'at no cost. Prefer reading before starting.',\n].join('\\n')\n\nexport interface McpHandlerOptions {\n store: McpToolContext['store']\n now?: () => Date\n /** Omit to keep the endpoint strictly read-only. */\n startCheck?: StartCheckFn\n}\n\nfunction jsonResponse(body: JsonRpcResponse, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' },\n })\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const declared = Number(request.headers.get('content-length'))\n if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) return null\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n return null\n }\n chunks.push(next.value)\n }\n const merged = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n merged.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(merged)\n}\n\n/**\n * Val injects `cf-connecting-ip`. `x-forwarded-for` is caller-controlled on a\n * public val and is deliberately ignored, so a caller cannot mint a fresh\n * quota identity per request.\n */\nfunction edgeIp(request: Request): string | null {\n const value = request.headers.get('cf-connecting-ip')?.trim()\n return value && value.length <= 128 ? value : null\n}\n\n/** Dispatch one parsed message. Returns null for a notification, which gets 202. */\nasync function dispatch(\n context: McpToolContext,\n request: ParsedMcpRequest,\n): Promise<{ response: JsonRpcResponse; status: number } | null> {\n const { message, protocolVersion } = request\n const id = message.id ?? null\n const params = message.params ?? {}\n\n switch (message.method) {\n case 'initialize': {\n // Echo a version the caller asked for when it is one we speak, so a\n // legacy client stays in its own era instead of being pushed forward\n // into rules it does not implement. A client that declared its version\n // only in the `MCP-Protocol-Version` header and omitted it from params\n // still gets its own era back, because `protocolVersion` carries what\n // the envelope declared; falling through to the newest version would\n // answer a 2025 client with 2026 rules it has no code for.\n const requested = typeof params.protocolVersion === 'string' ? params.protocolVersion : null\n const negotiated = requested && (SUPPORTED_PROTOCOL_VERSIONS as readonly string[]).includes(requested)\n ? requested\n : protocolVersion\n return {\n status: 200,\n response: jsonRpcResult(id, {\n protocolVersion: negotiated,\n capabilities: { tools: { listChanged: false }, resources: { listChanged: false, subscribe: false } },\n serverInfo: SERVER_INFO,\n instructions: INSTRUCTIONS,\n }),\n }\n }\n\n // Accepted so a legacy handshake completes. There is no session to advance.\n case 'notifications/initialized':\n case 'notifications/cancelled':\n return null\n\n case 'ping':\n return { status: 200, response: jsonRpcResult(id, {}) }\n\n case 'tools/list':\n return { status: 200, response: jsonRpcResult(id, { tools: mcpTools(context) }) }\n\n case 'tools/call': {\n const name = typeof params.name === 'string' ? params.name : ''\n const args = params.arguments && typeof params.arguments === 'object' && !Array.isArray(params.arguments)\n ? params.arguments as Record\n : {}\n if (!name) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, 'tools/call requires a \"name\".'),\n }\n }\n const result = await callMcpTool(context, name, args)\n if (!result) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, `Unknown tool \"${name}\".`),\n }\n }\n return { status: 200, response: jsonRpcResult(id, result) }\n }\n\n case 'resources/list':\n return { status: 200, response: jsonRpcResult(id, { resources: listSkillResources() }) }\n\n // Answered rather than refused: several clients probe both during startup,\n // and a method-not-found there reads as a broken server.\n case 'resources/templates/list':\n return { status: 200, response: jsonRpcResult(id, { resourceTemplates: [] }) }\n\n case 'prompts/list':\n return { status: 200, response: jsonRpcResult(id, { prompts: [] }) }\n\n case 'resources/read': {\n const uri = typeof params.uri === 'string' ? params.uri : ''\n const contents = uri ? readSkillResource(uri) : null\n if (!contents) {\n return {\n status: 200,\n response: jsonRpcError(id, JsonRpcErrorCodes.invalidParams, `Resource not found: \"${uri}\".`),\n }\n }\n return { status: 200, response: jsonRpcResult(id, { contents: [contents] }) }\n }\n\n default:\n // A notification (no id) must never be answered, even for an unknown\n // method: returning null yields the 202 no-body the handler sends for\n // notifications. A roots-capable client's notifications/roots/list_changed\n // would otherwise get a 404 it can read as \"endpoint gone\".\n if (request.isNotification) return null\n // Streamable HTTP pairs an unknown request with 404, which is how a client\n // tells a modern server apart from a legacy endpoint that lacks this route.\n return {\n status: 404,\n response: jsonRpcError(id, JsonRpcErrorCodes.methodNotFound, `Unknown method \"${message.method}\".