${theme.ogHeadline}

${theme.name}

${theme.ogTagline}

\n `);\n\n // satori-html returns a VNode; satori types its first arg as ReactNode. The\n // shapes are compatible at runtime — cast to satori's own parameter type.\n const svg = await satori(\n markup as unknown as Parameters[0],\n { width: 1200, height: 630, fonts },\n );\n\n if (!wasmReady) {\n await initWasm(\n fetch(\"https://esm.sh/@resvg/resvg-wasm@2.6.2/index_bg.wasm\"),\n );\n wasmReady = true;\n }\n const resvg = new Resvg(svg, { fitTo: { mode: \"width\", value: 1200 } });\n return resvg.render().asPng();\n}\n\n/** Serve a server's cached card (memory, then blob). Null if not generated yet. */\nexport async function readVerifyOgImage(\n guildId: string,\n): Promise {\n const memo = pngCache.get(guildId);\n if (memo) return memo;\n try {\n const res = await blob.get(blobKey(guildId));\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.length > 0) {\n pngCache.set(guildId, buf);\n return buf;\n }\n } catch {\n // not generated yet\n }\n return null;\n}\n\n/**\n * Generate a server's card from its theme and persist it. Heavy (cold module +\n * wasm + font loads), so this runs from the cron — which executes to completion\n * without an HTTP request's wall-clock limit — never inline on the hot path.\n */\nexport async function refreshVerifyOgImage(\n guildId: string,\n theme: ResolvedTheme,\n): Promise {\n const png = await generate(theme);\n pngCache.set(guildId, png);\n // A Uint8Array is a valid body at runtime; the cast satisfies blob.set's\n // BodyInit typing (the DOM lib narrows BufferSource).\n await blob.set(blobKey(guildId), png as BodyInit);\n return png.length;\n}\n",[],[307],"17132867-73bb-4988-83a5-294b4451c209","mod.ts","f2ebeaa4-668d-11f1-9138-1607ee4eb77e",87,["D",1781305585743],"/**\n * Discord CAPTCHA Shield — CAPTCHA + Discord OAuth verification module.\n *\n * A self-contained verification gate for a Discord server:\n * 1. Visitor solves a Cloudflare Turnstile CAPTCHA.\n * 2. Server verifies the Turnstile token and mints a one-time, short-lived\n * state nonce (SQLite) bound to that passed challenge.\n * 3. Visitor authorizes via Discord OAuth2 (identify scope only).\n * 4. On callback the nonce is validated + burned, identity is read, and the\n * configured bot grants the verified role to the (already-joined) member.\n *\n * Config-driven: everything visual lives in ./theme.ts, everything secret comes\n * from env (see ./config.ts). To shield a second Discord, clone the whole val\n * and set that copy's env — its project-scoped SQLite keeps storage isolated.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { portalCss, type ResolvedTheme, resolveTheme } from \"./theme.ts\";\nimport {\n type ChannelKind,\n getChannel,\n getMessage,\n rememberChannel,\n rememberMessage,\n} from \"./store.ts\";\nimport {\n ALERTS_TABLE,\n ensureSchema,\n LOG_TABLE,\n STATES_TABLE,\n} from \"./schema.ts\";\nimport { resolveGuildTheme } from \"./guilds.ts\";\nimport {\n loadGuildConfig,\n loadSharedEnv,\n optEnv,\n seedLegacyGuildFromEnv,\n type SharedEnv,\n} from \"./config.ts\";\nimport { handleAdminRequest } from \"./admin.ts\";\n\n/** Brand defaults, used when no specific server is in scope (generic error\n * pages, 404s). Per-server pages resolve their own theme. */\nconst defaultTheme: ResolvedTheme = resolveTheme();\n\n// ========================================\n// CONSTANTS\n// ========================================\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\nconst TURNSTILE_VERIFY_URL =\n \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\nconst STATE_TTL_MS = 10 * 60 * 1000; // verification link valid for 10 minutes\n\n// Table names + schema/migrations live in ./schema.ts (STATES_TABLE,\n// LOG_TABLE, ALERTS_TABLE are imported above).\n\n// Raid detection: alert when an abnormal number of *successful* verifications\n// land within a short window (the pattern Turnstile can't catch — farmed\n// accounts solving real CAPTCHAs). Debounced so we send at most one alert per\n// cooldown. These are defaults; override per-deployment via VerifyConfig.\nconst DEFAULT_RAID_WINDOW_MS = 5 * 60 * 1000; // look back 5 minutes\nconst DEFAULT_RAID_THRESHOLD = 15; // successes within window that trips alert\nconst DEFAULT_ALERT_COOLDOWN_MS = 15 * 60 * 1000; // min gap between alerts\n\n// ========================================\n// TYPES\n// ========================================\n\nexport interface VerifyConfig {\n clientId: string;\n clientSecret: string;\n botToken: string;\n guildId: string;\n roleId: string;\n turnstileSiteKey: string;\n turnstileSecretKey: string;\n /** Display name shown on the portal (defaults to the brand name). */\n serverName?: string;\n /** Override the derived `${origin}/callback` (use for custom domains). */\n redirectUriOverride?: string;\n /** Optional Discord webhook URL for raid alerts. No alerts if unset. */\n alertWebhookUrl?: string;\n /** Successful verifications within the window that trip a raid alert. */\n raidThreshold?: number;\n /** Raid-detection look-back window, in milliseconds. */\n raidWindowMs?: number;\n /** Minimum gap between raid alerts, in milliseconds. */\n alertCooldownMs?: number;\n /** Channel the bot posts the verification message into (for postVerifyMessage). */\n verifyChannelId?: string;\n /** Public base URL of the portal (for the Verify button + card image). */\n portalUrl?: string;\n /** Channel the bot posts the rules embed into (for postRulesMessage). */\n rulesChannelId?: string;\n /** Honeypot/trap channel the bot posts the \"do not post\" warning into. */\n honeypotChannelId?: string;\n /** DMZ channel the bot posts the \"about the community\" embed into. */\n aboutChannelId?: string;\n}\n\ninterface DiscordUser {\n id: string;\n username?: string;\n}\n\n// ========================================\n// DATABASE\n// ========================================\n\n/** Ensure all tables/migrations exist. Delegates to the centralized,\n * memoized schema module so every query can call it cheaply. */\nasync function ensureTables(): Promise {\n await ensureSchema();\n}\n\n/** Delete used or expired nonces. Cheap because the table only ever holds\n * in-flight verifications (we prune on every mint). Best-effort. */\nasync function pruneStates(): Promise {\n try {\n await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n } catch {\n // pruning is best-effort; never block a verification on it\n }\n}\n\n/** Mint a one-time state nonce bound to a guild. Only called after Turnstile\n * has passed. The guild is recovered from the nonce on callback. */\nasync function mintState(guildId: string): Promise {\n await ensureTables();\n await pruneStates();\n const state = crypto.randomUUID();\n await sqlite.execute({\n sql:\n `INSERT INTO ${STATES_TABLE} (state, guild_id, created_at, used) VALUES (?, ?, ?, 0)`,\n args: [state, guildId, Date.now()],\n });\n return state;\n}\n\n/** Validate and atomically burn a state nonce, returning the guild it was\n * bound to. Returns a reason on failure. */\nasync function consumeState(\n state: string,\n): Promise<\n { ok: true; guildId: string | null } | { ok: false; reason: string }\n> {\n await ensureTables();\n const now = Date.now();\n\n // Atomic single-use: only the request that flips `used` from 0->1 on a\n // still-valid row wins. Concurrent callbacks for the same state can't both\n // succeed (no check-then-act race).\n const burn = await sqlite.execute({\n sql:\n `UPDATE ${STATES_TABLE} SET used = 1 WHERE state = ? AND used = 0 AND created_at > ?`,\n args: [state, now - STATE_TTL_MS],\n });\n if ((burn.rowsAffected || 0) === 1) {\n // The row we just burned still exists (used = 1); read its guild binding.\n const res = await sqlite.execute({\n sql: `SELECT guild_id FROM ${STATES_TABLE} WHERE state = ?`,\n args: [state],\n });\n const raw = res.rows?.[0]?.[0];\n return { ok: true, guildId: raw == null ? null : String(raw) };\n }\n\n // The burn didn't take — figure out why for a helpful message (rare path).\n const res = await sqlite.execute({\n sql: `SELECT used, created_at FROM ${STATES_TABLE} WHERE state = ?`,\n args: [state],\n });\n if (!res.rows || res.rows.length === 0) {\n return { ok: false, reason: \"Invalid session. Please start over.\" };\n }\n if (Number(res.rows[0][0])) {\n return { ok: false, reason: \"This verification link was already used.\" };\n }\n return { ok: false, reason: \"Your session expired. Please start over.\" };\n}\n\nasync function logVerification(\n guildId: string,\n user: DiscordUser,\n success: boolean,\n detail: string,\n): Promise {\n try {\n await ensureTables();\n await sqlite.execute({\n sql:\n `INSERT INTO ${LOG_TABLE} (guild_id, discord_user_id, discord_username, created_at, success, detail) VALUES (?, ?, ?, ?, ?, ?)`,\n args: [\n guildId,\n user.id,\n user.username ?? null,\n Date.now(),\n success ? 1 : 0,\n detail,\n ],\n });\n } catch {\n // logging is best-effort\n }\n}\n\n/**\n * Prune ephemeral nonces and age out the audit log. Called by the cron.\n * Returns how many rows were deleted from each table.\n */\nexport async function cleanupVerifyData(\n logRetentionDays: number,\n): Promise<{ states: number; logs: number }> {\n await ensureTables();\n const states = await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n const logs = await sqlite.execute({\n sql: `DELETE FROM ${LOG_TABLE} WHERE created_at < ?`,\n args: [Date.now() - logRetentionDays * 24 * 60 * 60 * 1000],\n });\n return { states: states.rowsAffected || 0, logs: logs.rowsAffected || 0 };\n}\n\n// ========================================\n// DISCORD + TURNSTILE\n// ========================================\n\nasync function verifyTurnstile(\n secret: string,\n token: string,\n ip: string | null,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"secret\", secret);\n form.set(\"response\", token);\n if (ip) form.set(\"remoteip\", ip);\n\n const res = await fetch(TURNSTILE_VERIFY_URL, { method: \"POST\", body: form });\n const data = await res.json().catch(() => ({ success: false }));\n return data.success === true;\n}\n\nasync function exchangeCode(\n config: VerifyConfig,\n code: string,\n redirectUri: string,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"client_id\", config.clientId);\n form.set(\"client_secret\", config.clientSecret);\n form.set(\"grant_type\", \"authorization_code\");\n form.set(\"code\", code);\n form.set(\"redirect_uri\", redirectUri);\n\n const res = await fetch(`${DISCORD_API}/oauth2/token`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: form,\n });\n if (!res.ok) return null;\n const data = await res.json();\n return (data.access_token as string) ?? null;\n}\n\nasync function fetchDiscordUser(\n accessToken: string,\n): Promise {\n const res = await fetch(`${DISCORD_API}/users/@me`, {\n headers: { authorization: `Bearer ${accessToken}` },\n });\n if (!res.ok) return null;\n return await res.json() as DiscordUser;\n}\n\n/**\n * Grant the verified role to an existing guild member.\n * Returns the HTTP status and, on failure, the Discord error code so callers\n * can distinguish \"user not in guild\" from configuration problems.\n */\nasync function grantRole(\n config: VerifyConfig,\n userId: string,\n): Promise<{ status: number; body: string; code?: number }> {\n const res = await fetch(\n `${DISCORD_API}/guilds/${config.guildId}/members/${userId}/roles/${config.roleId}`,\n {\n method: \"PUT\",\n headers: {\n authorization: `Bot ${config.botToken}`,\n \"x-audit-log-reason\": \"Passed CAPTCHA verification portal\",\n },\n },\n );\n if (res.status === 204) return { status: 204, body: \"\" };\n const body = await res.text();\n let code: number | undefined;\n try {\n code = JSON.parse(body)?.code;\n } catch {\n // non-JSON error body\n }\n return { status: res.status, body, code };\n}\n\n/**\n * Fire a Discord webhook alert if the rate of successful verifications spikes\n * past RAID_THRESHOLD within RAID_WINDOW_MS. Debounced via an atomic update so\n * only one request per ALERT_COOLDOWN_MS sends. Best-effort and never blocks\n * the verifying user's response. No-op when no webhook is configured.\n */\nasync function maybeAlertRaid(\n config: VerifyConfig,\n theme: ResolvedTheme,\n): Promise {\n if (!config.alertWebhookUrl) return;\n const threshold = config.raidThreshold ?? DEFAULT_RAID_THRESHOLD;\n const windowMs = config.raidWindowMs ?? DEFAULT_RAID_WINDOW_MS;\n const cooldownMs = config.alertCooldownMs ?? DEFAULT_ALERT_COOLDOWN_MS;\n // One debounce row per server; the guild is namespaced into the alert kind so\n // each tenant alerts (and cools down) independently.\n const kind = `raid:${config.guildId}`;\n try {\n const now = Date.now();\n const countRes = await sqlite.execute({\n sql:\n `SELECT COUNT(*) FROM ${LOG_TABLE} WHERE guild_id = ? AND success = 1 AND created_at > ?`,\n args: [config.guildId, now - windowMs],\n });\n const count = Number(countRes.rows?.[0]?.[0] ?? 0);\n if (count < threshold) return;\n\n // Atomic debounce: ensure a row exists, then only the request that moves\n // last_alert_at past the cooldown actually sends.\n await sqlite.execute({\n sql:\n `INSERT OR IGNORE INTO ${ALERTS_TABLE} (kind, last_alert_at) VALUES (?, 0)`,\n args: [kind],\n });\n const claimed = await sqlite.execute({\n sql:\n `UPDATE ${ALERTS_TABLE} SET last_alert_at = ? WHERE kind = ? AND last_alert_at < ?`,\n args: [now, kind, now - cooldownMs],\n });\n if ((claimed.rowsAffected || 0) !== 1) return;\n\n await sendDiscordAlert(\n config.alertWebhookUrl,\n theme,\n count,\n windowMs,\n threshold,\n );\n } catch {\n // alerting is best-effort\n }\n}\n\nasync function sendDiscordAlert(\n webhookUrl: string,\n theme: ResolvedTheme,\n count: number,\n windowMs: number,\n threshold: number,\n): Promise {\n const windowMin = Math.round(windowMs / 60000);\n await fetch(webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({\n username: \"Verification Shield\",\n allowed_mentions: { parse: [] },\n embeds: [{\n title: \"⚠️ Possible verification raid\",\n description:\n `**${count}** accounts verified in the last **${windowMin} min** on **${theme.name}** — above the alert threshold of ${threshold}. This may be a coordinated raid using farmed accounts (Turnstile can't catch those). Consider pausing verification or tightening server join settings.`,\n color: theme.embedColor,\n timestamp: new Date().toISOString(),\n }],\n }),\n });\n}\n\n/**\n * Have the bot post the verification message (branded embed + a link \"Verify\"\n * button) into the configured channel. Triggered manually (post-verify.ts),\n * not on a schedule. The bot needs Send Messages + Embed Links in that channel.\n */\nexport async function postVerifyMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"verify\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No verify channel. Run setup.ts to create the DMZ channels, or set DISCORD_VERIFY_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n if (!config.portalUrl) {\n return {\n ok: false,\n detail: \"Set VERIFY_PORTAL_URL (or VERIFY_REDIRECT_URI) to the portal URL.\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n\n const payload = {\n embeds: [{\n title: \"Server Verification\",\n description:\n `Welcome to **${serverName}**! To keep the community safe from bots and raids, new members verify before getting access.\\n\\nClick **Verify** below, complete a quick CAPTCHA, and your role is granted automatically.`,\n color: theme.embedColor,\n image: { url: `${base}/og.png` },\n }],\n components: [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"verify\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the server rules as a branded embed into the configured\n * channel. Triggered manually (post-rules.ts). The bot needs Send Messages\n * + Embed Links in that channel.\n */\nexport async function postRulesMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"rules\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No rules channel. Run setup.ts to create the DMZ channels, or set DISCORD_RULES_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n\n const payload = {\n embeds: [{\n title: \"Discord Rules\",\n description:\n \"Our hope is that we rarely need to enforce these, but it's to everyone's benefit to be clear about who we are and what we expect. The mod team will enforce these rules as necessary.\",\n color: theme.embedColor,\n thumbnail: { url: theme.logoUrl },\n fields: theme.rules,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"rules\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the \"About the community\" embed into a DMZ channel — one an\n * unverified member can see — so newcomers know what they're joining before\n * they verify. Triggered manually (post-about.ts). Pulls links to the verify +\n * rules channels (as #mentions) when those IDs are set, and adds a Verify\n * button when VERIFY_PORTAL_URL is configured. The bot needs Send Messages +\n * Embed Links in that channel.\n */\nexport async function postAboutMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"about\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No about channel. Run setup.ts to create the DMZ channels, or set DISCORD_ABOUT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n\n // Point newcomers at the next step. Prefer channel mentions; fall back to a\n // plain instruction when those IDs aren't configured.\n const pointers: string[] = [];\n if (verifyId) pointers.push(`Ready? Verify in <#${verifyId}> to unlock the server.`);\n if (rulesId) pointers.push(`Read the rules in <#${rulesId}> first.`);\n\n const fields = [...theme.about.highlights];\n if (pointers.length) {\n fields.push({ name: \"👉 Getting in\", value: pointers.join(\"\\n\") });\n }\n\n const embed: Record = {\n title: `About ${serverName}`,\n description: `*${theme.about.tagline}*\\n\\n${theme.about.description}`,\n color: theme.embedColor,\n thumbnail: { url: theme.logoUrl },\n fields,\n footer: { text: serverName },\n };\n\n const payload: Record = {\n embeds: [embed],\n allowed_mentions: { parse: [] },\n };\n // When we know the portal URL, give the About card its own Verify button so\n // the DMZ has a one-click path in.\n if (config.portalUrl) {\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n payload.components = [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }];\n }\n\n return await upsertMessage(\"about\", channelId, config, payload, opts);\n}\n\n// ========================================\n// CHANNEL + MESSAGE RESOLUTION\n// ========================================\n\nexport interface PostOpts {\n /** Override the resolved channel (raw ID, link, or #mention). */\n channelId?: string;\n /** Edit this specific message instead of the stored one. */\n messageId?: string;\n /** Always post a new message, ignoring any stored message ID. */\n forceNew?: boolean;\n}\n\n/** Extract a numeric channel ID from a raw ID, a #mention, or a channel link. */\nexport function parseChannelId(raw: string | undefined): string {\n if (!raw) return \"\";\n const t = raw.trim();\n const m = t.match(/channels\\/\\d+\\/(\\d+)/);\n return m ? m[1] : t.replace(/\\D/g, \"\");\n}\n\n/** The env-derived channel field on config for a given DMZ message kind. */\nfunction channelEnvField(\n config: VerifyConfig,\n kind: ChannelKind,\n): string | undefined {\n switch (kind) {\n case \"about\":\n return config.aboutChannelId;\n case \"rules\":\n return config.rulesChannelId;\n case \"verify\":\n return config.verifyChannelId;\n case \"honeypot\":\n return config.honeypotChannelId;\n }\n}\n\n/**\n * Resolve a DMZ channel ID in priority order:\n * 1. an explicit override (e.g. opts.channelId)\n * 2. a channel the bot created (blob store)\n * 3. the env var (config field)\n * Returns \"\" when none is known.\n */\nexport async function resolveChannel(\n kind: ChannelKind,\n config: VerifyConfig,\n explicit?: string,\n): Promise {\n const direct = parseChannelId(explicit);\n if (direct) return direct;\n const stored = await getChannel(config.guildId, kind);\n if (stored) return stored;\n return parseChannelId(channelEnvField(config, kind));\n}\n\n/**\n * Post `payload` into `channelId`, or EDIT the message we last posted for this\n * kind — so re-running a post tool updates in place instead of duplicating.\n * Which message to edit: opts.messageId, else the stored id (unless\n * opts.forceNew). A stored-but-deleted message (404) falls back to a fresh\n * post. Remembers the resulting channel + message IDs in the blob store.\n */\nasync function upsertMessage(\n kind: ChannelKind,\n channelId: string,\n config: VerifyConfig,\n payload: Record,\n opts: PostOpts,\n): Promise<{ ok: boolean; detail: string }> {\n const headers = {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n const targetId = opts.messageId ??\n (opts.forceNew ? undefined : await getMessage(config.guildId, kind));\n\n if (targetId) {\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages/${targetId}`,\n { method: \"PATCH\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n await rememberMessage(config.guildId, kind, targetId);\n await rememberChannel(config.guildId, kind, channelId);\n return {\n ok: true,\n detail: `updated message ${targetId} in channel ${channelId}`,\n };\n }\n // A 404 means the stored message was deleted — fall through to a fresh post.\n if (res.status !== 404) {\n return {\n ok: false,\n detail:\n `Discord ${res.status} editing message ${targetId} in channel ${channelId}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n }\n\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages`,\n { method: \"POST\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n const msg = await res.json().catch(() => ({} as { id?: string }));\n if (msg?.id) await rememberMessage(config.guildId, kind, String(msg.id));\n await rememberChannel(config.guildId, kind, channelId);\n return {\n ok: true,\n detail: `posted to channel ${channelId}${msg?.id ? ` (message ${msg.id})` : \"\"}`,\n };\n }\n return {\n ok: false,\n detail:\n `Discord ${res.status} posting to channel ${channelId}: ${(await res.text()).slice(0, 200)} — check the ID is correct and the bot can view + post in that channel.`,\n };\n}\n\n/**\n * Have the bot post a \"do not post here\" warning into a honeypot/trap channel,\n * pointing legit users to verification (and the rules). Bots that auto-spam\n * every channel reveal themselves here. Triggered manually (post-honeypot.ts).\n * The verify/rules links use channel mentions resolved from the existing\n * DISCORD_VERIFY_CHANNEL_ID / DISCORD_RULES_CHANNEL_ID.\n */\nexport async function postHoneypotMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"honeypot\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No honeypot channel. Run setup.ts to create the DMZ channels, or set DISCORD_HONEYPOT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n const serverName = theme.name;\n\n const lines = [\"**Please do not post in this channel.**\", \"\"];\n lines.push(\n verifyId\n ? `To unlock ${serverName}, head to <#${verifyId}> and complete verification.`\n : `To unlock ${serverName}, complete verification in the verification channel.`,\n );\n if (rulesId) lines.push(`New here? Read the rules in <#${rulesId}>.`);\n lines.push(\"\", \"This channel is monitored — anything posted here may be treated as spam.\");\n\n const payload = {\n embeds: [{\n title: \"Do Not Post In This Channel\",\n description: lines.join(\"\\n\"),\n color: theme.embedColor,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"honeypot\", channelId, config, payload, opts);\n}\n\n// ========================================\n// RENDERING\n// ========================================\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nconst DISCORD_GLYPH =\n ``;\n\nfunction shell(\n theme: ResolvedTheme,\n innerHtml: string,\n ogImage: string,\n): string {\n const name = theme.name;\n return `\n\n\n \n \n \n Verify · ${escapeHtml(name)}\n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n