`),\n }\n }\n}\n\n/** Handle one POST to the MCP endpoint. */\nexport function createMcpHandler(options: McpHandlerOptions): (request: Request) => Promise {\n const base: McpToolContext = {\n store: options.store,\n now: options.now ?? (() => new Date()),\n startCheck: options.startCheck,\n }\n\n return async (request: Request): Promise => {\n if (request.method !== 'POST') {\n // The modern revision removed the GET stream and DELETE teardown.\n return jsonResponse(\n jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'The MCP endpoint accepts POST only.'),\n 405,\n )\n }\n\n if (!isAllowedOrigin(request.headers, request.url)) {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'Origin not allowed.'), 403)\n }\n\n const raw = await readLimitedBody(request)\n if (raw === null) {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.invalidRequest, 'Request body is too large.'), 413)\n }\n\n let body: unknown\n try {\n body = JSON.parse(raw)\n } catch {\n return jsonResponse(jsonRpcError(null, JsonRpcErrorCodes.parseError, 'Request body is not valid JSON.'), 400)\n }\n\n const parsed = parseMcpRequest(request.headers, body)\n if (!parsed.ok) return jsonResponse(parsed.response, parsed.status)\n\n let outcome: Awaited>\n try {\n outcome = await dispatch({ ...base, remoteIp: edgeIp(request) }, parsed.request)\n } catch {\n // Never surface an internal message; a store failure can carry\n // deployment detail that does not belong on a public endpoint.\n return jsonResponse(\n jsonRpcError(parsed.request.message.id ?? null, JsonRpcErrorCodes.internalError, 'Internal error.'),\n 200,\n )\n }\n\n if (!outcome) {\n if (!parsed.request.isNotification) {\n // A request that dispatched as a notification would otherwise hang the\n // caller waiting for a response that is never coming.\n return jsonResponse(\n jsonRpcError(\n parsed.request.message.id ?? null,\n JsonRpcErrorCodes.invalidRequest,\n `\"${parsed.request.message.method}\" is a notification and must be sent without an \"id\".`,\n ),\n 400,\n )\n }\n return new Response(null, { status: 202, headers: { 'cache-control': 'no-store' } })\n }\n\n return jsonResponse(outcome.response, outcome.status)\n }\n}\n",[],[165,342,344],"943197cc-b06b-4946-9882-f880ef9fb6c8",["D",1788456961282],[184,185],[165,342],"8095e465-176e-46c9-93c3-c168a95fb230","perception-check.ts","eff3ae6a-a7bd-11f1-bcaa-1607ee4eb77e","ee5205ca-a7bd-11f1-adc2-1607ee4eb77e",32,["D",1788474101787],"import {\n type CheckStore,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_CHECK_UNAVAILABLE,\n type PublicCheckDispatchOptions,\n type PublicCheckRunner,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport type {\n PerceptionEvidence,\n PerceptionProbePort,\n PerceptionReport,\n PerceptionSummary,\n} from 'npm:@canonry/val-kit@0.2.0/perception'\nimport { safeProviderErrorMessage } from 'npm:@canonry/val-kit@0.2.0/visibility'\nimport { CHECK_RESULT_SCHEMA_VERSION, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\n/**\n * Ceiling for one check's provider work.\n *\n * There is ONE phase here, and it runs three deadlines in sequence: the branded\n * planner, one wave of probes, and the verdict extraction. `perception-budget.test.ts`\n * is the only thing that connects those numbers to this one.\n */\nexport const PUBLIC_CHECK_WORK_BUDGET_MS = 45_000\n\nconst PERCEPTION_GENERIC_ERROR = 'The brand perception check could not complete.'\nconst PERCEPTION_TIMEOUT_ERROR = 'The brand perception check timed out.'\nconst PERCEPTION_NOT_CONFIGURED_ERROR = 'The brand perception check is not configured for this demo.'\n\n/**\n * Why one branded question could not be measured, in the visitor's words.\n *\n * The probe runner already classifies a failure into a small closed set of\n * strings, and none of them carry a provider body, a request id, or a\n * credential. They are translated rather than passed through for two reasons.\n * The upstream wording says \"provider\", which is not a word this page uses. And\n * a sanitizer must not trust its input: an adapter that one day puts a transport\n * dump in `message` falls through to the generic sentence instead of publishing\n * it.\n */\nconst PUBLIC_PROBE_ERRORS = new Map([\n ['The provider request timed out.', 'The answer engine did not respond in time.'],\n ['The provider request was cancelled.', 'This check was cancelled before the answer engine replied.'],\n ['The provider rate-limited this request.', 'The answer engine rate-limited this check.'],\n ['The provider was temporarily unavailable.', 'The answer engine was temporarily unavailable.'],\n ['The provider credentials were rejected.', 'This check could not be authorized with the answer engine.'],\n ['The provider response contained no answer text.', 'The answer engine returned no answer text.'],\n ['The provider answer was cut off at the length limit.', 'The answer engine ran out of room mid-answer.'],\n ['The provider declined to answer this query.', 'The answer engine declined to answer this question.'],\n [\n 'The provider stopped the answer to avoid reciting a source.',\n 'The answer engine stopped short to avoid quoting a source.',\n ],\n ['The provider does not support the language of this query.', 'The answer engine does not support this language.'],\n ['The provider ended the answer on an internal tool error.', 'The answer engine hit an internal error mid-answer.'],\n [\n 'The provider ended the answer without writing anything.',\n 'The answer engine finished without saying anything for this question.',\n ],\n ['The provider stopped the answer for an unstated reason.', 'The answer engine stopped without giving a reason.'],\n ['The provider response has an invalid requested model.', 'The answer engine reported an unusable model.'],\n ['The provider request failed.', 'The answer engine did not return an answer.'],\n])\n\n/** Exported for the test that pins every runner failure to a public sentence. */\nexport function publicProbeError(message: string | null): string | null {\n if (message === null) return null\n return PUBLIC_PROBE_ERRORS.get(message) ?? PUBLIC_CHECK_UNAVAILABLE\n}\n\n/**\n * Why the whole PHASE could not run, as opposed to why one question failed.\n *\n * A phase throw is a planning failure or a provider failure thrown before a\n * single probe ran, and both arrive as an Error whose message the classifier\n * below already reduces to a closed set. Anything it does not recognize becomes\n * the generic sentence, so an unbounded provider message can never reach the\n * durable public record.\n */\nconst PUBLIC_PERCEPTION_PHASE_ERRORS = new Map([\n ['The provider rate-limited this request.', 'The answer engine rate-limited this check.'],\n ['The provider was temporarily unavailable.', 'The answer engine was temporarily unavailable.'],\n ['The provider credentials were rejected.', 'This check could not be authorized with the answer engine.'],\n ['The provider request timed out.', 'The answer engine did not respond in time.'],\n])\n\n/** Exported for the test that pins every phase failure to a public sentence. */\nexport function perceptionPhaseError(error: unknown): string {\n if (isTimeout(error)) return PERCEPTION_TIMEOUT_ERROR\n if (!(error instanceof Error)) return PERCEPTION_GENERIC_ERROR\n\n const classified = PUBLIC_PERCEPTION_PHASE_ERRORS.get(safeProviderErrorMessage(error))\n if (classified) return classified\n\n // A planning failure is the val's own string, not a provider body, and it is\n // a fact about the BRAND rather than about the engine: nothing could be asked\n // because nothing could be asked ABOUT. That is the difference between \"try\n // again\" and \"this will not work\".\n if (/perception planner/i.test(error.message)) {\n return 'Branded questions could not be generated for this brand.'\n }\n return PERCEPTION_GENERIC_ERROR\n}\n\nexport class PublicQuotaError extends Error {\n override name = 'PublicQuotaError'\n constructor(readonly scope: 'client' | 'global') {\n super(scope === 'client' ? 'Daily check limit reached.' : 'The public check is at capacity. Try again tomorrow.')\n }\n}\n\nexport interface PerceptionCheckRunnerOptions {\n store: CheckStore\n perceptionProbe: PerceptionProbePort | null\n ttlMs: number\n now?: () => Date\n}\n\nexport function createPerceptionCheckRunner(options: PerceptionCheckRunnerOptions): PublicCheckRunner {\n const now = options.now ?? (() => new Date())\n return {\n async run(checkId, dispatchOptions: PublicCheckDispatchOptions = {}) {\n const owner = dispatchOptions.executionLeaseOwner ?? crypto.randomUUID()\n const started = now()\n const jobLeaseUntil = new Date(started.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n // A supplied reservation must be released even when the durable job\n // vanished before this request-bound runner could claim it.\n let shouldReleaseExecutionLease = dispatchOptions.executionLeaseOwner !== undefined\n\n try {\n const record = await options.store.claimJob(checkId, owner, started.toISOString(), jobLeaseUntil)\n if (!record) return 'ignored'\n\n // Renew an admission reservation (or claim a direct-run lease) after\n // the durable job claim. A slow admission must never reach provider\n // work on a reservation that has expired in the meantime.\n const renewalAt = now()\n const executionLeaseUntil = new Date(renewalAt.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const hasExecutionLease = await options.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n owner,\n renewalAt.toISOString(),\n executionLeaseUntil,\n )\n if (!hasExecutionLease) {\n // A transient capacity race, not a failed check. Persist it back to\n // the queue so a later request can safely claim it.\n return (await options.store.requeueJob(checkId, owner, now().toISOString())) ? 