\n ${innerHtml}\n

\n\n`;\n}\n\n// The portal page is identical for every visitor of a given server (depends\n// only on that server's static config + theme), so build it once per\n// (guild, theme, og) key and reuse the string.\nconst portalPageCache = new Map();\n\nexport function renderPortalPage(\n config: VerifyConfig,\n theme: ResolvedTheme,\n ogImage: string,\n): string {\n const serverName = theme.name;\n const startPath = `/g/${config.guildId}/start`;\n const cacheKey =\n `${config.guildId}|${config.turnstileSiteKey}|${serverName}|${theme.logoUrl}|${theme.accentColor}|${ogImage}`;\n const cached = portalPageCache.get(cacheKey);\n if (cached) return cached;\n const inner = `\n $\"${escapeHtml(serverName)}\"$ \n

Are you human?

${escapeHtml(serverName)} · Access Check

1 Pass the CAPTCHA below
2 Authorize with Discord
3 Receive your verified role

\n \n

Protected by Cloudflare Turnstile

\n \n `;\n const html = shell(theme, inner, ogImage);\n portalPageCache.set(cacheKey, html);\n return html;\n}\n\nexport function renderResultPage(\n theme: ResolvedTheme,\n success: boolean,\n message: string,\n restartHref = \"/\",\n): string {\n const inner = `\n