'busy' : 'ignored'\n }\n shouldReleaseExecutionLease = true\n\n const signal = AbortSignal.timeout(PUBLIC_CHECK_WORK_BUDGET_MS)\n const errors: PerceptionCheckResult['errors'] = []\n let perception: PerceptionReport | null = null\n try {\n if (!options.perceptionProbe) throw new PerceptionNotConfiguredError()\n perception = sanitizePerception(\n await options.perceptionProbe.probe({\n domain: record.domain,\n userQueries: record.userQueries,\n maxProbeCalls: 3,\n signal,\n }),\n )\n } catch (error) {\n errors.push({\n area: 'perception',\n message: error instanceof PerceptionNotConfiguredError\n ? PERCEPTION_NOT_CONFIGURED_ERROR\n : perceptionPhaseError(error),\n })\n }\n\n const completedAt = now()\n const result: PerceptionCheckResult = {\n schemaVersion: CHECK_RESULT_SCHEMA_VERSION,\n domain: record.domain,\n generatedAt: completedAt.toISOString(),\n perception,\n errors,\n }\n // A report where nothing was measured produced no finding at all: every\n // denominator below it would be zero, so the record is a failure rather\n // than a result with empty sections. Reaching a configured ceiling is\n // never a failure here — there is no ceiling to reach, only questions\n // that were answered or were not.\n const status = perception === null || perception.summary.successfulChecks === 0\n ? 'failed'\n : perception.summary.failedChecks > 0 || errors.length > 0\n ? 'partial'\n : 'complete'\n await options.store.finalizeJob(checkId, owner, {\n status,\n updatedAt: completedAt.toISOString(),\n // Failed checks are never reused, but they still need a TTL so their\n // public capability URL and durable row do not live forever.\n expiresAt: new Date(completedAt.getTime() + options.ttlMs).toISOString(),\n result,\n errorCode: status === 'failed' ? 'check-failed' : null,\n errorMessage: status === 'failed' ? 'The public check could not complete.' : null,\n })\n return 'completed'\n } finally {\n if (shouldReleaseExecutionLease) {\n await options.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, owner)\n }\n }\n },\n }\n}\n\n/** Distinguishes \"no credential on this deployment\" from \"the engine failed\". */\nclass PerceptionNotConfiguredError extends Error {\n override name = 'PerceptionNotConfiguredError'\n}\n\n/**\n * Bound every string and array before the report becomes a durable public\n * record. The instrument already clips inside its own limits; this is the\n * boundary that does not trust it, and it is where the visitor's wording\n * replaces the provider's.\n */\nfunction sanitizePerception(report: PerceptionReport): PerceptionReport {\n return {\n schemaVersion: report.schemaVersion,\n domain: clip(report.domain, 253),\n brandNames: report.brandNames.slice(0, 20).map((name) => clip(name, 128)),\n startedAt: report.startedAt,\n completedAt: report.completedAt,\n summary: sanitizeSummary(report.summary),\n evidence: report.evidence.slice(0, 3).map(sanitizeEvidence),\n }\n}\n\n/**\n * Clipped and coerced, never RECOMPUTED. The summary is what the instrument\n * measured; deriving it a second time here would let a headline disagree with\n * the rows the reader is shown.\n */\nfunction sanitizeSummary(summary: PerceptionSummary): PerceptionSummary {\n return {\n successfulChecks: finiteCount(summary.successfulChecks),\n failedChecks: finiteCount(summary.failedChecks),\n verdicts: {\n recommends: finiteCount(summary.verdicts.recommends),\n cautions: finiteCount(summary.verdicts.cautions),\n mixed: finiteCount(summary.verdicts.mixed),\n none: finiteCount(summary.verdicts.none),\n },\n concerns: summary.concerns.slice(0, 24).map((concern) => ({\n phrase: clip(concern.phrase, 64),\n answers: finiteCount(concern.answers),\n })),\n sourceTypes: summary.sourceTypes === null ? null : {\n measuredAnswers: finiteCount(summary.sourceTypes.measuredAnswers),\n unattributedAnswers: finiteCount(summary.sourceTypes.unattributedAnswers),\n totalAppearances: finiteCount(summary.sourceTypes.totalAppearances),\n entries: summary.sourceTypes.entries.slice(0, 5).map((entry) => ({\n type: entry.type,\n answers: finiteCount(entry.answers),\n share: finiteRate(entry.share),\n })),\n },\n }\n}\n\nfunction sanitizeEvidence(evidence: PerceptionEvidence): PerceptionEvidence {\n return {\n query: clip(evidence.query, 300),\n provider: clip(evidence.provider, 80),\n requestedModel: clip(evidence.requestedModel, 160),\n servedModel: nullableClip(evidence.servedModel, 160),\n completedAt: evidence.completedAt,\n answerText: nullableClip(evidence.answerText, 4_000),\n verdict: evidence.verdict,\n // Already verified to be written in the answer, so these are the answer's\n // own words. Bounded anyway, like every other array on this record.\n evidenceSentences: evidence.evidenceSentences.slice(0, 3).map((sentence) => clip(sentence, 240)),\n concerns: evidence.concerns.slice(0, 8).map((concern) => clip(concern, 64)),\n sources: evidence.sources.slice(0, 12).map((source) => ({\n url: clip(source.url, 2_048),\n domain: source.domain === null ? null : clip(source.domain, 253),\n title: nullableClip(source.title, 300),\n type: source.type,\n })),\n searchQueries: evidence.searchQueries.slice(0, 12).map((query) => clip(query, 300)),\n retrievalStatus: evidence.retrievalStatus,\n // Provider adapters may include transport diagnostics, so only a known\n // classification survives; anything else becomes the generic sentence.