${success ? \"✓\" : \"✕\"}

${success ? \"Verified\" : \"Verification failed\"}

${escapeHtml(message)}

\n ${success ? \"\" : `

Start Over

`}`;\n return shell(theme, inner, theme.ogFallbackImage);\n}\n\n// ========================================\n// RESPONSE HELPERS\n// ========================================\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction htmlResponse(body: string, status = 200): Response {\n return new Response(body, {\n status,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\nfunction redirectUriFor(config: VerifyConfig, url: URL): string {\n return config.redirectUriOverride ?? `${url.origin}/callback`;\n}\n\n// ========================================\n// ROUTE HANDLERS\n// ========================================\n\nasync function handleStart(\n req: Request,\n url: URL,\n config: VerifyConfig,\n): Promise {\n let token = \"\";\n try {\n const body = await req.json();\n token = String(body?.token ?? \"\");\n } catch {\n return jsonResponse({ error: \"Bad request.\" }, 400);\n }\n if (!token) {\n return jsonResponse({ error: \"Please complete the CAPTCHA first.\" }, 400);\n }\n\n const ok = await verifyTurnstile(\n config.turnstileSecretKey,\n token,\n req.headers.get(\"cf-connecting-ip\"),\n );\n if (!ok) {\n return jsonResponse({ error: \"CAPTCHA check failed. Please try again.\" }, 400);\n }\n\n const state = await mintState(config.guildId);\n const authUrl = new URL(\"https://discord.com/oauth2/authorize\");\n authUrl.searchParams.set(\"client_id\", config.clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUriFor(config, url));\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", \"identify\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"prompt\", \"consent\");\n\n return jsonResponse({ url: authUrl.toString() });\n}\n\n/**\n * OAuth callback — a single shared redirect URI for every server. The guild is\n * recovered from the state nonce (not the URL), so one registered redirect URI\n * serves unlimited servers. Loads that server's config + theme, then grants.\n */\nasync function handleCallback(\n url: URL,\n shared: SharedEnv,\n): Promise {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const oauthError = url.searchParams.get(\"error\");\n\n if (oauthError) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Discord authorization was cancelled.\"));\n }\n if (!code || !state) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Missing authorization data. Please start over.\"));\n }\n\n const consumed = await consumeState(state);\n if (!consumed.ok) {\n return htmlResponse(renderResultPage(defaultTheme, false, consumed.reason));\n }\n\n // Recover the server this nonce was minted for. Legacy nonces (pre-migration,\n // guild_id NULL) fall back to the single guild named in env.\n const guildId = consumed.guildId ?? optEnv(\"DISCORD_GUILD_ID\");\n if (!guildId) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Invalid session. Please start over.\"));\n }\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"This server is no longer active. Please contact a moderator.\"));\n }\n const theme = await resolveGuildTheme(guildId);\n const restart = `/g/${guildId}`;\n\n const accessToken = await exchangeCode(config, code, redirectUriFor(config, url));\n if (!accessToken) {\n return htmlResponse(renderResultPage(theme, false, \"Could not authenticate with Discord. Please start over.\", restart));\n }\n\n const user = await fetchDiscordUser(accessToken);\n if (!user) {\n return htmlResponse(renderResultPage(theme, false, \"Could not read your Discord profile. Please start over.\", restart));\n }\n\n const { status, body, code: errorCode } = await grantRole(config, user.id);\n\n if (status === 204) {\n await logVerification(guildId, user, true, \"role granted\");\n await maybeAlertRaid(config, theme);\n const name = user.username ? `, ${user.username}` : \"\";\n return htmlResponse(\n renderResultPage(\n theme,\n true,\n `You're all set${name}! Head back to Discord — your verified role has been granted. You can close this tab.`,\n ),\n );\n }\n\n // Record the precise failure for diagnostics (Discord error codes:\n // 10004 Unknown Guild, 10007 Unknown Member, 10011 Unknown Role,\n // 50013 Missing Permissions, 50001 Missing Access).\n await logVerification(\n guildId,\n user,\n false,\n `role grant failed: status=${status} code=${errorCode ?? \"?\"} body=${body.slice(0, 400)}`,\n );\n\n // Only a genuine \"Unknown Member\" means the user must join first.\n if (status === 404 && errorCode === 10007) {\n return htmlResponse(\n renderResultPage(theme, false, \"You're not in the server yet. Join the Discord first, then come back and verify.\", restart),\n );\n }\n // Everything else is a server-side configuration problem.\n let adminMessage = \"Couldn't assign your role. The verification bot is misconfigured — please contact a moderator.\";\n if (errorCode === 10004) {\n adminMessage = \"The verification bot isn't connected to this server yet. Please contact a moderator.\";\n } else if (errorCode === 10011) {\n adminMessage = \"The verified role no longer exists or is misconfigured. Please contact a moderator.\";\n } else if (status === 403 || errorCode === 50013 || errorCode === 50001) {\n adminMessage = \"The bot doesn't have permission to grant the role (check its permissions and role position). Please contact a moderator.\";\n }\n return htmlResponse(renderResultPage(theme, false, adminMessage, restart));\n}\n\n/** Serve a server's portal page (per-server branding + Turnstile). */\nasync function handlePortal(\n url: URL,\n guildId: string,\n shared: SharedEnv,\n): Promise {\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"This verification link isn't active.\", \"/\"),\n 404,\n );\n }\n const theme = await resolveGuildTheme(guildId);\n const ogImage = `${url.origin}/g/${guildId}/og.png`;\n return new Response(renderPortalPage(config, theme, ogImage), {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"public, max-age=3600\",\n },\n });\n}\n\n/** Serve a server's cached OG card, or redirect to its fallback image. */\nasync function handleOgImage(guildId: string): Promise {\n try {\n const { readVerifyOgImage } = await import(\"./og.ts\");\n const png = await readVerifyOgImage(guildId);\n if (png) {\n // A Uint8Array is a valid BodyInit at runtime; the cast satisfies the\n // DOM lib's narrower BufferSource typing.\n return new Response(png as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400, immutable\",\n },\n });\n }\n } catch (e) {\n console.error(\"og read failed:\", e);\n }\n // Not generated yet (the cron builds it) — fall back to the theme image.\n const theme = await resolveGuildTheme(guildId);\n return new Response(null, {\n status: 302,\n headers: { location: theme.ogFallbackImage },\n });\n}\n\n// ========================================\n// PUBLIC ENTRY POINT\n// ========================================\n\nlet migrationRan = false;\n\n/** Run the legacy single-guild migration once per isolate (cheap no-op after\n * the row exists). Keeps an upgraded deployment serving its existing server. */\nasync function ensureMigration(): Promise {\n if (migrationRan) return;\n migrationRan = true;\n try {\n await seedLegacyGuildFromEnv();\n } catch (e) {\n console.error(\"legacy guild seed failed:\", e);\n }\n}\n\n/**\n * Multi-tenant router. Per-server pages live under /g/{guildId}; the OAuth\n * callback is a single shared route that recovers its server from the state\n * nonce. Config + branding are loaded per request from SQLite.\n *\n * GET / -> redirect to the legacy server, if env-named\n * GET /g/{guildId} -> portal page\n * GET /g/{guildId}/og.png -> social card\n * POST /g/{guildId}/start -> verify Turnstile, mint state, return OAuth URL\n * GET /callback -> validate state, grant the verified role\n */\nexport async function handleVerifyRequest(req: Request): Promise {\n const url = new URL(req.url);\n\n try {\n const shared = loadSharedEnv();\n await ensureMigration();\n\n if (req.method === \"GET\" && url.pathname === \"/\") {\n const legacy = optEnv(\"DISCORD_GUILD_ID\");\n if (legacy) {\n return new Response(null, {\n status: 302,\n headers: { location: `/g/${legacy}` },\n });\n }\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"No server specified.\"),\n 404,\n );\n }\n\n // Guarded admin API (/admin/*). Returns null when not an admin path.\n const adminRes = await handleAdminRequest(req, url, shared.adminSecret);\n if (adminRes) return adminRes;\n\n // Shared OAuth callback (guild recovered from the state nonce).\n if (req.method === \"GET\" && url.pathname === \"/callback\") {\n return await handleCallback(url, shared);\n }\n\n // Per-server routes: /g/{guildId}[/start|/og.png]\n const m = url.pathname.match(/^\\/g\\/(\\d+)(\\/[a-z.]+)?$/);\n if (m) {\n const guildId = m[1];\n const sub = m[2] ?? \"\";\n if (req.method === \"GET\" && sub === \"\") {\n return await handlePortal(url, guildId, shared);\n }\n if (req.method === \"GET\" && sub === \"/og.png\") {\n return await handleOgImage(guildId);\n }\n if (req.method === \"POST\" && sub === \"/start\") {\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return jsonResponse({ error: \"Unknown or disabled server.\" }, 404);\n }\n return await handleStart(req, url, config);\n }\n }\n\n return htmlResponse(renderResultPage(defaultTheme, false, \"Page not found.\"), 404);\n } catch (e) {\n console.error(\"verify error:\", e);\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"Something went wrong on our end. Please try again later.\"),\n 500,\n );\n }\n}\n",[],[315],"9b35fe3b-5def-4e88-a6ab-8c671377e0b8","kick-bots.ts","66e6ae0c-66b7-11f1-bb21-1607ee4eb77e",95,["D",1781307331657],"// ============================================================================\n// Discord CAPTCHA Shield — kick self-identified bots (Val Town Cron)\n// ============================================================================\n//\n// A Discord Onboarding \"prejoin question\" can ask new members whether they're a\n// bot / automated. Members who answer affirmatively get a \"self-identified bot\"\n// role (set per server as `botRoleId` via the admin API); members who answer\n// \"no\" get your Unverified role, which reveals the #verify portal. This cron\n// sweeps every server that has a `botRoleId` configured and KICKS members still\n// holding that role. A short grace skips brand-new joins (mid-onboarding) so a\n// human who just mis-clicked has a moment to fix it.\n//\n// Set this file as a Cron val on a frequent-ish schedule (e.g. every 15 min:\n// `*/15 * * * *`). Requires, in addition to the shield's usual permissions:\n// - the **GUILD_MEMBERS** privileged intent (Developer Portal → Bot) so the\n// bot can list guild members, and\n// - the **Kick Members** permission in each server.\n// ============================================================================\n\nimport { listGuilds } from \"./guilds.ts\";\nimport { loadSharedEnv } from \"./config.ts\";\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\nconst PAGE = 1000; // max members Discord returns per list page\nconst GRACE_MS = 5 * 60 * 1000; // skip members who joined < 5 min ago\n\ninterface GuildMember {\n user?: { id: string };\n roles: string[];\n joined_at: string;\n}\n\n/** Discord REST with a single 429 retry honoring retry-after. */\nasync function discord(\n path: string,\n init: RequestInit,\n botToken: string,\n): Promise {\n const url = `${DISCORD_API}${path}`;\n const headers = { ...(init.headers ?? {}), authorization: `Bot ${botToken}` };\n let res = await fetch(url, { ...init, headers });\n if (res.status === 429) {\n const retry = Number(res.headers.get(\"retry-after\") ?? \"1\");\n await new Promise((r) => setTimeout(r, Math.min(retry, 10) * 1000 + 250));\n res = await fetch(url, { ...init, headers });\n }\n return res;\n}\n\n/** Page through guild members, returning the IDs holding `roleId` past grace. */\nasync function membersWithRole(\n botToken: string,\n guildId: string,\n roleId: string,\n now: number,\n): Promise {\n const ids: string[] = [];\n let after = \"0\";\n for (;;) {\n const res = await discord(\n `/guilds/${guildId}/members?limit=${PAGE}&after=${after}`,\n { method: \"GET\" },\n botToken,\n );\n if (!res.ok) {\n console.error(\n `kick-bots: list failed for ${guildId}: ${res.status} ${(await res.text()).slice(0, 200)}`,\n );\n break;\n }\n const page = await res.json() as GuildMember[];\n if (!Array.isArray(page) || page.length === 0) break;\n for (const m of page) {\n const id = m.user?.id;\n if (!id || !m.roles?.includes(roleId)) continue;\n const joined = Date.parse(m.joined_at);\n if (Number.isFinite(joined) && now - joined < GRACE_MS) continue; // grace\n ids.push(id);\n }\n const last = page[page.length - 1].user?.id;\n if (page.length < PAGE || !last || last === after) break; // last page / no progress\n after = last;\n }\n return ids;\n}\n\n/**\n * Kick every member of `guildId` holding `roleId`. Returns counts. Exported so\n * it can be invoked directly for one server; the cron loops all servers.\n */\nexport async function kickIdentifiedBots(\n botToken: string,\n guildId: string,\n roleId: string,\n now: number = Date.now(),\n): Promise<{ kicked: number; failed: number }> {\n const ids = await membersWithRole(botToken, guildId, roleId, now);\n let kicked = 0;\n let failed = 0;\n for (const id of ids) {\n const res = await discord(\n `/guilds/${guildId}/members/${id}`,\n {\n method: \"DELETE\",\n headers: {\n \"x-audit-log-reason\":\n \"Self-identified as a bot (CAPTCHA Shield onboarding trap)\",\n },\n },\n botToken,\n );\n if (res.status === 204) {\n kicked++;\n } else {\n failed++;\n console.error(\n `kick-bots: kick ${id} in ${guildId} failed: ${res.status} ${(await res.text()).slice(0, 200)}`,\n );\n }\n }\n return { kicked, failed };\n}\n\nexport default async function () {\n const { botToken } = loadSharedEnv();\n const now = Date.now();\n for (const g of await listGuilds()) {\n if (g.disabled || !g.botRoleId) continue;\n try {\n const { kicked, failed } = await kickIdentifiedBots(\n botToken,\n g.guildId,\n g.botRoleId,\n now,\n );\n if (kicked || failed) {\n console.log(`kick-bots[${g.guildId}]: kicked ${kicked}, failed ${failed}`);\n }\n } catch (e) {\n console.error(`kick-bots: error for ${g.guildId}:`, e);\n }\n }\n}\n",[],[323],"cead6647-30d1-4834-a0a2-051c9a56295d","http.ts","f3c73b40-668d-11f1-befe-1607ee4eb77e",86,["D",1781305585901],"http","// ============================================================================\n// Discord CAPTCHA Shield — HTTP entry point (Val Town HTTP trigger)\n// ============================================================================\n//\n// Set this file as the val's HTTP trigger. One deployment shields many Discord\n// servers; each server's config + branding lives in SQLite (see guilds.ts).\n// Routes (served at the val's endpoint or a mapped custom domain):\n// GET /g/{guildId} -> CAPTCHA portal page (per-server branding)\n// POST /g/{guildId}/start -> verify Turnstile, mint state, return OAuth URL\n// GET /g/{guildId}/og.png -> cached social card (generated by the cron)\n// GET /callback -> validate state, grant the verified role\n// GET / -> redirect to the legacy server, if env-named\n//\n// Register/manage servers via the guarded admin API (see admin.ts). The single\n// OAuth app uses one fixed /callback redirect URI for every server.\n// ============================================================================\n\nimport { handleVerifyRequest } from \"./mod.ts\";\n\nexport default async function (req: Request): Promise {\n return await handleVerifyRequest(req);\n}\n",[],[331],"eb6e4c94-73a4-4720-9a1c-0ebf80997d6b","guilds.ts","55e7cc48-66b3-11f1-854c-1607ee4eb77e",99,["D",1781307331719],"/**\n * Per-server config registry — the source of truth for which Discord servers\n * this deployment shields and how each is configured.\n *\n * One row per guild in the captcha_guilds table (see schema.ts). A row holds\n * the server's role + identity, optional white-label branding overrides (logo,\n * colors, copy, rules), optional per-guild Turnstile keys, alert tuning, and\n * DMZ channel IDs. Anything left null falls back to the shared env / theme.ts\n * defaults at load time (see config.ts `loadGuildConfig` and the theme step).\n *\n * Storing config in SQLite (rather than env) is what makes this multi-tenant:\n * servers can be added, edited, and removed at runtime via the guarded admin\n * API without redeploying the val.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport {\n type AboutInfo,\n type ResolvedTheme,\n resolveTheme,\n type Rule,\n} from \"./theme.ts\";\nimport { ensureSchema, GUILDS_TABLE } from \"./schema.ts\";\n\n/**\n * A server's stored configuration. Optional fields are overrides — when unset,\n * the resolver falls back to shared env (secrets, default Turnstile keys) or to\n * theme.ts (branding). `guildId` + `roleId` are the only hard requirements.\n */\nexport interface GuildConfig {\n guildId: string;\n roleId: string;\n /** Role assigned (via Discord Onboarding) to members who self-identify as a\n * bot. The kick-bots cron kicks anyone holding it. Unset = feature off. */\n botRoleId?: string;\n serverName?: string;\n disabled: boolean;\n\n // White-label branding overrides (undefined => theme.ts default).\n brandName?: string;\n logoUrl?: string;\n accentColor?: string; // hex, e.g. \"#F4A340\"\n accentColorBright?: string; // hex\n embedColor?: number; // Discord int color, e.g. 0xf4a340\n ogHeadline?: string;\n ogTagline?: string;\n ogFallbackImage?: string;\n rules?: Rule[];\n about?: AboutInfo;\n\n // Per-guild Turnstile keys (undefined => shared TURNSTILE_* env default).\n turnstileSiteKey?: string;\n turnstileSecretKey?: string;\n\n // Raid-alert config.\n alertWebhookUrl?: string;\n raidThreshold?: number;\n raidWindowMs?: number;\n alertCooldownMs?: number;\n\n // DMZ channels (blob store stays primary; these are env-style fallbacks).\n verifyChannelId?: string;\n rulesChannelId?: string;\n aboutChannelId?: string;\n honeypotChannelId?: string;\n\n // Portal addressing.\n portalUrl?: string;\n redirectUriOverride?: string;\n\n createdAt: number;\n updatedAt: number;\n}\n\n/** Shape accepted when creating/updating a server. Timestamps are stamped by\n * upsertGuild; `disabled` defaults to false. */\nexport type GuildInput =\n & Omit\n & { disabled?: boolean };\n\n// Column order for the upsert. Keep in sync with the CREATE in schema.ts.\nconst COLS = [\n \"guild_id\",\n \"role_id\",\n \"bot_role_id\",\n \"server_name\",\n \"disabled\",\n \"brand_name\",\n \"logo_url\",\n \"accent_color\",\n \"accent_color_bright\",\n \"embed_color\",\n \"og_headline\",\n \"og_tagline\",\n \"og_fallback_image\",\n \"rules_json\",\n \"about_json\",\n \"turnstile_site_key\",\n \"turnstile_secret_key\",\n \"alert_webhook_url\",\n \"raid_threshold\",\n \"raid_window_ms\",\n \"alert_cooldown_ms\",\n \"verify_channel_id\",\n \"rules_channel_id\",\n \"about_channel_id\",\n \"honeypot_channel_id\",\n \"portal_url\",\n \"redirect_uri_override\",\n \"created_at\",\n \"updated_at\",\n] as const;\n\n/** Zip a result row's values onto its column names for order-independent reads. */\nfunction rowObject(\n columns: string[],\n row: unknown[],\n): Record {\n const o: Record = {};\n columns.forEach((c, i) => (o[c] = row[i]));\n return o;\n}\n\n/** Parse a JSON column; undefined on null/blank/garbage (never throws). */\nfunction parseJson(raw: unknown): T | undefined {\n if (typeof raw !== \"string\" || !raw.trim()) return undefined;\n try {\n return JSON.parse(raw) as T;\n } catch {\n return undefined;\n }\n}\n\nconst str = (v: unknown): string | undefined =>\n v == null ? undefined : String(v);\nconst num = (v: unknown): number | undefined =>\n v == null ? undefined : Number(v);\n\n/** Map a captcha_guilds row object to a GuildConfig. */\nfunction rowToGuild(o: Record): GuildConfig {\n return {\n guildId: String(o.guild_id),\n roleId: String(o.role_id),\n botRoleId: str(o.bot_role_id),\n serverName: str(o.server_name),\n disabled: Number(o.disabled) === 1,\n brandName: str(o.brand_name),\n logoUrl: str(o.logo_url),\n accentColor: str(o.accent_color),\n accentColorBright: str(o.accent_color_bright),\n embedColor: num(o.embed_color),\n ogHeadline: str(o.og_headline),\n ogTagline: str(o.og_tagline),\n ogFallbackImage: str(o.og_fallback_image),\n rules: parseJson(o.rules_json),\n about: parseJson(o.about_json),\n turnstileSiteKey: str(o.turnstile_site_key),\n turnstileSecretKey: str(o.turnstile_secret_key),\n alertWebhookUrl: str(o.alert_webhook_url),\n raidThreshold: num(o.raid_threshold),\n raidWindowMs: num(o.raid_window_ms),\n alertCooldownMs: num(o.alert_cooldown_ms),\n verifyChannelId: str(o.verify_channel_id),\n rulesChannelId: str(o.rules_channel_id),\n aboutChannelId: str(o.about_channel_id),\n honeypotChannelId: str(o.honeypot_channel_id),\n portalUrl: str(o.portal_url),\n redirectUriOverride: str(o.redirect_uri_override),\n createdAt: Number(o.created_at),\n updatedAt: Number(o.updated_at),\n };\n}\n\n/** Fetch one server's config. Null if it was never registered. */\nexport async function getGuild(guildId: string): Promise {\n await ensureSchema();\n const res = await sqlite.execute({\n sql: `SELECT * FROM ${GUILDS_TABLE} WHERE guild_id = ?`,\n args: [guildId],\n });\n const row = res.rows?.[0];\n if (!row) return null;\n return rowToGuild(rowObject(res.columns ?? [], row as unknown[]));\n}\n\n/** All registered servers, newest first. */\nexport async function listGuilds(): Promise {\n await ensureSchema();\n const res = await sqlite.execute(\n `SELECT * FROM ${GUILDS_TABLE} ORDER BY created_at DESC`,\n );\n const columns = res.columns ?? [];\n return (res.rows ?? []).map((row) =>\n rowToGuild(rowObject(columns, row as unknown[]))\n );\n}\n\n/**\n * Create or update a server's config (keyed by guild_id). On update, every\n * field is replaced from the input except `created_at` (preserved); set or\n * clear an override by passing a value or leaving it undefined.\n */\nexport async function upsertGuild(input: GuildInput): Promise {\n await ensureSchema();\n const now = Date.now();\n const data: Record = {\n guild_id: input.guildId,\n role_id: input.roleId,\n bot_role_id: input.botRoleId ?? null,\n server_name: input.serverName ?? null,\n disabled: input.disabled ? 1 : 0,\n brand_name: input.brandName ?? null,\n logo_url: input.logoUrl ?? null,\n accent_color: input.accentColor ?? null,\n accent_color_bright: input.accentColorBright ?? null,\n embed_color: input.embedColor ?? null,\n og_headline: input.ogHeadline ?? null,\n og_tagline: input.ogTagline ?? null,\n og_fallback_image: input.ogFallbackImage ?? null,\n rules_json: input.rules ? JSON.stringify(input.rules) : null,\n about_json: input.about ? JSON.stringify(input.about) : null,\n turnstile_site_key: input.turnstileSiteKey ?? null,\n turnstile_secret_key: input.turnstileSecretKey ?? null,\n alert_webhook_url: input.alertWebhookUrl ?? null,\n raid_threshold: input.raidThreshold ?? null,\n raid_window_ms: input.raidWindowMs ?? null,\n alert_cooldown_ms: input.alertCooldownMs ?? null,\n verify_channel_id: input.verifyChannelId ?? null,\n rules_channel_id: input.rulesChannelId ?? null,\n about_channel_id: input.aboutChannelId ?? null,\n honeypot_channel_id: input.honeypotChannelId ?? null,\n portal_url: input.portalUrl ?? null,\n redirect_uri_override: input.redirectUriOverride ?? null,\n created_at: now,\n updated_at: now,\n };\n\n // Update everything except the identity and the original creation time.\n const updatable = COLS.filter((c) => c !== \"guild_id\" && c !== \"created_at\");\n const setClause = updatable.map((c) => `${c} = excluded.${c}`).join(\", \");\n\n await sqlite.execute({\n sql: `INSERT INTO ${GUILDS_TABLE} (${COLS.join(\", \")})\n VALUES (${COLS.map(() => \"?\").join(\", \")})\n ON CONFLICT(guild_id) DO UPDATE SET ${setClause}`,\n args: COLS.map((c) => data[c] as never),\n });\n}\n\n/** Toggle a server on/off without deleting its config. Disabled servers stop\n * resolving (the portal + callback treat them as unknown). */\nexport async function setGuildDisabled(\n guildId: string,\n disabled: boolean,\n): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `UPDATE ${GUILDS_TABLE} SET disabled = ?, updated_at = ?\n WHERE guild_id = ?`,\n args: [disabled ? 1 : 0, Date.now(), guildId],\n });\n}\n\n/** Permanently remove a server's config. Verification stops immediately; its\n * state/log rows age out on their own via the cron. */\nexport async function deleteGuild(guildId: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `DELETE FROM ${GUILDS_TABLE} WHERE guild_id = ?`,\n args: [guildId],\n });\n}\n\n/**\n * Resolve a server's full theme: its stored branding overrides layered over the\n * theme.ts defaults. Returns the bare defaults when the guild is unknown (or\n * undefined), so callers always get a complete ResolvedTheme.\n */\nexport async function resolveGuildTheme(\n guildId: string | undefined,\n): Promise {\n const g = guildId ? await getGuild(guildId) : null;\n if (!g) return resolveTheme();\n return resolveTheme({\n serverName: g.serverName,\n brandName: g.brandName,\n logoUrl: g.logoUrl,\n accentColor: g.accentColor,\n accentColorBright: g.accentColorBright,\n embedColor: g.embedColor,\n ogHeadline: g.ogHeadline,\n ogTagline: g.ogTagline,\n ogFallbackImage: g.ogFallbackImage,\n rules: g.rules,\n about: g.about,\n });\n}\n",[],[340],"cc177afb-267a-48a6-a22b-a37ff025340b","deno.json","f329fa10-668d-11f1-befe-1607ee4eb77e",48,["D",1781289527448],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/98f62cee78e85bfc47c62ed703777c6bc8794f1c/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}\n",[],[348],"382b0624-1d22-49c3-82b0-489e53c5f4f9","cron.ts","f2d5c9ae-668d-11f1-9138-1607ee4eb77e",84,["D",1781305585670],"interval","// ============================================================================\n// Discord CAPTCHA Shield — data cleanup + OG card refresh (Val Town Cron)\n// ============================================================================\n//\n// Set this file as the val's Cron trigger (daily is plenty). It prunes\n// ephemeral state nonces, ages out the verification audit log, and regenerates\n// each shielded server's social card. Card generation is heavy (satori + resvg\n// cold loads) and exceeds an HTTP request's wall-clock, so it lives here where\n// the cron runs to completion; the og.png route only serves the cached blob.\n// ============================================================================\n\nimport { cleanupVerifyData } from \"./mod.ts\";\nimport { refreshVerifyOgImage } from \"./og.ts\";\nimport { listGuilds, resolveGuildTheme } from \"./guilds.ts\";\nimport { seedLegacyGuildFromEnv } from \"./config.ts\";\n\nconst LOG_RETENTION_DAYS = 7;\n\nexport default async function () {\n // Keep an upgraded single-guild deployment migrated even if no HTTP request\n // has triggered the seed yet.\n await seedLegacyGuildFromEnv();\n\n const result = await cleanupVerifyData(LOG_RETENTION_DAYS);\n console.log(\n `verify cleanup: deleted ${result.states} state nonce(s), ${result.logs} log row(s) older than ${LOG_RETENTION_DAYS}d`,\n );\n\n // Refresh every registered server's card.\n const guilds = await listGuilds();\n for (const g of guilds) {\n try {\n const theme = await resolveGuildTheme(g.guildId);\n const bytes = await refreshVerifyOgImage(g.guildId, theme);\n console.log(`verify og.png[${g.guildId}] refreshed: ${bytes} bytes`);\n } catch (e) {\n console.error(`verify og refresh failed for ${g.guildId}:`, e);\n }\n }\n}\n",[],[356],"501ac023-f106-4172-9712-c1ea12bb2673","config.ts","f3ce5c4a-668d-11f1-befe-1607ee4eb77e",88,["D",1781305586007],"/**\n * Configuration loading for the Discord CAPTCHA Shield.\n *\n * Multi-tenant split:\n * - SHARED, per-deployment values come from env (Val Town Settings →\n * Environment Variables): the one Discord app's credentials, the bot token,\n * a default Turnstile keypair, and the admin secret. See loadSharedEnv().\n * - PER-SERVER values come from the captcha_guilds SQLite table (see\n * guilds.ts): role, branding, channels, alert tuning, optional Turnstile\n * override. loadGuildConfig() merges a server's row with the shared env to\n * build the VerifyConfig the request handlers consume.\n *\n * Visual branding lives in ./theme.ts (defaults) and per-server overrides in\n * the guild row. See README.md for the full variable reference.\n */\n\nimport type { VerifyConfig } from \"./mod.ts\";\nimport { type GuildConfig, getGuild, upsertGuild } from \"./guilds.ts\";\nimport { migrateLegacyLog } from \"./schema.ts\";\nimport { migrateLegacyKeys } from \"./store.ts\";\n\n/** Required env var — throws a clear error if unset. */\nexport function env(key: string): string {\n const value = Deno.env.get(key);\n if (!value) throw new Error(`Missing required environment variable: ${key}`);\n return value;\n}\n\n/** Optional env var. Guarded with has() so we never get() an unset key\n * (avoids Val Town's \"environment variable not set\" log warnings). */\nexport function optEnv(key: string): string | undefined {\n return Deno.env.has(key) ? (Deno.env.get(key) || undefined) : undefined;\n}\n\n/** Optional numeric env var; undefined if unset or not a finite number. */\nexport function optNum(key: string): number | undefined {\n const raw = optEnv(key);\n if (raw === undefined) return undefined;\n const n = Number(raw);\n return Number.isFinite(n) ? n : undefined;\n}\n\n/** Optional \"minutes\" env var, returned as milliseconds. */\nexport function optMinutesToMs(key: string): number | undefined {\n const min = optNum(key);\n return min === undefined ? undefined : min * 60 * 1000;\n}\n\n/**\n * Shared, per-deployment configuration: the single Discord app + bot all\n * shielded servers run through, a default Turnstile keypair, and the admin\n * secret. Per-server values come from the guild row, not from here.\n */\nexport interface SharedEnv {\n clientId: string;\n clientSecret: string;\n botToken: string;\n /** Default Turnstile site key. Optional — a guild may set its own. */\n turnstileSiteKey?: string;\n /** Default Turnstile secret key. Optional — a guild may set its own. */\n turnstileSecretKey?: string;\n /** Bearer secret guarding the /admin API. No admin API if unset. */\n adminSecret?: string;\n}\n\n/** Load the shared, per-deployment env. The Discord app credentials are\n * required; Turnstile keys are optional here because a guild may override. */\nexport function loadSharedEnv(): SharedEnv {\n return {\n clientId: env(\"DISCORD_CLIENT_ID\"),\n clientSecret: env(\"DISCORD_CLIENT_SECRET\"),\n botToken: env(\"DISCORD_BOT_TOKEN\"),\n turnstileSiteKey: optEnv(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: optEnv(\"TURNSTILE_SECRET_KEY\"),\n adminSecret: optEnv(\"ADMIN_SECRET\"),\n };\n}\n\n/** Merge a guild row with the shared env into a VerifyConfig. Turnstile keys\n * fall back to \"\" when neither per-guild nor shared — callers that need them\n * (the verification flow) must check; tooling that doesn't can ignore. */\nfunction mergeGuildConfig(\n guild: GuildConfig,\n shared: SharedEnv,\n): VerifyConfig {\n return {\n clientId: shared.clientId,\n clientSecret: shared.clientSecret,\n botToken: shared.botToken,\n guildId: guild.guildId,\n roleId: guild.roleId,\n turnstileSiteKey: guild.turnstileSiteKey ?? shared.turnstileSiteKey ?? \"\",\n turnstileSecretKey: guild.turnstileSecretKey ??\n shared.turnstileSecretKey ?? \"\",\n serverName: guild.serverName,\n redirectUriOverride: guild.redirectUriOverride,\n alertWebhookUrl: guild.alertWebhookUrl,\n raidThreshold: guild.raidThreshold,\n raidWindowMs: guild.raidWindowMs,\n alertCooldownMs: guild.alertCooldownMs,\n verifyChannelId: guild.verifyChannelId,\n rulesChannelId: guild.rulesChannelId,\n honeypotChannelId: guild.honeypotChannelId,\n aboutChannelId: guild.aboutChannelId,\n portalUrl: guild.portalUrl,\n };\n}\n\n/**\n * Build a VerifyConfig for one server for the verification flow. Returns null\n * when the server isn't registered or is disabled. Throws only when no\n * Turnstile keys are available at all (neither per-guild nor a shared default)\n * — a genuine misconfiguration the visitor can't get past.\n */\nexport async function loadGuildConfig(\n guildId: string,\n shared: SharedEnv = loadSharedEnv(),\n): Promise {\n const guild = await getGuild(guildId);\n if (!guild || guild.disabled) return null;\n\n const config = mergeGuildConfig(guild, shared);\n if (!config.turnstileSiteKey || !config.turnstileSecretKey) {\n throw new Error(\n `No Turnstile keys for guild ${guildId}: set them on the guild or via ` +\n `the TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY env defaults.`,\n );\n }\n return config;\n}\n\n/**\n * Build a VerifyConfig for the admin/DMZ tools (setup.ts, post-*.ts). Unlike\n * loadGuildConfig this does NOT require Turnstile keys (the tools only post\n * messages + create channels) and works on disabled servers. Returns null when\n * the server isn't registered.\n */\nexport async function loadGuildToolConfig(\n guildId: string,\n shared: SharedEnv = loadSharedEnv(),\n): Promise {\n const guild = await getGuild(guildId);\n return guild ? mergeGuildConfig(guild, shared) : null;\n}\n\n/**\n * Resolve which server a manual tool run targets. Order: explicit argument, the\n * first CLI arg, then the TOOL_GUILD_ID / DISCORD_GUILD_ID env vars. Throws a\n * clear error if none is set.\n */\nexport function toolGuildId(explicit?: string): string {\n const id = explicit ?? Deno.args?.[0] ?? optEnv(\"TOOL_GUILD_ID\") ??\n optEnv(\"DISCORD_GUILD_ID\");\n if (!id) {\n throw new Error(\n \"No server specified. Pass a guild id as the first argument, or set \" +\n \"TOOL_GUILD_ID (or DISCORD_GUILD_ID) in the environment.\",\n );\n }\n return id;\n}\n\n/**\n * One-time migration for deployments upgrading from the single-guild build.\n *\n * If DISCORD_GUILD_ID is still set in env and no matching guild row exists yet,\n * seed a captcha_guilds row from the legacy env vars and backfill `guild_id` on\n * existing state/log rows so the audit history isn't orphaned. Returns the\n * seeded guild id (or the already-present one), else null. Safe to call on\n * every boot — it no-ops once the row exists.\n */\nexport async function seedLegacyGuildFromEnv(): Promise {\n const guildId = optEnv(\"DISCORD_GUILD_ID\");\n if (!guildId) return null;\n if (await getGuild(guildId)) return guildId;\n\n const redirect = optEnv(\"VERIFY_REDIRECT_URI\");\n await upsertGuild({\n guildId,\n roleId: env(\"DISCORD_ROLE_ID\"),\n serverName: optEnv(\"VERIFY_SERVER_NAME\"),\n turnstileSiteKey: optEnv(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: optEnv(\"TURNSTILE_SECRET_KEY\"),\n alertWebhookUrl: optEnv(\"VERIFY_ALERT_WEBHOOK\"),\n raidThreshold: optNum(\"VERIFY_RAID_THRESHOLD\"),\n raidWindowMs: optMinutesToMs(\"VERIFY_RAID_WINDOW_MIN\"),\n alertCooldownMs: optMinutesToMs(\"VERIFY_ALERT_COOLDOWN_MIN\"),\n verifyChannelId: optEnv(\"DISCORD_VERIFY_CHANNEL_ID\"),\n rulesChannelId: optEnv(\"DISCORD_RULES_CHANNEL_ID\"),\n honeypotChannelId: optEnv(\"DISCORD_HONEYPOT_CHANNEL_ID\"),\n aboutChannelId: optEnv(\"DISCORD_ABOUT_CHANNEL_ID\"),\n portalUrl: optEnv(\"VERIFY_PORTAL_URL\") ??\n (redirect ? redirect.replace(/\\/callback$/, \"\") : undefined),\n redirectUriOverride: redirect,\n });\n // Copy the single-guild audit log forward into the guild-scoped table.\n await migrateLegacyLog(guildId);\n // Re-home channel/message IDs from the old un-namespaced blob keys so post\n // tools keep editing in place instead of duplicating.\n await migrateLegacyKeys(guildId);\n return guildId;\n}\n\n/**\n * LEGACY single-guild loader — builds a VerifyConfig straight from env.\n *\n * @deprecated Retained so the current HTTP/cron/setup entry points keep working\n * until they are rewired to the per-guild router. New code should resolve a\n * server with loadGuildConfig(guildId). Removed once routing lands.