\n error: publicProbeError(evidence.error),\n }\n}\n\nfunction finiteCount(value: number): number {\n return Number.isFinite(value) && value >= 0 ? Math.floor(value) : 0\n}\n\nfunction finiteRate(value: number): number {\n return Number.isFinite(value) ? Math.max(0, Math.min(1, value)) : 0\n}\n\nfunction nullableClip(value: string | null, max: number): string | null {\n return value == null ? null : clip(value, max)\n}\n\nfunction isTimeout(error: unknown): boolean {\n return error instanceof Error && (error.name === 'TimeoutError' || error.name === 'AbortError')\n}\n\nfunction clip(value: string, max: number): string {\n return value.length <= max ? value : `${value.slice(0, Math.max(0, max - 1))}…`\n}\n",[],[165,364,356],"jobs","ebf126d5-0f4e-4391-8a29-d0cf0edb41da",6,["D",1788456961408],[182],[165,364],"4f817035-aa37-4dfa-9636-dc05d001c627","app.ts","ef9ec922-a7bd-11f1-ba16-1607ee4eb77e","ee205a2a-a7bd-11f1-a3ef-1607ee4eb77e",27,["D",1788474100495],"import { Hono } from 'npm:hono@4.12.25'\nimport type { ValTownConfig } from 'npm:@canonry/val-kit@0.2.0/config'\nimport {\n type CheckRecord,\n checkFingerprint,\n type CheckStore,\n isCheckExpired,\n type JobDispatcher,\n newCheckRecord,\n normalizeUserQueries,\n PUBLIC_CHECK_EXECUTION_LEASE_MS,\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n PUBLIC_RATE_LIMITED_ERROR_CODE,\n} from 'npm:@canonry/val-kit@0.2.0/jobs'\nimport {\n HumanVerificationError,\n normalizePublicDomain,\n PublicUrlError,\n utcDay,\n} from 'npm:@canonry/val-kit@0.2.0/security'\nimport { PublicQuotaError } from '../jobs/perception-check.ts'\nimport { createMcpHandler } from '../mcp/server.ts'\nimport { CHECK_FINGERPRINT_NAMESPACE, type PerceptionCheckResult } from '../runtime/check-result.ts'\n\nconst MAX_BODY_BYTES = 4_096\nconst CHECK_ID = /^[0-9a-f-]{36}$/i\n\nexport interface PageAssets {\n styles: string\n script: string\n /** Plated logo, used as the favicon. */\n mark: string\n /** Bare glyph, used inline in the brand lockup. */\n glyph: string\n}\n\nexport interface ValTownAppDependencies {\n store: CheckStore\n config: ValTownConfig\n dispatcher: JobDispatcher\n /** The UI is injected so this host stays independent from the renderer implementation. */\n renderPage: (record: CheckRecord | null) => string\n assets: PageAssets\n now?: () => Date\n}\n\nexport class PublicCheckUnavailableError extends Error {\n override name = 'PublicCheckUnavailableError'\n}\n\nclass PublicCheckAdmissionBusyError extends Error {\n override name = 'PublicCheckAdmissionBusyError'\n constructor() {\n super('Another request for this domain is being accepted. Try again shortly.')\n }\n}\n\nclass PublicCheckCapacityError extends Error {\n override name = 'PublicCheckCapacityError'\n constructor() {\n super('The public check is at capacity. Try again shortly.')\n }\n}\n\nexport function createValTownApp(deps: ValTownAppDependencies): Hono {\n const app = new Hono()\n const now = deps.now ?? (() => new Date())\n\n app.use('*', async (context, next) => {\n const turnstileAllowed = deps.config.publicChecksEnabled &&\n deps.config.humanVerificationStatus === 'ready' && Boolean(deps.config.turnstileSiteKey)\n context.header('Content-Security-Policy', contentSecurityPolicy(turnstileAllowed))\n context.header('X-Content-Type-Options', 'nosniff')\n context.header('Referrer-Policy', 'strict-origin-when-cross-origin')\n context.header('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=()')\n context.header('Cross-Origin-Opener-Policy', 'same-origin')\n await next()\n })\n\n app.get('/healthz', (context) => context.json({ ok: true }))\n\n // Anonymous, read-only MCP over Streamable HTTP. It shares this app's store\n // so an agent reads exactly the checks the UI shows, and it owns its own\n // method/origin/envelope handling — including the 405 for a non-POST, which\n // is why it is registered for every method rather than POST alone.\n const mcp = createMcpHandler({\n store: deps.store,\n now,\n startCheck: deps.config.mcpStartChecksEnabled\n ? async (domain, remoteIp, queries) => {\n const outcome = await submitCheck(deps, {\n domain,\n queries,\n token: null,\n remoteIp,\n now: now(),\n admission: 'mcp',\n })\n return { record: (await deps.store.get(outcome.record.id)) ?? outcome.record, reused: outcome.reused }\n }\n : undefined,\n })\n app.all('/mcp', (context) => mcp(context.req.raw))\n // Immutable: the document references these with a content hash, so a changed\n // asset arrives under a new URL rather than waiting out a TTL.\n app.get('/assets/canonry-ui.css', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.styles, 200, { 'content-type': 'text/css; charset=utf-8' })\n })\n app.get('/assets/canonry-ui.js', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.script, 200, { 'content-type': 'application/javascript; charset=utf-8' })\n })\n app.get('/assets/canonry-mark.