\n */\nexport function loadConfig(): VerifyConfig {\n const redirect = optEnv(\"VERIFY_REDIRECT_URI\");\n return {\n clientId: env(\"DISCORD_CLIENT_ID\"),\n clientSecret: env(\"DISCORD_CLIENT_SECRET\"),\n botToken: env(\"DISCORD_BOT_TOKEN\"),\n guildId: env(\"DISCORD_GUILD_ID\"),\n roleId: env(\"DISCORD_ROLE_ID\"),\n turnstileSiteKey: env(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: env(\"TURNSTILE_SECRET_KEY\"),\n serverName: optEnv(\"VERIFY_SERVER_NAME\"),\n redirectUriOverride: redirect,\n alertWebhookUrl: optEnv(\"VERIFY_ALERT_WEBHOOK\"),\n raidThreshold: optNum(\"VERIFY_RAID_THRESHOLD\"),\n raidWindowMs: optMinutesToMs(\"VERIFY_RAID_WINDOW_MIN\"),\n alertCooldownMs: optMinutesToMs(\"VERIFY_ALERT_COOLDOWN_MIN\"),\n verifyChannelId: optEnv(\"DISCORD_VERIFY_CHANNEL_ID\"),\n rulesChannelId: optEnv(\"DISCORD_RULES_CHANNEL_ID\"),\n honeypotChannelId: optEnv(\"DISCORD_HONEYPOT_CHANNEL_ID\"),\n aboutChannelId: optEnv(\"DISCORD_ABOUT_CHANNEL_ID\"),\n portalUrl: optEnv(\"VERIFY_PORTAL_URL\") ??\n (redirect ? redirect.replace(/\\/callback$/, \"\") : undefined),\n };\n}\n",[],[365],"02420742-505b-4824-a27f-62b9cdb935a3","channels.ts","f2f643a0-668d-11f1-bf75-1607ee4eb77e",81,["D",1781305585471],"/**\n * One-shot creation of the DMZ channels the shield posts into.\n *\n * Run via setup.ts. Creates a category + four text channels (about, rules,\n * verify, honeypot) with sensible @everyone permission overwrites, and stores\n * every ID in the blob store so the post tools find them automatically and the\n * run is idempotent (re-running skips channels that still exist).\n *\n * Requires the bot to have **Manage Channels** (in addition to the permissions\n * the rest of the shield needs). The shield never creates channels on its own —\n * only this explicit setup path does.\n */\n\nimport type { VerifyConfig } from \"./mod.ts\";\nimport {\n type ChannelKind,\n getCategory,\n getChannel,\n rememberCategory,\n rememberChannel,\n} from \"./store.ts\";\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\n\n// Discord permission bits (as strings, since they're 53-bit-safe here).\nconst VIEW_CHANNEL = 1 << 10; // 1024\nconst SEND_MESSAGES = 1 << 11; // 2048\nconst EMBED_LINKS = 1 << 14; // 16384\n\nconst CHANNEL_TYPE_TEXT = 0;\nconst CHANNEL_TYPE_CATEGORY = 4;\nconst OVERWRITE_ROLE = 0;\nconst OVERWRITE_MEMBER = 1;\n\ninterface ChannelSpec {\n kind: ChannelKind;\n name: string;\n topic: string;\n /** Honeypot lets @everyone post (that's the trap); the rest are read-only. */\n everyoneCanSend: boolean;\n}\n\nconst DMZ_CHANNELS: ChannelSpec[] = [\n {\n kind: \"about\",\n name: \"about\",\n topic: \"What this community is about. Read before you verify.\",\n everyoneCanSend: false,\n },\n {\n kind: \"rules\",\n name: \"rules\",\n topic: \"The server rules. By being here you agree to them.\",\n everyoneCanSend: false,\n },\n {\n kind: \"verify\",\n name: \"verify\",\n topic: \"Click Verify, pass a quick CAPTCHA, and the server unlocks.\",\n everyoneCanSend: false,\n },\n {\n kind: \"honeypot\",\n name: \"do-not-post\",\n topic: \"Do not post here. This channel is a spam trap.\",\n everyoneCanSend: true,\n },\n];\n\nconst CATEGORY_NAME = \"Welcome\";\n\nexport interface CreateResult {\n kind: ChannelKind | \"category\";\n name: string;\n status: \"created\" | \"exists\" | \"failed\";\n id?: string;\n detail?: string;\n}\n\nfunction authHeaders(config: VerifyConfig): HeadersInit {\n return {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n}\n\n/** True if a channel with this ID still exists and the bot can see it. */\nasync function channelExists(config: VerifyConfig, id: string): Promise {\n const res = await fetch(`${DISCORD_API}/channels/${id}`, {\n headers: authHeaders(config),\n });\n return res.ok;\n}\n\n/** Overwrites that make a channel visible to everyone but writable only by the\n * bot (read-only), or writable by everyone (the honeypot trap). The bot always\n * keeps an explicit allow so a read-only @everyone deny can't mute it. */\nfunction overwritesFor(config: VerifyConfig, everyoneCanSend: boolean) {\n const everyoneAllow = VIEW_CHANNEL | (everyoneCanSend ? SEND_MESSAGES : 0);\n const everyoneDeny = everyoneCanSend ? 0 : SEND_MESSAGES;\n return [\n {\n id: config.guildId, // @everyone role id == guild id\n type: OVERWRITE_ROLE,\n allow: String(everyoneAllow),\n deny: String(everyoneDeny),\n },\n {\n id: config.clientId, // a bot's user id == its application/client id\n type: OVERWRITE_MEMBER,\n allow: String(VIEW_CHANNEL | SEND_MESSAGES | EMBED_LINKS),\n deny: \"0\",\n },\n ];\n}\n\n/** Ensure the DMZ category exists; return its ID (or \"\" if creation failed). */\nasync function ensureCategory(\n config: VerifyConfig,\n results: CreateResult[],\n): Promise {\n const existing = await getCategory(config.guildId);\n if (existing && await channelExists(config, existing)) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"exists\",\n id: existing,\n });\n return existing;\n }\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify({ name: CATEGORY_NAME, type: CHANNEL_TYPE_CATEGORY }),\n });\n if (!res.ok) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n });\n return \"\";\n }\n const created = await res.json();\n await rememberCategory(config.guildId, created.id);\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"created\",\n id: created.id,\n });\n return created.id;\n}\n\n/** Create (or confirm) one DMZ channel, storing its ID in blob. */\nasync function ensureChannel(\n config: VerifyConfig,\n spec: ChannelSpec,\n parentId: string,\n): Promise {\n const existingId = await getChannel(config.guildId, spec.kind);\n if (existingId && await channelExists(config, existingId)) {\n return { kind: spec.kind, name: spec.name, status: \"exists\", id: existingId };\n }\n\n const body: Record = {\n name: spec.name,\n type: CHANNEL_TYPE_TEXT,\n topic: spec.topic,\n permission_overwrites: overwritesFor(config, spec.everyoneCanSend),\n };\n if (parentId) body.parent_id = parentId;\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify(body),\n });\n if (!res.ok) {\n return {\n kind: spec.kind,\n name: spec.name,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n const created = await res.json();\n await rememberChannel(config.guildId, spec.kind, created.id);\n return { kind: spec.kind, name: spec.name, status: \"created\", id: created.id };\n}\n\n/**\n * Create (or confirm) the DMZ category + channels, storing every ID in blob.\n * Idempotent: a channel already recorded and still present is left untouched.\n * The category is created first (channels nest under it); the channels then go\n * up concurrently — safe because each writes its own per-kind blob key.\n */\nexport async function createDmzChannels(\n config: VerifyConfig,\n): Promise {\n const results: CreateResult[] = [];\n const parentId = await ensureCategory(config, results);\n\n const channelResults = await Promise.all(\n DMZ_CHANNELS.map((spec) => ensureChannel(config, spec, parentId)),\n );\n results.push(...channelResults);\n return results;\n}\n",[],[373],"a60cd2bc-ec7b-45b8-8b76-61c65d5df5aa","admin.ts","56077a0c-66b3-11f1-854c-1607ee4eb77e",100,["D",1781307331735],"/**\n * Guarded admin API — register and manage shielded servers at runtime, so\n * onboarding a new Discord never needs a redeploy.\n *\n * All routes live under /admin/guilds and require a bearer token matching the\n * ADMIN_SECRET env var (constant-time compared). If ADMIN_SECRET is unset the\n * API is disabled entirely (404). Secrets are never echoed back in responses.\n *\n * GET /admin/guilds list all servers\n * POST /admin/guilds create a server (body: full config; 409 if it exists)\n * GET /admin/guilds/{id} fetch one server\n * PUT /admin/guilds/{id} create or replace a server\n * PATCH /admin/guilds/{id} partially update an existing server\n * DELETE /admin/guilds/{id} remove a server\n *\n * Request/response bodies use the camelCase GuildInput/GuildConfig shape (see\n * guilds.ts). Branding (logo, colors, rules, about) and per-guild Turnstile\n * keys are all settable here.\n */\n\nimport {\n deleteGuild,\n getGuild,\n type GuildConfig,\n type GuildInput,\n listGuilds,\n upsertGuild,\n} from \"./guilds.ts\";\n\n// ========================================\n// AUTH\n// ========================================\n\n/** Constant-time secret comparison via fixed-length SHA-256 digests (so neither\n * length nor content leaks through timing). */\nasync function tokenMatches(provided: string, secret: string): Promise {\n const enc = new TextEncoder();\n const [a, b] = await Promise.all([\n crypto.subtle.digest(\"SHA-256\", enc.encode(provided)),\n crypto.subtle.digest(\"SHA-256\", enc.encode(secret)),\n ]);\n const av = new Uint8Array(a);\n const bv = new Uint8Array(b);\n let diff = 0;\n for (let i = 0; i < av.length; i++) diff |= av[i] ^ bv[i];\n return diff === 0;\n}\n\n/** Extract the bearer token from the Authorization header. */\nfunction bearer(req: Request): string | null {\n const h = req.headers.get(\"authorization\") ?? \"\";\n const m = h.match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\n\n// ========================================\n// RESPONSES + VALIDATION\n// ========================================\n\n/** A validation/authorization failure carrying the HTTP status to return. */\nclass AdminError extends Error {\n constructor(readonly status: number, message: string) {\n super(message);\n }\n}\n\nconst bad = (msg: string) => new AdminError(400, msg);\n\nfunction json(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"content-type\": \"application/json\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\n/** Hide the Turnstile secret from responses; report only whether one is set. */\nfunction redact(g: GuildConfig): Record {\n const { turnstileSecretKey, ...rest } = g;\n return { ...rest, hasTurnstileSecretKey: Boolean(turnstileSecretKey) };\n}\n\nconst isSnowflake = (v: unknown): v is string =>\n typeof v === \"string\" && /^\\d+$/.test(v);\n\nfunction asString(v: unknown, key: string): string {\n if (typeof v !== \"string\") throw bad(`${key} must be a string`);\n return v;\n}\n\nfunction asBool(v: unknown, key: string): boolean {\n if (typeof v !== \"boolean\") throw bad(`${key} must be a boolean`);\n return v;\n}\n\nfunction asNumber(v: unknown, key: string): number {\n const n = typeof v === \"string\" ? Number(v) : v;\n if (typeof n !== \"number\" || !Number.isFinite(n)) {\n throw bad(`${key} must be a number`);\n }\n return n;\n}\n\nfunction asSnowflake(v: unknown, key: string): string {\n if (!isSnowflake(v)) throw bad(`${key} must be a numeric Discord ID`);\n return v;\n}\n\nfunction asColor(v: unknown, key: string): string {\n const s = asString(v, key);\n if (!/^#?[0-9a-fA-F]{3}([0-9a-fA-F]{3})?$/.test(s)) {\n throw bad(`${key} must be a hex color like #F4A340`);\n }\n return s.startsWith(\"#\") ? s : `#${s}`;\n}\n\n/** Accept a Discord int color, a numeric string, or a #RRGGBB hex string. */\nfunction asEmbedColor(v: unknown, key: string): number {\n if (typeof v === \"string\" && v.startsWith(\"#\")) {\n const n = parseInt(v.slice(1), 16);\n if (Number.isNaN(n)) throw bad(`${key} must be a hex color`);\n return n;\n }\n return asNumber(v, key);\n}\n\nfunction asRules(v: unknown, key: string): { name: string; value: string }[] {\n if (!Array.isArray(v)) throw bad(`${key} must be an array`);\n return v.map((r, i) => {\n if (!r || typeof r !== \"object\") throw bad(`${key}[${i}] must be an object`);\n const o = r as Record;\n return {\n name: asString(o.name, `${key}[${i}].name`),\n value: asString(o.value, `${key}[${i}].value`),\n };\n });\n}\n\nfunction asAbout(v: unknown, key: string) {\n if (!v || typeof v !== \"object\") throw bad(`${key} must be an object`);\n const o = v as Record;\n return {\n tagline: asString(o.tagline, `${key}.tagline`),\n description: asString(o.description, `${key}.description`),\n highlights: asRules(o.highlights ?? [], `${key}.highlights`),\n };\n}\n\n// Per-field validators. A field present in the body (even as null) is processed;\n// null clears the override. Absent fields are left untouched (PATCH-friendly).\nconst FIELDS: Record unknown> = {\n guildId: asSnowflake,\n roleId: asSnowflake,\n botRoleId: asSnowflake,\n serverName: asString,\n disabled: asBool,\n brandName: asString,\n logoUrl: asString,\n accentColor: asColor,\n accentColorBright: asColor,\n embedColor: asEmbedColor,\n ogHeadline: asString,\n ogTagline: asString,\n ogFallbackImage: asString,\n rules: asRules,\n about: asAbout,\n turnstileSiteKey: asString,\n turnstileSecretKey: asString,\n alertWebhookUrl: asString,\n raidThreshold: asNumber,\n raidWindowMs: asNumber,\n alertCooldownMs: asNumber,\n verifyChannelId: asString,\n rulesChannelId: asString,\n aboutChannelId: asString,\n honeypotChannelId: asString,\n portalUrl: asString,\n redirectUriOverride: asString,\n};\n\n/** Read + validate only the GuildInput fields present in the body. A field set\n * to null becomes undefined (clear the override). Unknown keys are ignored. */\nfunction readGuildFields(body: Record): Partial {\n const out: Record = {};\n for (const key of Object.keys(FIELDS) as (keyof GuildInput)[]) {\n if (!(key in body)) continue;\n const raw = body[key];\n out[key] = raw === null ? undefined : FIELDS[key](raw, key);\n }\n return out as Partial;\n}\n\nasync function parseBody(req: Request): Promise> {\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n throw bad(\"Body must be valid JSON.\");\n }\n if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n throw bad(\"Body must be a JSON object.\");\n }\n return body as Record;\n}\n\n/** Drop server-managed timestamps so a fetched config can seed an update. */\nfunction toInput(g: GuildConfig): GuildInput {\n const { createdAt: _c, updatedAt: _u, ...input } = g;\n return input;\n}\n\n// ========================================\n// ROUTER\n// ========================================\n\n/**\n * Handle an /admin request. `secret` is the configured ADMIN_SECRET (undefined\n * disables the API). Returns null only if the path isn't an admin path, so the\n * caller can fall through to other routes.\n */\nexport async function handleAdminRequest(\n req: Request,\n url: URL,\n secret: string | undefined,\n): Promise {\n const parts = url.pathname.split(\"/\").filter(Boolean); // e.g. [\"admin\",\"guilds\",\"123\"]\n if (parts[0] !== \"admin\") return null;\n\n // API disabled when no secret is configured — don't reveal it exists.\n if (!secret) return json({ error: \"Not found.\" }, 404);\n\n const token = bearer(req);\n if (!token || !(await tokenMatches(token, secret))) {\n return new Response(JSON.stringify({ error: \"Unauthorized.\" }), {\n status: 401,\n headers: {\n \"content-type\": \"application/json\",\n \"cache-control\": \"no-store\",\n \"www-authenticate\": \"Bearer\",\n },\n });\n }\n\n if (parts[1] !== \"guilds\") return json({ error: \"Not found.\" }, 404);\n const id = parts[2];\n\n try {\n // Collection: /admin/guilds\n if (parts.length === 2) {\n if (req.method === \"GET\") {\n return json({ guilds: (await listGuilds()).map(redact) });\n }\n if (req.method === \"POST\") {\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n if (!isSnowflake(fields.guildId)) throw bad(\"guildId is required.\");\n if (!isSnowflake(fields.roleId)) throw bad(\"roleId is required.\");\n if (await getGuild(fields.guildId)) {\n throw new AdminError(\n 409,\n `Server ${fields.guildId} already exists — use PUT or PATCH.`,\n );\n }\n await upsertGuild(fields as GuildInput);\n const saved = await getGuild(fields.guildId);\n return json(saved ? redact(saved) : {}, 201);\n }\n return json({ error: \"Method not allowed.\" }, 405);\n }\n\n // Item: /admin/guilds/{id}\n if (parts.length === 3 && id) {\n if (req.method === \"GET\") {\n const g = await getGuild(id);\n return g ? json(redact(g)) : json({ error: \"Not found.\" }, 404);\n }\n if (req.method === \"PUT\") {\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n // Path id is authoritative.\n const merged = { ...fields, guildId: id } as GuildInput;\n if (!isSnowflake(merged.roleId)) throw bad(\"roleId is required.\");\n await upsertGuild(merged);\n const saved = await getGuild(id);\n return json(saved ? redact(saved) : {});\n }\n if (req.method === \"PATCH\") {\n const existing = await getGuild(id);\n if (!existing) return json({ error: \"Not found.\" }, 404);\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n // Overlay the patch on the existing config; path id stays authoritative.\n const merged = { ...toInput(existing), ...fields, guildId: id };\n await upsertGuild(merged);\n const saved = await getGuild(id);\n return json(saved ? redact(saved) : {});\n }\n if (req.method === \"DELETE\") {\n if (!(await getGuild(id))) return json({ error: \"Not found.\" }, 404);\n await deleteGuild(id);\n return json({ deleted: id });\n }\n return json({ error: \"Method not allowed.\" }, 405);\n }\n\n return json({ error: \"Not found.\" }, 404);\n } catch (e) {\n if (e instanceof AdminError) return json({ error: e.message }, e.status);\n console.error(\"admin error:\", e);\n return json({ error: \"Internal error.\" }, 500);\n }\n}\n",[],[381],"f72f51a7-e490-4392-a097-3ed3324bd48b","README.md","f3e36766-668d-11f1-befe-1607ee4eb77e",96,["D",1781307331683],"# 🐱 Discord CAPTCHA Shield\n\nA drop-in, self-hostable **CAPTCHA + Discord OAuth verification gate** for your\nDiscord servers — built to run on [Val Town](https://val.town). New members solve\na Cloudflare Turnstile CAPTCHA, authorize with Discord, and a bot automatically\ngrants them your **Verified** role. Bots and raid scripts don't get in.\n\n**One deployment shields many servers.** Each server gets its own configuration\nand branding, stored in SQLite and managed at runtime through a guarded admin\nAPI — no redeploy to onboard a new server.\n\n> Made by **catalloc**. Remix it, re-skin it, ship it. The whole thing is one\n> small Val Town project with no build step and no servers to run.\n\n

$\"Discord$

\n\n---\n\n## What you get\n\n- **A branded portal per server** (`/g/{guildId}`) — CAPTCHA → \"Continue with\n Discord\" → done. Each server's logo, colors, name, and copy are its own.\n- **Multi-tenant from one val** — per-server config (role, branding, channels,\n alert tuning, optional Turnstile keys) lives in SQLite, keyed by guild id.\n- **A guarded admin API** (`/admin/guilds`) — add, edit, and remove servers at\n runtime with a bearer token. No redeploy.\n- **One shared Discord app + bot** — a single OAuth app with **one** registered\n `/callback` redirect URI serves unlimited servers (the guild is carried in the\n one-time state nonce, not the URL).\n- **One-time, single-use state nonces** (SQLite) bound to a passed CAPTCHA *and*\n a specific server, so a callback can't be replayed, forged, or cross-wired.\n- **Automatic role grant** via the bot using only the `identify` OAuth scope (the\n shield never sees a password and never reads message content).\n- **Per-server raid alerts** — a Discord webhook ping when an abnormal number of\n *successful* verifications land in a short window, counted and debounced per\n server (the farmed-account pattern Turnstile can't catch).\n- **A dynamic social card per server** (`/g/{guildId}/og.png`) rendered with\n satori + resvg and cached.\n- **Per-server DMZ bootstrap** (`setup.ts`) — the bot creates the `#about`,\n `#rules`, `#verify`, and `#do-not-post` channels (read-only, honeypot open)\n and posts every message into them.\n- **Editable messages** — re-running a post tool updates the existing message in\n place instead of duplicating it (channel + message IDs are kept in blob,\n namespaced per guild).\n- **An audit log** of every attempt (per server), auto-pruned after 7 days.\n\n## How it works\n\n```\nVisitor Portal (this val) Discord\n │ GET /g/{id} ───────────▶ load server config + theme (SQLite)\n │ render CAPTCHA page\n │ solve Turnstile\n │ POST /g/{id}/start ────▶ verify token w/ Cloudflare\n │ mint one-time state nonce bound to {id}\n │ ◀──────────── OAuth URL\n │ authorize (identify) ─────────────────────────────▶ consent screen\n │ GET /callback?code&state ◀──────────────────────── redirect back\n │ burn nonce → recover {id},\n │ exchange code, read user id,\n │ PUT role in {id} ─────────▶ role granted ✅\n │ ◀──────────── \"Verified\" result page\n```\n\nThe `/callback` redirect URI is the **same for every server** — the server is\nrecovered from the `state` nonce, so you register just one redirect URI in the\nDiscord app no matter how many servers you shield.\n\nRoles gate **channel access**. Lock `@everyone` down to a single `#verify`\nchannel and grant the rest to the Verified role — see\n[`HARDENING.md`](./HARDENING.md) for the full lockdown + the limits of this model\n(DMs / member-list visibility).\n\n---\n\n## Files\n\n```\nhttp.ts # HTTP trigger — the multi-tenant router (set as HTTP val)\ncron.ts # Cron trigger — daily cleanup + per-server OG card refresh\nkick-bots.ts # Cron trigger — kick members who self-identified as bots (optional)\nmod.ts # Verification logic + routing (Turnstile, OAuth, role grant, UI)\nadmin.ts # Guarded /admin API to register & manage servers at runtime\nguilds.ts # Per-server config registry (CRUD over the captcha_guilds table)\nschema.ts # Centralized SQLite schema + migrations\nconfig.ts # Env split: shared secrets + per-server config loaders\ntheme.ts # 🎨 Default branding (per-server overrides live in each server's config)\nog.ts # Per-server /og.png social card generator\nstore.ts # Blob-backed store of created channel + posted message IDs (per guild)\nchannels.ts # Creates the DMZ channels (used by setup.ts)\nsetup.ts # Bot creates the DMZ channels AND posts every message, for one server\npost-verify.ts # Bot posts (or updates) the Verify button for one server\npost-rules.ts # ... the rules embed\npost-about.ts # ... the \"About the community\" card\npost-honeypot.ts # ... the honeypot \"do not post\" trap\ndeno.json # Val Town / Deno config\n```\n\n---\n\n## Installation\n\nYou'll need ~15 minutes, one or more Discord servers you administer, and free\nCloudflare + Val Town accounts. **One Discord app + bot is shared across every\nserver you shield.**\n\n### 1. Create ONE Discord application & bot\n\n1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)\n → **New Application**.\n2. **OAuth2** tab → copy the **Client ID** and **Client Secret**.\n3. **Bot** tab → **Add Bot** → **Reset Token** and copy the **Bot Token**.\n - The default (non-privileged) intents are fine — this shield never reads\n message content or the member list.\n4. **Invite the bot to each server** you want to shield, with the `bot` scope and\n these permissions:\n\n | Permission | Why |\n | --- | --- |\n | **Manage Roles** | Grant the Verified role on a successful verification |\n | **View Channel** | See the DMZ channels it posts into |\n | **Send Messages** | Post the verify / rules / about / honeypot messages |\n | **Embed Links** | Those messages are rich embeds |\n\n Quick invite URL (replace `CLIENT_ID`) — the `permissions` integer already\n bundles all four:\n ```\n https://discord.com/oauth2/authorize?client_id=CLIENT_ID&scope=bot&permissions=268454912\n ```\n\n **Want the bot to auto-create the DMZ channels** via `setup.ts`? Also grant\n **Manage Channels** — use `permissions=268454928` instead. If you'll make the\n channels yourself, the shield never needs it.\n\n### 2. Per server: Verified role & IDs\n\nFor **each** server you'll shield:\n\n1. Create a **Verified** role. Copy its ID (enable *Developer Mode* in Discord\n → User Settings → Advanced, then right-click the role → **Copy ID**).\n2. **Important — role hierarchy:** drag the **bot's own role above the Verified\n role** in Server Settings → Roles. A bot can only assign roles *below* its\n highest role.\n3. Right-click the server → **Copy Server ID** (that's the **Guild ID**).\n4. (Recommended) Lock the server down: deny `@everyone` **View Channel**\n everywhere except a single `#verify` channel; grant the real channels to the\n Verified role. See [`HARDENING.md`](./HARDENING.md).\n\nYou'll register these IDs with the admin API in step 6.\n\n### 3. Get a Cloudflare Turnstile keypair (free)\n\n1. Cloudflare Dashboard → **Turnstile** → **Add site**.\n2. Add the domain you'll serve the portal from (your val's domain — e.g.\n `your-val.val.run`, or a custom domain). You can add `localhost` for testing.\n3. Copy the **Site Key** and **Secret Key**.\n\nBecause the Turnstile site key is **domain-bound** and every server shares the\nportal domain, **one keypair covers all your servers**. (A server on its own\ncustom domain can set its own keypair — see the admin API fields.)\n\n### 4. Create the val on Val Town\n\n1. **Remix this template** into your own Val Town project (or create a new\n project and copy these files in).\n2. Set the triggers:\n - **`http.ts`** → make it an **HTTP** val. Note its URL — that's your portal\n base (servers live at `/g/{guildId}`).\n - **`cron.ts`** → make it a **Cron** val on a daily schedule (e.g. `0 6 * * *`).\n3. Add the **shared** environment variables below (Val Town → your project →\n **Environment Variables**). Per-server values are NOT env vars — they go\n through the admin API.\n\n### 5. Configure the OAuth redirect (once)\n\nBack in the Discord Developer Portal → **OAuth2** → **Redirects**, add the single\nshared callback:\n\n```\nhttps:///callback\n```\n\nThis must match exactly, and it's the **only** redirect URI you ever need, for\nany number of servers. (A server on a custom domain that sets its own\n`redirectUriOverride` needs that URI registered too.)\n\n### 6. Register each server (admin API)\n\nWith `ADMIN_SECRET` set (step env table below), register a server by POSTing its\nconfig. Minimum is the guild id + role id; add branding and channels as you like:\n\n```bash\ncurl -X POST https:///admin/guilds \\\n -H \"authorization: Bearer $ADMIN_SECRET\" \\\n -H \"content-type: application/json\" \\\n -d '{\n \"guildId\": \"111111111111111111\",\n \"roleId\": \"222222222222222222\",\n \"serverName\": \"My Community\",\n \"accentColor\": \"#5865F2\",\n \"logoUrl\": \"https://example.com/logo.png\",\n \"portalUrl\": \"https://your-portal-domain/g/111111111111111111\",\n \"alertWebhookUrl\": \"https://discord.com/api/webhooks/...\"\n }'\n```\n\nMembers then verify at `https:///g/111111111111111111`.\nRepeat for each server. See [Managing servers](#managing-servers) for the full\nfield list and the other verbs.\n\n> Set **`portalUrl`** to the server's full portal URL (`.../g/{guildId}`) — the\n> Verify buttons and the OG card image are built from it.\n\n### 7. Set up each server's DMZ & post the messages\n\nThe **DMZ** is the handful of channels an unverified member can see. The tools\nact on **one server at a time** — pass the guild id as the first argument, or set\n`TOOL_GUILD_ID` in the environment before running. You have two ways to set it\nup — pick one.\n\n**Option A — let the bot build it.** Grant the bot **Manage Channels** (step 1),\nthen run **`setup.ts`** with the guild id. It creates a `Welcome` category with\n`#about`, `#rules`, `#verify`, and `#do-not-post` (read-only to `@everyone`,\nhoneypot left open), then posts every message into them. Channel + message IDs\nare saved to blob storage (namespaced per server), so you never copy an ID by\nhand.\n\n**Option B — use your own channels.** Create the channels yourself, set the\nchannel IDs on the server's config (admin API: `verifyChannelId`,\n`rulesChannelId`, `aboutChannelId`, `honeypotChannelId`), and run the post\nscripts individually:\n\n| Script | Posts | Config field |\n| --- | --- | --- |\n| `post-about.ts` | \"About the community\" card (+ Verify button) | `aboutChannelId` |\n| `post-rules.ts` | The rules embed | `rulesChannelId` |\n| `post-verify.ts` | The Verify button | `verifyChannelId` |\n| `post-honeypot.ts` | A \"do not post\" trap that outs spam bots | `honeypotChannelId` |\n\nEither way: **re-running a post script edits its message in place** — it doesn't\npost a duplicate. See [Updating messages](#updating-messages) below. Done — new\nmembers can now read what you're about, see the rules, and verify. 🎉\n\n---\n\n## Environment variables\n\nThese are **shared across all servers** — per-server values live in each\nserver's config row (admin API), not in env.\n\n### Required\n\n| Variable | What it is |\n| --- | --- |\n| `DISCORD_CLIENT_ID` | OAuth2 Client ID of the **one** shared app |\n| `DISCORD_CLIENT_SECRET` | OAuth2 Client Secret |\n| `DISCORD_BOT_TOKEN` | Bot token (the bot is invited to each server) |\n| `ADMIN_SECRET` | Bearer token guarding the `/admin` API. Unset = admin API disabled |\n\n### Optional (shared)\n\n| Variable | Default | What it is |\n| --- | --- | --- |\n| `TURNSTILE_SITE_KEY` | _(none)_ | Default Turnstile site key (a server may override) |\n| `TURNSTILE_SECRET_KEY` | _(none)_ | Default Turnstile secret key (a server may override) |\n| `TOOL_GUILD_ID` | _(none)_ | Which server `setup.ts` / `post-*.ts` act on (or pass as the first CLI arg) |\n\nA server needs Turnstile keys from **either** the shared defaults above **or**\nits own config. With one portal domain, set the shared defaults once and you're\ndone.\n\n### Legacy (upgrading from the single-guild build only)\n\nIf you're upgrading an old single-server deployment, leave its existing env vars\nin place: on first boot the shield **auto-seeds a server config row** from them\n(and migrates the audit log + stored channel/message IDs), so the server keeps\nworking and `/` redirects to its `/g/{guildId}`. These are read once for that\nmigration: `DISCORD_GUILD_ID`, `DISCORD_ROLE_ID`, `VERIFY_SERVER_NAME`,\n`VERIFY_REDIRECT_URI`, `VERIFY_PORTAL_URL`, `VERIFY_ALERT_WEBHOOK`,\n`VERIFY_RAID_THRESHOLD`, `VERIFY_RAID_WINDOW_MIN`, `VERIFY_ALERT_COOLDOWN_MIN`,\nand `DISCORD_*_CHANNEL_ID`. After migrating you can manage everything through the\nadmin API. New installs should ignore these entirely.\n\n---\n\n## Managing servers\n\nAll routes live under `/admin/guilds` and require `Authorization: Bearer\n$ADMIN_SECRET`. If `ADMIN_SECRET` is unset the whole API returns `404`. The\nTurnstile **secret** is never echoed back (responses report only\n`hasTurnstileSecretKey`).\n\n| Method | Route | Does |\n| --- | --- | --- |\n| `GET` | `/admin/guilds` | List all servers |\n| `POST` | `/admin/guilds` | Create a server (`409` if it already exists) |\n| `GET` | `/admin/guilds/{id}` | Fetch one server |\n| `PUT` | `/admin/guilds/{id}` | Create or replace a server |\n| `PATCH` | `/admin/guilds/{id}` | Partial update (only the fields you send) |\n| `DELETE` | `/admin/guilds/{id}` | Remove a server |\n\nIn `PATCH`, a field sent as `null` **clears** that override (falls back to the\ndefault); fields you omit are left unchanged.\n\n### Config fields\n\n`guildId` and `roleId` are required to create a server. Everything else is\noptional; branding fields left unset fall back to `theme.ts`.\n\n| Field | Type | Notes |\n| --- | --- | --- |\n| `guildId` | string | The Discord server ID (numeric) |\n| `roleId` | string | The Verified role ID to grant (numeric) |\n| `botRoleId` | string | Role given (via Onboarding) to self-identified bots; the `kick-bots.ts` cron kicks holders. Unset = off |\n| `serverName` | string | Display name on the portal + embeds |\n| `disabled` | boolean | When true, the portal/callback treat the server as unknown |\n| `brandName` | string | Branding name (defaults to `serverName`, then `theme.ts`) |\n| `logoUrl` | string | Square logo (portal card, OG card, rules thumbnail) |\n| `accentColor` / `accentColorBright` | hex string | Portal + button accents (e.g. `#5865F2`) |\n| `embedColor` | int or `#RRGGBB` | Discord embed stripe color |\n| `ogHeadline` / `ogTagline` | string | Social card copy |\n| `ogFallbackImage` | string | Shown before the cron first renders the card |\n| `rules` | `{name,value}[]` | Rules embed contents (`post-rules.ts`) |\n| `about` | `{tagline,description,highlights}` | About card contents (`post-about.ts`) |\n| `turnstileSiteKey` / `turnstileSecretKey` | string | Override the shared Turnstile keypair |\n| `alertWebhookUrl` | string | Discord webhook for this server's raid alerts |\n| `raidThreshold` | number | Successful verifies in the window that trip an alert (default 15) |\n| `raidWindowMs` | number | Raid look-back window in ms (default 5 min) |\n| `alertCooldownMs` | number | Min gap between alerts in ms (default 15 min) |\n| `verifyChannelId` / `rulesChannelId` / `aboutChannelId` / `honeypotChannelId` | string | DMZ channels for the post tools |\n| `portalUrl` | string | This server's portal base, `.../g/{guildId}` (Verify button + card image) |\n| `redirectUriOverride` | string | Override `/callback` (only for a custom per-server domain) |\n\n```bash\n# Re-skin a server later\ncurl -X PATCH https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\" \\\n -d '{\"accentColor\":\"#43B581\",\"logoUrl\":\"https://example.com/new.png\"}'\n\n# Temporarily pause verification for a server\ncurl -X PATCH https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\" -d '{\"disabled\":true}'\n\n# Remove a server\ncurl -X DELETE https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\"\n```\n\n---\n\n## Make it yours\n\n`theme.ts` holds the **default** branding for every server — edit it and the\nportal page, social card, and Discord embeds re-skin together for any server that\nhasn't set its own overrides:\n\n- **`brand.name`** — fallback community name.\n- **`brand.logoUrl`** — a square logo (swap the placeholder cat for yours).\n- **`brand.accentColor` / `accentColorBright` / `embedColor`** — the accent.\n- **`brand.ogHeadline` / `ogTagline`** — the social card copy.\n- **`rules`** — the default rules `post-rules.ts` posts.\n- **`about`** — the default tagline, description, and highlights.\n\nTo brand an **individual** server differently, set the matching fields on its\nconfig via the admin API (`accentColor`, `logoUrl`, `rules`, `about`, …) — those\noverride the `theme.ts` defaults for that server only. Secrets never live in the\nsource.\n\nTo update what's already posted: change the config (or `theme.ts`) and **re-run\nthe matching post script** for that server — it edits the live message in place.\n\n---\n\n## Updating messages\n\nWhen a post tool posts a message, it saves that message's ID to blob storage\n(`store.ts`), namespaced by guild. Run the same script again (for the same\nserver) and it **edits the existing message** instead of posting a duplicate.