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.mark, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n app.get('/assets/canonry-glyph.svg', (context) => {\n context.header('Cache-Control', 'public, max-age=31536000, immutable')\n return context.body(deps.assets.glyph, 200, { 'content-type': 'image/svg+xml; charset=utf-8' })\n })\n\n app.get('/', async (context) => {\n const requestedId = context.req.query('check')\n const stored = requestedId && CHECK_ID.test(requestedId) ? await deps.store.get(requestedId) : null\n const record = stored && !isCheckExpired(stored, now()) ? stored : null\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(record))\n })\n\n app.get('/api/checks/:id', async (context) => {\n const id = context.req.param('id')\n if (!CHECK_ID.test(id)) return apiError(context, 404, 'not-found', 'Check not found.')\n const record = await deps.store.get(id)\n if (!record || isCheckExpired(record, now())) return apiError(context, 404, 'not-found', 'Check not found.')\n context.header('Cache-Control', 'no-store')\n return context.json({ check: publicCheckRecord(record) })\n })\n\n app.post('/api/checks', async (context) => {\n const payload = await parseJsonBody(context.req.raw)\n const outcome = await submitCheck(deps, {\n domain: payload.domain,\n queries: payload.queries,\n token: typeof payload.turnstileToken === 'string' ? payload.turnstileToken : null,\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n context.header('Cache-Control', 'no-store')\n if (outcome.dispatch === 'busy') {\n return apiError(context, 503, 'busy', 'The public check is at capacity. Try again shortly.')\n }\n return context.json(\n { check: publicCheckRecord(outcome.record), reused: outcome.reused },\n outcome.record.status === 'queued' || outcome.record.status === 'running' ? 202 : 200,\n )\n })\n\n app.post('/check', async (context) => {\n let submittedDomain: unknown = null\n try {\n const form = await parseFormBody(context.req.raw)\n submittedDomain = form.get('domain')\n const outcome = await submitCheck(deps, {\n domain: submittedDomain,\n queries: form.get('queries'),\n token: form.get('cf-turnstile-response'),\n remoteIp: remoteIp(context.req.raw),\n now: now(),\n })\n if (outcome.dispatch === 'busy') throw new PublicCheckCapacityError()\n return context.redirect(`/?check=${encodeURIComponent(outcome.record.id)}`, 303)\n } catch (error) {\n const failure = formFailureRecord(submittedDomain, now(), error)\n context.header('Cache-Control', 'no-store')\n return context.html(deps.renderPage(failure), formFailureStatus(error))\n }\n })\n\n app.notFound((context) => apiError(context, 404, 'not-found', 'Not found.'))\n app.onError((error, context) => {\n if (error instanceof PublicUrlError) return apiError(context, 400, 'invalid-domain', error.message)\n if (error instanceof HumanVerificationError) {\n const status = error.code === 'unavailable' || error.code === 'transport' ? 503 : 403\n return apiError(context, status, `human-verification-${error.code}`, error.message)\n }\n if (error instanceof PublicQuotaError) return apiError(context, 429, `${error.scope}-quota`, error.message)\n if (error instanceof PublicCheckAdmissionBusyError) return apiError(context, 503, 'admission-busy', error.message)\n if (error instanceof PublicCheckCapacityError) return apiError(context, 503, 'busy', error.message)\n if (error instanceof PublicCheckUnavailableError) return apiError(context, 503, 'unavailable', error.message)\n if (error instanceof BodyTooLargeError) {\n return apiError(context, 413, 'body-too-large', 'Request body is too large.')\n }\n if (error instanceof InvalidBodyError) return apiError(context, 400, 'invalid-body', error.message)\n return apiError(context, 500, 'internal-error', 'The public check could not be started.')\n })\n\n return app\n}\n\ninterface CheckSubmission {\n record: CheckRecord\n reused: boolean\n dispatch: 'completed' | 'busy' | 'ignored'\n}\n\ninterface SubmitInput {\n domain: unknown\n /** Raw caller input; normalized here, never trusted as given. */\n queries?: unknown\n token: string | null\n remoteIp: string | null\n now: Date\n /**\n * Which admission rules apply. `mcp` skips human verification, which an\n * agent cannot perform, and spends from a separate, tighter daily bucket so\n * it cannot consume the browser allowance. Every other control — the global\n * daily cap, the single execution lease, cache reuse — is identical.\n */\n admission?: 'browser' | 'mcp'\n}\n\nasync function submitCheck(\n deps: ValTownAppDependencies,\n input: SubmitInput,\n): Promise {\n if (!deps.config.publicChecksEnabled) {\n throw new PublicCheckUnavailableError(\n deps.config.publicChecksUnavailableMessage ?? 'Public checks are temporarily unavailable.',\n )\n }\n const target = normalizePublicDomain(input.domain)\n const userQueries = normalizeUserQueries(input.queries)\n const viaMcp = input.admission === 'mcp'\n if (!viaMcp) await deps.config.humanVerifier.verify({ token: input.token, remoteIp: input.remoteIp })\n // The questions join the reuse key. They change what the check measures, so\n // a second caller asking different questions about the same domain must not\n // be handed the first caller's answers.\n const fingerprint = checkFingerprint(CHECK_FINGERPRINT_NAMESPACE, target.domain, userQueries)\n const timestamp = input.now.toISOString()\n\n // Cached and already-active work is useful without consuming the one global\n // execution slot. This keeps same-domain retries quota- and capacity-free.\n const reusable = await deps.store.findReusable(fingerprint, timestamp)\n if (reusable) return dispatchExistingCheck(deps, reusable)\n\n const hashedClient = await hashQuotaSubject(deps.config.quotaSalt, input.remoteIp ?? 'unknown')\n // A distinct subject rather than a distinct scope: `CheckQuotaClaim.scope` is\n // a closed union, and prefixing keeps the two buckets disjoint without\n // widening a durable contract.\n const clientSubject = viaMcp ? `mcp:${hashedClient}` : hashedClient\n const clientMax = viaMcp ? deps.config.mcpPerClientDailyLimit : deps.config.perClientDailyLimit\n const day = utcDay(input.now)\n const executionLeaseOwner = crypto.randomUUID()\n const executionLeaseUntil = new Date(input.now.getTime() + PUBLIC_CHECK_EXECUTION_LEASE_MS).toISOString()\n const capacityAvailable = await deps.store.claimGlobalLease(\n PUBLIC_CHECK_EXECUTION_LEASE_NAME,\n executionLeaseOwner,\n timestamp,\n executionLeaseUntil,\n )\n if (!capacityAvailable) throw new PublicCheckCapacityError()\n\n let capacityHeld = true\n let dispatchOwnsCapacity = false\n const releaseCapacity = async () => {\n if (!capacityHeld) return\n await deps.store.releaseGlobalLease(PUBLIC_CHECK_EXECUTION_LEASE_NAME, executionLeaseOwner)\n capacityHeld = false\n }\n\n try {\n const admission = await deps.store.admit({\n candidate: newCheckRecord({\n id: crypto.randomUUID(),\n fingerprint,\n domain: target.domain,\n userQueries,\n now: input.now,\n }),\n now: timestamp,\n clientQuota: { scope: 'client', subject: clientSubject, day, max: clientMax },\n globalQuota: { scope: 'global', subject: 'all', day, max: deps.config.globalDailyLimit },\n })\n if (admission.kind === 'quota-exhausted') throw new PublicQuotaError(admission.scope)\n if (admission.kind === 'busy') throw new PublicCheckAdmissionBusyError()\n\n if (admission.kind === 'reused') {\n // A concurrent same-domain admission won. It must not inherit capacity\n // reserved by this request, so it goes through ordinary reuse dispatch.\n await releaseCapacity()\n return dispatchExistingCheck(deps, admission.record)\n }\n\n let dispatch: 'completed' | 'busy' | 'ignored' = 'ignored'\n if (admission.record.status === 'queued') {\n // Request-bound dispatch takes responsibility for this owner as soon as\n // it receives the promise. Its runner releases even a lost job claim.\n const dispatched = deps.dispatcher.dispatch(admission.record.id, { executionLeaseOwner })\n dispatchOwnsCapacity = true\n dispatch = await dispatched\n }\n return {\n record: (await deps.store.get(admission.record.id)) ?? admission.record,\n reused: admission.kind !== 'created',\n dispatch,\n }\n } finally {\n // The runner owns capacity only after dispatch receives the owner. The app\n // releases every admission, reuse, quota, and pre-dispatch error path.\n if (!dispatchOwnsCapacity) await releaseCapacity()\n }\n}\n\nasync function dispatchExistingCheck(\n deps: ValTownAppDependencies,\n record: CheckRecord,\n): Promise {\n const dispatch = record.status === 'queued' ? await deps.dispatcher.dispatch(record.id) : 'ignored'\n return {\n record: (await deps.store.get(record.id)) ?? record,\n reused: true,\n dispatch,\n }\n}\n\nfunction publicCheckRecord(\n record: CheckRecord,\n): Omit, 'fingerprint' | 'leaseOwner' | 'leaseUntil'> {\n const { fingerprint: _fingerprint, leaseOwner: _leaseOwner, leaseUntil: _leaseUntil, ...safe } = record\n return safe\n}\n\nfunction apiError(\n context: { json: (body: unknown, status?: number) => Response; header: (name: string, value: string) => void },\n status: number,\n code: string,\n message: string,\n): Response {\n context.header('Cache-Control', 'no-store')\n return context.json({ error: { code, message } }, status)\n}\n\nclass BodyTooLargeError extends Error {}\nclass InvalidBodyError extends Error {}\n\nasync function parseJsonBody(request: Request): Promise> {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/json')) {\n throw new InvalidBodyError('Expected a JSON request body.')\n }\n const text = await readLimitedBody(request)\n try {\n const parsed = JSON.parse(text)\n if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) throw new Error()\n return parsed as Record\n } catch {\n throw new InvalidBodyError('Request body must be a JSON object.')\n }\n}\n\nasync function parseFormBody(request: Request): Promise {\n if (!request.headers.get('content-type')?.toLowerCase().includes('application/x-www-form-urlencoded')) {\n throw new InvalidBodyError('Expected a form submission.')\n }\n return new URLSearchParams(await readLimitedBody(request))\n}\n\nasync function readLimitedBody(request: Request): Promise {\n const contentLength = Number(request.headers.get('content-length'))\n if (Number.isFinite(contentLength) && contentLength > MAX_BODY_BYTES) throw new BodyTooLargeError()\n if (!request.body) return ''\n const reader = request.body.getReader()\n const chunks: Uint8Array[] = []\n let length = 0\n while (true) {\n const next = await reader.read()\n if (next.done) break\n length += next.value.byteLength\n if (length > MAX_BODY_BYTES) {\n await reader.cancel()\n throw new BodyTooLargeError()\n }\n chunks.push(next.value)\n }\n const output = new Uint8Array(length)\n let offset = 0\n for (const chunk of chunks) {\n output.set(chunk, offset)\n offset += chunk.byteLength\n }\n return new TextDecoder().decode(output)\n}\n\nfunction remoteIp(request: Request): string | null {\n // Val injects this edge header. `x-forwarded-for` is caller-controlled on a\n // public val, so it is deliberately ignored for quota identity.\n const cf = request.headers.get('cf-connecting-ip')?.trim()\n if (cf && cf.length <= 128) return cf\n return null\n}\n\nasync function hashQuotaSubject(salt: string, value: string): Promise {\n const bytes = new TextEncoder().encode(`${salt}\\u0000${value}`)\n const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', bytes))\n return [...digest].map((byte) => byte.toString(16).padStart(2, '0')).join('')\n}\n\n/**\n * `frame-ancestors` allows Val Town because the val's own page previews the\n * deployed site in an iframe, and `'none'` renders that preview blank — the\n * first thing anyone arriving from val.town sees. The allowance is exactly the\n * hosting platform and nothing else, so ordinary clickjacking is still blocked.\n * There is little to hijack regardless: no session, no credential, and the only\n * action is submitting a public domain.\n */\nconst FRAME_ANCESTORS = [\"'self'\", 'https://www.val.town', 'https://val.town'].join(' ')\n\n/**\n * Geist is served from jsDelivr because a Val cannot ship the font itself:\n * woff2 is binary and Val Town refuses to push binary files. It is the same\n * package and version the dashboard bundles (`@fontsource-variable/geist`), so\n * the two surfaces render in the same typeface rather than this one silently\n * falling back to a system font, which is what it did before.\n */\nconst FONT_CDN = 'https://cdn.jsdelivr.net'\n\nfunction contentSecurityPolicy(turnstileAllowed: boolean): string {\n const turnstile = turnstileAllowed ? ' https://challenges.cloudflare.com' : ''\n return [\n \"default-src 'self'\",\n \"base-uri 'none'\",\n \"object-src 'none'\",\n `frame-ancestors ${FRAME_ANCESTORS}`,\n \"form-action 'self'\",\n `script-src 'self'${turnstile}`,\n `style-src 'self' ${FONT_CDN}`,\n `font-src ${FONT_CDN}`,\n `connect-src 'self'${turnstile}`,\n `frame-src${turnstile || \" 'none'\"}`,\n \"img-src 'self' data: https:\",\n ].join('; ')\n}\n\nfunction formFailureRecord(domain: unknown, now: Date, error: unknown): CheckRecord {\n const displayDomain = typeof domain === 'string' ? domain.trim().slice(0, 253) : ''\n const timestamp = now.toISOString()\n return {\n id: crypto.randomUUID(),\n fingerprint: '',\n domain: displayDomain,\n userQueries: [],\n status: 'failed',\n createdAt: timestamp,\n updatedAt: timestamp,\n expiresAt: null,\n result: null,\n errorCode: error instanceof PublicQuotaError ? PUBLIC_RATE_LIMITED_ERROR_CODE : 'form-submission-failed',\n errorMessage: formFailureMessage(error),\n leaseOwner: null,\n leaseUntil: null,\n }\n}\n\nfunction formFailureMessage(error: unknown): string {\n if (\n error instanceof PublicUrlError || error instanceof PublicQuotaError || error instanceof HumanVerificationError ||\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return error.message\n if (error instanceof BodyTooLargeError) return 'The submission was too large. Enter only a domain.'\n if (error instanceof InvalidBodyError) return 'The form could not be read. Try again.'\n return 'The public check could not be started. Try again later.'\n}\n\nfunction formFailureStatus(error: unknown): 400 | 403 | 413 | 429 | 503 {\n if (error instanceof PublicUrlError || error instanceof InvalidBodyError) return 400\n if (error instanceof BodyTooLargeError) return 413\n if (error instanceof PublicQuotaError) return 429\n if (\n error instanceof PublicCheckUnavailableError || error instanceof PublicCheckAdmissionBusyError ||\n error instanceof PublicCheckCapacityError\n ) return 503\n if (error instanceof HumanVerificationError) return error.code === 'invalid' ? 403 : 503\n return 503\n}\n",[],[165,379,371],"app","3d119210-fb81-4a4a-9cbb-b0eaa18880b4",3,["D",1788456961083],[180],[165,379],"c1a9a2b8-0174-4415-b76e-49d63d23fbdd",["D",1788456960824],[179,181,183,186,188],[165],["D",1788456812405],["D",1789501263826],{"_11":12,"_133":69},{"_11":12,"_128":129,"_68":69,"_30":-5,"_130":131,"_132":24},{"_39":72,"_13":16,"_33":36,"_120":79,"_121":-5,"_122":-5,"_123":-5,"_124":-5,"_125":-5,"_126":14,"_127":12},"ctx",{"_52":-5,"_152":427,"_428":429,"_430":431,"_432":24,"_433":24,"_434":24,"_435":94,"_436":-5,"_437":-7,"_438":-7,"_439":26,"_440":24,"_441":24,"_442":-5,"_443":24,"_444":24,"_445":24,"_446":-5},"ENV",{"_398":399,"_400":401,"_402":16,"_403":404,"_405":406,"_407":408,"_409":410,"_411":412,"_413":414,"_415":416,"_417":418,"_419":420,"_421":422,"_423":424,"_425":426},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · check-form.ts