\n\nHow a channel is resolved, in priority order:\n\n1. an explicit ID passed in code (`postRulesMessage(config, { channelId })`),\n2. a channel the bot created via `setup.ts` (blob store, per guild),\n3. the channel ID on the server's config (`rulesChannelId`, etc.).\n\nSo the bot-created channels win automatically, and hand-wired config IDs still\nwork as a fallback. The post functions also accept `{ messageId }` to target a\nspecific message, or `{ forceNew: true }` to post a fresh one. If a stored\nmessage was deleted in Discord, the next run notices the `404` and posts a new\none.\n\n> Blob keys used: `captcha_shield_v1_{guildId}_channel_`,\n> `captcha_shield_v1_{guildId}_message_`, and\n> `captcha_shield_v1_{guildId}_category` (one ID per key, so `setup.ts` can post\n> all four messages concurrently), plus `verify_og_png_v1_{guildId}` (the cached\n> social card).\n\n---\n\n## Bot self-identification trap (optional)\n\nA honeypot that catches scripted accounts before they ever reach the portal,\nusing Discord **Onboarding** + the `kick-bots.ts` cron:\n\n1. In **Server Settings → Onboarding**, add a prejoin **question** like *\"Are you\n an automated account or a bot?\"* with two answers:\n - **\"Yes\"** → assign a **\"Self-identified Bot\"** role.\n - **\"No\"** → assign your **Unverified** role (the one that reveals `#verify`).\n2. Register that bot role on the server: set **`botRoleId`** to its ID via the\n admin API.\n3. Set **`kick-bots.ts`** as a second **Cron** val on a frequent schedule (e.g.\n every 15 minutes, `*/15 * * * *`). It sweeps every server with a `botRoleId`\n and **kicks** members still holding that role (a 5-minute grace skips\n brand-new joins so a human who mis-clicked can re-do onboarding).\n\nReal humans read the question and pick \"No\"; naive bots/self-bots that auto-pick\nthrough Onboarding select themselves into the kick list.\n\n> **Extra requirements for this feature only:** the bot needs the\n> **GUILD_MEMBERS** privileged intent (Developer Portal → Bot → *Privileged\n> Gateway Intents*) so it can list members, and the **Kick Members** permission\n> in each server (add bit `0x2` to the invite `permissions`). The rest of the\n> shield never needs either.\n\n---\n\n## Adding more servers\n\nJust register another server with the admin API (`POST /admin/guilds`) — no\nredeploy, no second val. The one deployment serves them all: each server's\nconfig + branding is keyed by guild id in SQLite, the state nonces / audit log /\nraid alerts are scoped per guild, and the single shared bot + OAuth app handles\nevery server through the one `/callback` redirect URI.\n\n---\n\n## Troubleshooting\n\nThe portal turns Discord's API errors into plain-language messages. Common ones:\n\n| Symptom | Cause / fix |\n| --- | --- |\n| Portal says \"This verification link isn't active\" | The guild id in the URL isn't registered, or the server is `disabled`. Register it via the admin API. |\n| \"You're not in the server yet\" | The user must **join** the Discord before verifying (this is an already-members gate). |\n| \"The bot doesn't have permission to grant the role\" | Move the **bot's role above** the Verified role, and ensure it has **Manage Roles**. |\n| \"The verification bot isn't connected to this server\" | Wrong `guildId` on the config, or the bot was never invited to that server. |\n| \"The verified role no longer exists\" | Wrong/deleted `roleId` on the config. |\n| CAPTCHA never lets you continue | No Turnstile keys for that server (set shared `TURNSTILE_*` env or per-server keys), or the portal domain isn't added to the Turnstile site. |\n| Admin API returns `401` | Missing/incorrect `Authorization: Bearer $ADMIN_SECRET`. A `404` on `/admin/*` means `ADMIN_SECRET` isn't set. |\n| OAuth \"redirect URI mismatch\" | The single `/callback` URL in the Developer Portal must match your portal exactly. |\n| `/g/{id}/og.png` shows the fallback image | The cron hasn't generated that server's card yet — run `cron.ts` once manually. |\n\nEvery attempt (success or failure) is recorded in the `captcha_verify_log_v2`\nSQLite table with the `guild_id` and a `detail` column carrying the exact Discord\nstatus/error code, then pruned after 7 days.\n\n---\n\n## Security notes\n\n- OAuth uses the **`identify` scope only** — the shield reads a Discord user ID\n and nothing else.\n- State nonces are **single-use, atomically burned, and bound to one server**;\n concurrent callbacks for the same nonce can't both succeed, they expire after\n 10 minutes, and a nonce minted for one server can't grant a role in another.\n- The admin API compares the bearer token in **constant time** and never echoes\n the Turnstile secret back.\n- Turnstile tokens are verified **server-side** against Cloudflare.\n- This is an **\"already-members\" gate**: it stops unverified users from accessing\n gated channels, but Discord roles don't block DMs or member-list visibility on\n their own. [`HARDENING.md`](./HARDENING.md) covers closing those gaps with\n Membership Screening / lockdown.\n\n---\n\n## License\n\nMIT — do whatever you like. A 🐱 of credit to **catalloc** is appreciated but not\nrequired.\n",[],[389],"ff1b743d-25d4-4e7a-98d3-4039a2151f87","LICENSE","f2cfba00-668d-11f1-8d84-1607ee4eb77e",34,["D",1781289527444],"MIT License\n\nCopyright (c) 2026 catalloc\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",[],[397],"d2bb5b82-cc65-43fb-9a3d-21b37a57a169","HARDENING.md","f4016d42-668d-11f1-8d84-1607ee4eb77e",98,["D",1781307331789],"# Verification Hardening — closing the gaps\n\nThe CAPTCHA shield is an **\"already-members\" gate**, and that model has known\nlimits. This doc explains exactly what it does and does not stop, and the options\nfor tightening it. None of this is required to run the shield — it works as-is —\nbut read it before relying on it as your only line of defense.\n\n## What the shield does\n\nA user joins the Discord → solves the CAPTCHA → Discord OAuth → the bot grants\nthe **Verified** role, which *unlocks* channels.\n\n- **Stops:** posting/participating in channels gated behind the Verified role\n (assuming `@everyone` is locked down).\n- **Does NOT stop (the gap):** a member who has *joined but not verified* can\n still (a) appear in / read the **member list** of any channel they can view,\n and (b) **DM** other members they share the server with.\n\nRoles gate *channel access*, not DMs or member-list visibility. Discord has **no\n\"cannot DM\" permission** — DMs are allowed between users who share a server\n(subject to each user's privacy settings + the server DM spam filter).\n\n## What actually restricts a joined user\n\nOnly two things meaningfully limit a joined-but-unverified user:\n\n1. **Membership Screening \"pending\" state** — Discord's native gate. New joins\n are \"pending\" until they complete screening; pending members **cannot DM\n other members or interact**. This is the real lever for the DM/member-list\n vector.\n2. **Hard channel-permission lockdown** — `@everyone` can view only a single\n `#verify` channel, so member-list exposure is limited to who can see that one\n channel. Still does not block DMs.\n\n## Options (with tradeoffs)\n\n### A. Server-config lockdown — do this regardless (little/no code)\n- `@everyone`: deny **View Channel** everywhere except one `#verify` channel;\n strip most perms. Verified role grants View on the real channels.\n- Stack native levers: raise **Verification Level** (Medium/High), enable\n **AutoMod** + **DM spam filter**, enable **Membership Screening** +\n **Onboarding**.\n- Limits member-list exposure; does not by itself stop DMs.\n\n### B. Membership Screening (the real DM blocker)\n- New joins are \"pending\" until they pass screening → can't DM/interact.\n- **Caveat:** native screening completion is \"agree to the rules\" (a client\n gesture a determined bot can automate), so it isn't bot-proof on its own. Pair\n it with the CAPTCHA: screening blocks DMs, the CAPTCHA blocks bots.\n\n### B½. Onboarding bot-trap + kick cron (no gateway needed)\n- In **Server Settings → Onboarding**, add a prejoin **question** — *\"Are you an\n automated account or a bot?\"* Answer **\"Yes\"** → assign a *Self-identified Bot*\n role; answer **\"No\"** → assign your *Unverified* role (which reveals `#verify`).\n- Set the bot role as the server's **`botRoleId`** (admin API), and run\n **`kick-bots.ts`** as a Cron val (e.g. `*/15 * * * *`). It sweeps every server\n with a `botRoleId` and **kicks** holders of that role (a 5-min grace skips\n brand-new joins). Humans pick \"No\"; scripts that auto-advance Onboarding pick\n themselves into the kick list.\n- Unlike option C this needs **no always-on gateway** — it's a periodic REST\n sweep. It does need the **GUILD_MEMBERS** privileged intent (to list members)\n and the **Kick Members** permission. It complements, not replaces, screening:\n it catches the naive-bot pattern, not a careful human-like bot.\n\n### C. Gateway bot for join handling (quarantine + auto-kick)\n- React to `GUILD_MEMBER_ADD`: assign a **Quarantine** role (View denied\n everywhere except `#verify`) and auto-kick if unverified within N minutes.\n- Quarantine limits member-list exposure and the auto-kick shrinks the DM\n window, but does **not** fully block DMs (mutual server).\n- **Cost:** needs a persistent gateway (WebSocket) connection. **Val Town is\n serverless and not suited to an always-on gateway.** You'd need a separate\n always-on host (a small VPS, Fly/Railway, a Cloudflare Durable Object with a\n gateway lib, or a hosted bot framework). The CAPTCHA portal can stay on Val\n Town as the unlock step. Requires the **GUILD_MEMBERS** privileged intent.\n\n### D. Combine (recommended target)\n- Membership Screening / Onboarding holds joiners pending (blocks DMs +\n member-list) and routes them to the CAPTCHA portal; the bot grants Verified\n after CAPTCHA.\n\n## A quick win available now\n\nOn successful verify, also **remove** an \"Unverified\"/\"Quarantine\" role (not just\nadd Verified): add an `unverifiedRoleId` field to the per-server config (a column\nin `captcha_guilds` + the admin API, alongside `roleId`) and a `DELETE\n/guilds/{guild}/members/{user}/roles/{roleId}` call on success in `mod.ts`. Keep\nit per-server, not an env var, so each shielded server can use its own quarantine\nrole. (Auto-*assigning* that role on join still needs a gateway bot or an\nOnboarding default role.)\n",[],[405],"b5e6c93b-b6df-44bc-8dc9-4962479dfbee","AGENTS.md","5747987a-66b3-11f1-bed8-1607ee4eb77e",94,["D",1781305585120],"You are an advanced assistant specialized in generating Val Town code.\n\n---\n\n## This project — Discord CAPTCHA Shield (multi-tenant)\n\nA CAPTCHA + Discord OAuth verification gate. **One deployment shields many\nDiscord servers**, each with its own config and branding. Read `README.md` for\nthe user-facing model; this section is the architecture map for editing the code.\n\n### Shape\n\n- **One shared Discord app + bot** for all servers, in shared env\n (`DISCORD_CLIENT_ID` / `_SECRET` / `DISCORD_BOT_TOKEN`). Per-server values\n (role, branding, channels, alert tuning, optional Turnstile keys) live in the\n `captcha_guilds` SQLite table, **not** env.\n- **Routing** (`mod.ts` `handleVerifyRequest`): per-server pages under\n `/g/{guildId}` (`` = portal, `/start`, `/og.png`); a single shared\n `/callback`; and the guarded `/admin/*` API. The OAuth `state` nonce carries\n the guild id, so **one** registered `/callback` redirect URI serves every\n server — never add per-guild redirect URIs to the OAuth routing.\n- **Config flow**: `config.ts` splits `loadSharedEnv()` (secrets) from\n `loadGuildConfig(guildId)` (merges a `captcha_guilds` row with shared env →\n `VerifyConfig`). Tools use `loadGuildToolConfig()` (no Turnstile requirement).\n `guilds.ts` is the CRUD registry; `admin.ts` is the bearer-guarded HTTP layer\n over it. Branding resolves via `theme.ts` `resolveTheme()` (defaults) layered\n with a guild's overrides (`resolveGuildTheme()`).\n- **Per-guild scoping**: state nonces + audit log carry `guild_id`; raid alerts\n namespace the guild into the alert `kind` (`raid:`); blob keys in\n `store.ts` and the OG card in `og.ts` are keyed by guild id.\n\n### Invariants — don't break these\n\n- **Schema migrations: rename, never ALTER.** Per the SQLite guidance below,\n adding a column means a **new table name** (e.g. `captcha_verify_log_v2`)\n created fresh with the column, plus a one-time data copy where it matters — see\n `schema.ts`. Do not reintroduce `ALTER TABLE`. All table DDL lives in\n `schema.ts` (`ensureSchema()`); `mod.ts`/`guilds.ts` import the table-name\n constants from there.\n- **The shared `/callback` must stay singular.** The guild comes from the state\n nonce (`consumeState` returns it), not the path.\n- **Never echo secrets.** The admin API redacts `turnstileSecretKey` and\n compares `ADMIN_SECRET` in constant time (`admin.ts`).\n- **Legacy upgrades are automatic.** `seedLegacyGuildFromEnv()` (config.ts) runs\n once to seed a `captcha_guilds` row from old single-guild env vars and migrate\n the log + blob IDs. Keep it idempotent.\n\n### Verifying changes\n\nType-check + lint are the local ceiling (the Discord/Turnstile/SQLite paths need\na Val Town deploy): `deno check --allow-import *.ts` and `deno lint *.ts`. The\n`no-import-prefix` lint warnings on `https://esm.town` / `https://esm.sh` imports\nare expected (Val Town requires those URL imports) — ignore them.\n\n---\n\n## Core Guidelines\n\n- Ask clarifying questions when requirements are ambiguous\n- Provide complete, functional solutions rather than skeleton implementations\n- Test your logic against edge cases before presenting the final solution\n- Ensure all code follows Val Town's specific platform requirements\n- If a section of code that you're working on is getting too complex, consider refactoring it into subcomponents\n\n## Code Standards\n\n- Generate code in TypeScript or TSX\n- Add appropriate TypeScript types and interfaces for all data structures\n- Prefer official SDKs or libraries than writing API calls directly\n- Ask the user to supply API or library documentation if you are at all unsure about it\n- **Never bake in secrets into the code** - always use environment variables\n- Include comments explaining complex logic (avoid commenting obvious operations)\n- Follow modern ES6+ conventions and functional programming practices if possible\n\n## Types of triggers\n\n### 1. HTTP Trigger\n\n- Create web APIs and endpoints\n- Handle HTTP requests and responses\n- Example structure:\n\n```ts\nexport default async function (req: Request) {\n return new Response(\"Hello World\");\n}\n```\n\nFiles that are HTTP triggers have http in their name like `foobar.http.tsx`\n\n### 2. Cron Triggers\n\n- Run on a schedule\n- Use cron expressions for timing\n- Example structure:\n\n```ts\nexport default async function () {\n // Scheduled task code\n}\n```\n\nFiles that are Cron triggers have cron in their name like `foobar.cron.tsx`\n\n### 3. Email Triggers\n\n- Process incoming emails\n- Handle email-based workflows\n- Example structure:\n\n```ts\nexport default async function (email: Email) {\n // Process email\n}\n```\n\nFiles that are Email triggers have email in their name like `foobar.email.tsx`\n\n\n## Val Town Standard Libraries\n\nVal Town provides several hosted services and utility functions.\n\n### Blob Storage\n\n```ts\nimport { blob } from \"https://esm.town/v/std/blob\";\nawait blob.setJSON(\"myKey\", { hello: \"world\" });\nlet blobDemo = await blob.getJSON(\"myKey\");\nlet appKeys = await blob.list(\"app_\");\nawait blob.delete(\"myKey\");\n```\n\n### SQLite\n\n```ts\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nconst TABLE_NAME = 'todo_app_users_2';\n// Create table - do this before usage and change table name when modifying schema\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL\n)`);\n// Query data\nconst result = await sqlite.execute(`SELECT * FROM ${TABLE_NAME} WHERE id = ?`, [1]);\n```\n\nNote: When changing a SQLite table's schema, change the table's name (e.g., add _2 or _3) to create a fresh table.\n\n### OpenAI\n\n```ts\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\nconst openai = new OpenAI();\nconst completion = await openai.chat.completions.create({\n messages: [\n { role: \"user\", content: \"Say hello in a creative way\" },\n ],\n model: \"gpt-4o-mini\",\n max_tokens: 30,\n});\n```\n\n### Email\n\n```ts\nimport { email } from \"https://esm.town/v/std/email\";\n// By default emails the owner of the val\nawait email({ \n subject: \"Hi\", \n text: \"Hi\", \n html: \"

Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n",[],[413],"889e60c2-2fe0-453d-85e3-b7a422bacfe0",".vtignore","55fdb2ec-66b3-11f1-a5fa-1607ee4eb77e",78,["D",1781305585119],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[],[421],"78e7f1cd-c6b6-40ee-838f-d72c1cb64a99",".gitignore","f2e6812c-668d-11f1-8d84-1607ee4eb77e",37,["D",1781289527671],"# Secrets — never commit these; set them as Val Town environment variables\n.env\n.env.local\n*.key\n*.pem\nsecrets.json\n\n# Val Town local state\n.vt/\n\n# Editor / OS\n.vscode/\n.idea/\n.DS_Store\n*.Identifier\n\n# Deno / Node\nnode_modules/\nvendor/\ndeno.lock\n",[],[429],["D",1781289528790],[],[148,63],"68756796-d50a-4ca7-8b72-6101a929af95","config","f3061fa0-668d-11f1-bf75-1607ee4eb77e",43,["D",1781289527877],"[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = false\n\tlogallrefupdates = true\n[remote \"origin\"]\n\turl = git@github.com:catalloc/discord-captcha-shield.git\n\tfetch = +refs/heads/*:refs/remotes/origin/*\n",[],[148,440],"20447dd9-ed12-4b41-b42f-c071593bc56b","HEAD","f3197b40-668d-11f1-bf75-1607ee4eb77e",46,["D",1781289527991],"ref: refs/heads/main\n",[],[148,448],"c3e87590-de2b-4560-9877-0181c1608273","COMMIT_EDITMSG","f35ace6a-668d-11f1-9138-1607ee4eb77e",54,["D",1781289527790],"Initial commit: Discord CAPTCHA Shield template\n\nA self-hostable CAPTCHA + Discord OAuth verification gate for Val Town.\nNew members solve a Cloudflare Turnstile CAPTCHA, authorize via Discord\n(identify scope), and a bot grants the Verified role.\n\nIncludes:\n- Portal + OAuth routes (http.ts), daily cleanup + OG card cron (cron.ts)\n- One-click DMZ bootstrap (setup.ts): bot creates the about/rules/verify/\n honeypot channels and posts every message\n- Per-key blob storage (store.ts) so post tools edit messages in place and\n setup posts concurrently\n- Raid alerts, audit log, dynamic social card\n- Single-file branding via theme.ts; README with full install guide\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n",[],[148,456],"261dc8ea-208c-4fed-ba41-2f4ecd45fedf","tags","f14c94d2-668d-11f1-84f3-1607ee4eb77e","f0f60360-668d-11f1-b249-1607ee4eb77e",8,["D",1781289524988],"directory",[],[148,472,464],"refs","e0a7603c-9e1f-4cde-9434-f671ca1d1d04","f2f18d4c-668d-11f1-9ab7-1607ee4eb77e","f1404754-668d-11f1-84f3-1607ee4eb77e",39,["D",1781289527732],"2f5f9232437b9da397467e05c22798a95a66f830\n",[],[148,472,481,16],"heads","ab3fc845-ea05-4515-9b9a-d0f31f7d8cb4",7,["D",1781289524906],[210],[148,472,481],"6d32b545-cba3-460c-91e9-b0f019b115ef",["D",1781289524416],[209,211],[148,472],"453f6ffb-ff9f-423f-8821-ebc5f1164704","pack","f17a4698-668d-11f1-b249-1607ee4eb77e","f105437a-668d-11f1-b68b-1607ee4eb77e",11,["D",1781289525287],[],[148,499,492],"objects","8983f4aa-0184-4fd3-9fad-6c6ff4512348","info","f207f330-668d-11f1-bfda-1607ee4eb77e",20,["D",1781289526212],[],[148,499,501],"43275c82-b244-46c3-be78-60065082bb32","e5","f16dd0f2-668d-11f1-b68b-1607ee4eb77e",10,["D",1781289525204],[],[148,499,508],"1d3b9d3a-41e1-4c49-9369-071a1b811284","d8","f217cca6-668d-11f1-bfda-1607ee4eb77e",21,["D",1781289526319],[],[148,499,515],"49a59a5c-1dc0-4fc2-aa35-edcfc4372191","d4","f235eb96-668d-11f1-b249-1607ee4eb77e",23,["D",1781289526509],[],[148,499,522],"ff7bb85e-ce20-4a25-bf35-d737a027b36d","d1","f1d7748a-668d-11f1-b7b6-1607ee4eb77e",17,["D",1781289525896],[],[148,499,529],"04a1e9da-0fcc-4227-ac5d-bd269e7e96f1","bd","f27d7e48-668d-11f1-84f3-1607ee4eb77e",28,["D",1781289526986],[],[148,499,536],"17c8169b-0642-4df8-a28d-8fed84e55170","a5","f1a9e7ea-668d-11f1-b249-1607ee4eb77e",14,["D",1781289525586],[],[148,499,543],"8c8b06ee-889a-4a8d-b02c-8ad2b34da028","99","f1580db2-668d-11f1-b68b-1607ee4eb77e",9,["D",1781289525063],[],[148,499,550],"46196381-57bf-4c1e-88c8-0f72133e2951","94","f1c6b00a-668d-11f1-b7b6-1607ee4eb77e",16,["D",1781289525788],[],[148,499,557],"1c295602-7354-4267-9958-129b8f1d5979","7e","f27255e0-668d-11f1-84f3-1607ee4eb77e",27,["D",1781289526897],[],[148,499,564],"406788c5-95be-4480-bb54-bf2957f628e4","73","f25e8cc2-668d-11f1-84f3-1607ee4eb77e",26,["D",1781289526784],[],[148,499,571],"cdb1f050-5cbb-49e5-9eed-99ffcf8cb173","6f","f289ca0e-668d-11f1-84f3-1607ee4eb77e",29,["D",1781289527068],[],[148,499,578],"868a8827-1df3-4934-8464-2055623e56af","4f1dc9a93d9d0c02c0b957ed86cacd50063dc9","f2fb6ccc-668d-11f1-9084-1607ee4eb77e","f1b92ce6-668d-11f1-b7b6-1607ee4eb77e",41,["D",1781289527796],"x\u0001�T�n�@\u0014��_1r{�U�(�T\u0002EU\n��@\u00054RO��\u000f��z��I��۵IPr��oޛ73�Z�5ο��pv��\u0013�\"��\u000e�P�} \u000b�(�!�3\u0018ɺ0�DR\t�\b\u0005g�vK6��\u0013��~��LD��HEHny��\u001c�m�D7\u0015YY`<꡸\u0013Z��=\u0018��\u0015i'��P\n�(h�L3Lw�T�>n��r��rry�#�\u0018��\u0005�\r\u000b6�+��\u001asbqn��Ŗ=��<�{�㼣��p\u0007\u001e\u0001}R\u0013#Y�ux\u000e��|�:*=��\u001dᖵ�<\r��-��^!��*S�S��\u0015O��ٹ\\?\u001c�\u0015\u0001ؖF�/�\u0012��.�it\u0011d��I��\b�j�u��E8�Wja�I��#��q�c(�Wa\"*�w<��\u0013�ꐽak�|E\u001cڿ�E��h\u001eK2�^hs�\u001a嘶x\u0014�D\u001f�c=�v�t�\u0001��L�m\u0012��܇;�\u001bV\u0001��E��oA��+-�\t��i�� }��#��w\u001f��C\u001fo�+/[�c�5V��<��QԮ�:3��\u0003%�v\"",[],[148,499,593,585],"6d","b2ce834d-8174-4e01-b284-9970a417a70a",15,["D",1781289525691],[194],[148,499,593],"3da80ccb-2eb8-43be-93e8-05fbe77bb83b","5d","f251ea9e-668d-11f1-b7b6-1607ee4eb77e",25,["D",1781289526701],[],[148,499,600],"30addad7-63dc-4b0b-ab0d-43c95775d7b9","5a","f1f6008a-668d-11f1-b7b6-1607ee4eb77e",19,["D",1781289526097],[],[148,499,607],"55902c88-4ded-4836-8000-d142b6ebb3d7","50","f2455dec-668d-11f1-b249-1607ee4eb77e",24,["D",1781289526617],[],[148,499,614],"b9392db2-82b3-4226-8723-9481ed9b52c0","39","f1901dec-668d-11f1-9228-1607ee4eb77e",12,["D",1781289525415],[],[148,499,621],"9b410a66-394b-47d9-802a-3e71d0fee8c7","38","f1e4f9ca-668d-11f1-b7b6-1607ee4eb77e",18,["D",1781289525987],[],[148,499,628],"10f4166b-3911-4750-8857-33df75b0a4e7","2f","f2263796-668d-11f1-bfda-1607ee4eb77e",22,["D",1781289526408],[],[148,499,635],"a6028611-b62c-44ed-b2e4-420d0008ba78","1e","f19abfc2-668d-11f1-9228-1607ee4eb77e",13,["D",1781289525501],[],[148,499,642],"ff63dd59-7707-44b7-9589-a093017a0efa",3,["D",1781289524514],[186,187,188,189,190,191,192,193,195,196,197,198,199,200,201,202,203,204,205,206,207],[148,499],"8691a00c-5a32-4490-9fc8-721850764554","f315167c-668d-11f1-9ab7-1607ee4eb77e","f11f0f8a-668d-11f1-b68b-1607ee4eb77e",45,["D",1781289527943],"0000000000000000000000000000000000000000 2f5f9232437b9da397467e05c22798a95a66f830 catalloc <80437062+catalloc@users.noreply.github.com> 1781289324 -0400\tcommit (initial): Initial commit: Discord CAPTCHA Shield template\n",[],[148,661,448],"logs","9254b389-b3e2-4813-8e37-176c5b1c144c","f30f250a-668d-11f1-9084-1607ee4eb77e","f2af6c96-668d-11f1-84f3-1607ee4eb77e",44,["D",1781289527922],[],[148,661,472,481,16],"99e8e0d7-467d-4ac1-a391-4a07c953caae","f29c48fa-668d-11f1-84f3-1607ee4eb77e",31,["D",1781289527310],[183],[148,661,472,481],"07ce5f94-6b8a-4fe2-8a0c-d8c3025814d8",30,["D",1781289527188],[182],[148,661,472],"b811d182-cf8b-44ac-bd93-1a21c79a6883",5,["D",1781289524687],[181,184],[148,661],"a7881e2c-ee16-48a8-be0b-696bd8787f0f","exclude","f3005e94-668d-11f1-9ab7-1607ee4eb77e","f1111d4e-668d-11f1-b68b-1607ee4eb77e",42,["D",1781289527827],"# git ls-files --others --exclude-from=.git/info/exclude\n# Lines that start with '#' are comments.\n# For a project mostly in C, the following would be a good set of\n# exclude patterns (uncomment them if you want to use them):\n# *.[oa]\n# *~\n",[],[148,501,686],"ee16ca23-3c5c-4bf2-9f08-20764efed1e2",4,["D",1781289524598],[179],[148,501],"d96c57c0-a5b6-4a24-b3e7-85206eed6708","update.sample","f399e3c0-668d-11f1-b0f1-1607ee4eb77e","f12e6dfe-668d-11f1-84f3-1607ee4eb77e",60,["D",1781289528092],"#!/bin/sh\n#\n# An example hook script to block unannotated tags from entering.\n# Called by \"git receive-pack\" with arguments: refname sha1-old sha1-new\n#\n# To enable this hook, rename this file to \"update\".\n#\n# Config\n# ------\n# hooks.allowunannotated\n# This boolean sets whether unannotated tags will be allowed into the\n# repository. By default they won't be.\n# hooks.allowdeletetag\n# This boolean sets whether deleting tags will be allowed in the\n# repository. By default they won't be.\n# hooks.allowmodifytag\n# This boolean sets whether a tag may be modified after creation. By default\n# it won't be.\n# hooks.allowdeletebranch\n# This boolean sets whether deleting branches will be allowed in the\n# repository. By default they won't be.\n# hooks.denycreatebranch\n# This boolean sets whether remotely creating branches will be denied\n# in the repository. By default this is allowed.\n#\n\n# --- Command line\nrefname=\"$1\"\noldrev=\"$2\"\nnewrev=\"$3\"\n\n# --- Safety check\nif [ -z \"$GIT_DIR\" ]; then\n\techo \"Don't run this script from the command line.\" >&2\n\techo \" (if you want, you could supply GIT_DIR then run\" >&2\n\techo \" $0 )\" >&2\n\texit 1\nfi\n\nif [ -z \"$refname\" -o -z \"$oldrev\" -o -z \"$newrev\" ]; then\n\techo \"usage: $0 \" >&2\n\texit 1\nfi\n\n# --- Config\nallowunannotated=$(git config --type=bool hooks.allowunannotated)\nallowdeletebranch=$(git config --type=bool hooks.allowdeletebranch)\ndenycreatebranch=$(git config --type=bool hooks.denycreatebranch)\nallowdeletetag=$(git config --type=bool hooks.allowdeletetag)\nallowmodifytag=$(git config --type=bool hooks.allowmodifytag)\n\n# check for no description\nprojectdesc=$(sed -e '1q' \"$GIT_DIR/description\")\ncase \"$projectdesc\" in\n\"Unnamed repository\"* | \"\")\n\techo \"*** Project description file hasn't been set\" >&2\n\texit 1\n\t;;\nesac\n\n# --- Check types\n# if $newrev is 0000...0000, it's a commit to delete a ref.\nzero=$(git hash-object --stdin &2\n\t\t\techo \"*** Use 'git tag [ -a | -s ]' for tags you want to propagate.\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/tags/*,delete)\n\t\t# delete tag\n\t\tif [ \"$allowdeletetag\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a tag is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/tags/*,tag)\n\t\t# annotated tag\n\t\tif [ \"$allowmodifytag\" != \"true\" ] && git rev-parse $refname > /dev/null 2>&1\n\t\tthen\n\t\t\techo \"*** Tag '$refname' already exists.\" >&2\n\t\t\techo \"*** Modifying a tag is not allowed in this repository.\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/heads/*,commit)\n\t\t# branch\n\t\tif [ \"$oldrev\" = \"$zero\" -a \"$denycreatebranch\" = \"true\" ]; then\n\t\t\techo \"*** Creating a branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/heads/*,delete)\n\t\t# delete branch\n\t\tif [ \"$allowdeletebranch\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/remotes/*,commit)\n\t\t# tracking branch\n\t\t;;\n\trefs/remotes/*,delete)\n\t\t# delete tracking branch\n\t\tif [ \"$allowdeletebranch\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a tracking branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\t*)\n\t\t# Anything else (is there anything else?)\n\t\techo \"*** Update hook: unknown type of update to ref $refname of type $newrev_type\" >&2\n\t\texit 1\n\t\t;;\nesac\n\n# --- Finished\nexit 0\n",[],[148,708,700],"hooks","1f5d1f00-c259-43a9-b524-d97154f18bbe","sendemail-validate.sample","f37caf26-668d-11f1-b477-1607ee4eb77e",58,["D",1781289528493],"#!/bin/sh\n\n# An example hook script to validate a patch (and/or patch series) before\n# sending it via email.\n#\n# The hook should exit with non-zero status after issuing an appropriate\n# message if it wants to prevent the email(s) from being sent.\n#\n# To enable this hook, rename this file to \"sendemail-validate\".\n#\n# By default, it will only check that the patch(es) can be applied on top of\n# the default upstream branch without conflicts in a secondary worktree. After\n# validation (successful or not) of the last patch of a series, the worktree\n# will be deleted.\n#\n# The following config variables can be set to change the default remote and\n# remote ref that are used to apply the patches against:\n#\n# sendemail.validateRemote (default: origin)\n# sendemail.validateRemoteRef (default: HEAD)\n#\n# Replace the TODO placeholders with appropriate checks according to your\n# needs.\n\nvalidate_cover_letter () {\n\tfile=\"$1\"\n\t# TODO: Replace with appropriate checks (e.g. spell checking).\n\ttrue\n}\n\nvalidate_patch () {\n\tfile=\"$1\"\n\t# Ensure that the patch applies without conflicts.\n\tgit am -3 \"$file\" || return\n\t# TODO: Replace with appropriate checks for this patch\n\t# (e.g. checkpatch.pl).\n\ttrue\n}\n\nvalidate_series () {\n\t# TODO: Replace with appropriate checks for the whole series\n\t# (e.g. quick build, coding style checks, etc.).\n\ttrue\n}\n\n# main -------------------------------------------------------------------------\n\nif test \"$GIT_SENDEMAIL_FILE_COUNTER\" = 1\nthen\n\tremote=$(git config --default origin --get sendemail.validateRemote) &&\n\tref=$(git config --default HEAD --get sendemail.validateRemoteRef) &&\n\tworktree=$(mktemp --tmpdir -d sendemail-validate.XXXXXXX) &&\n\tgit worktree add -fd --checkout \"$worktree\" \"refs/remotes/$remote/$ref\" &&\n\tgit config --replace-all sendemail.validateWorktree \"$worktree\"\nelse\n\tworktree=$(git config --get sendemail.validateWorktree)\nfi || {\n\techo \"sendemail-validate: error: failed to prepare worktree\" >&2\n\texit 1\n}\n\nunset GIT_DIR GIT_WORK_TREE\ncd \"$worktree\" &&\n\nif grep -q \"^diff --git \" \"$1\"\nthen\n\tvalidate_patch \"$1\"\nelse\n\tvalidate_cover_letter \"$1\"\nfi &&\n\nif test \"$GIT_SENDEMAIL_FILE_COUNTER\" = \"$GIT_SENDEMAIL_FILE_TOTAL\"\nthen\n\tgit config --unset-all sendemail.validateWorktree &&\n\ttrap 'git worktree remove -ff \"$worktree\"' EXIT &&\n\tvalidate_series\nfi\n",[],[148,708,710],"e42e3f66-772a-40b7-bfc5-f098b4929ef5","push-to-checkout.sample","f34d6e64-668d-11f1-847c-1607ee4eb77e",52,["D",1781289528314],"#!/bin/sh\n\n# An example hook script to update a checked-out tree on a git push.\n#\n# This hook is invoked by git-receive-pack(1) when it reacts to git\n# push and updates reference(s) in its repository, and when the push\n# tries to update the branch that is currently checked out and the\n# receive.denyCurrentBranch configuration variable is set to\n# updateInstead.\n#\n# By default, such a push is refused if the working tree and the index\n# of the remote repository has any difference from the currently\n# checked out commit; when both the working tree and the index match\n# the current commit, they are updated to match the newly pushed tip\n# of the branch. This hook is to be used to override the default\n# behaviour; however the code below reimplements the default behaviour\n# as a starting point for convenient modification.\n#\n# The hook receives the commit with which the tip of the current\n# branch is going to be updated:\ncommit=$1\n\n# It can exit with a non-zero status to refuse the push (when it does\n# so, it must not modify the index or the working tree).\ndie () {\n\techo >&2 \"$*\"\n\texit 1\n}\n\n# Or it can make any necessary changes to the working tree and to the\n# index to bring them to the desired state when the tip of the current\n# branch is updated to the new commit, and exit with a zero status.\n#\n# For example, the hook can simply run git read-tree -u -m HEAD \"$1\"\n# in order to emulate git fetch that is run in the reverse direction\n# with git push, as the two-tree form of git read-tree -u -m is\n# essentially the same as git switch or git checkout that switches\n# branches while keeping the local changes in the working tree that do\n# not interfere with the difference between the branches.\n\n# The below is a more-or-less exact translation to shell of the C code\n# for the default behaviour for git's push-to-checkout hook defined in\n# the push_to_deploy() function in builtin/receive-pack.c.\n#\n# Note that the hook will be executed from the repository directory,\n# not from the working tree, so if you want to perform operations on\n# the working tree, you will have to adapt your code accordingly, e.g.\n# by adding \"cd ..\" or using relative paths.\n\nif ! git update-index -q --ignore-submodules --refresh\nthen\n\tdie \"Up-to-date check failed\"\nfi\n\nif ! git diff-files --quiet --ignore-submodules --\nthen\n\tdie \"Working directory has unstaged changes\"\nfi\n\n# This is a rough translation of:\n#\n# head_has_history() ? \"HEAD\" : EMPTY_TREE_SHA1_HEX\nif git cat-file -e HEAD 2>/dev/null\nthen\n\thead=HEAD\nelse\n\thead=$(git hash-object -t tree --stdin \\).*$/Signed-off-by: \\1/p')\n# git interpret-trailers --in-place --trailer \"$SOB\" \"$COMMIT_MSG_FILE\"\n# if test -z \"$COMMIT_SOURCE\"\n# then\n# /usr/bin/perl -i.bak -pe 'print \"\\n\" if !$first_line++' \"$COMMIT_MSG_FILE\"\n# fi\n",[],[148,708,726],"2d97cfac-0e1b-4a9f-9e1b-d0b3df5e2402","pre-receive.sample","f331c038-668d-11f1-9ab7-1607ee4eb77e",49,["D",1781289528116],"#!/bin/sh\n#\n# An example hook script to make use of push options.\n# The example simply echoes all push options that start with 'echoback='\n# and rejects all pushes when the \"reject\" push option is used.\n#\n# To enable this hook, rename this file to \"pre-receive\".\n\nif test -n \"$GIT_PUSH_OPTION_COUNT\"\nthen\n\ti=0\n\twhile test \"$i\" -lt \"$GIT_PUSH_OPTION_COUNT\"\n\tdo\n\t\teval \"value=\\$GIT_PUSH_OPTION_$i\"\n\t\tcase \"$value\" in\n\t\techoback=*)\n\t\t\techo \"echo from the pre-receive-hook: ${value#*=}\" >&2\n\t\t\t;;\n\t\treject)\n\t\t\texit 1\n\t\tesac\n\t\ti=$((i + 1))\n\tdone\nfi\n",[],[148,708,734],"6495c585-f0f3-4f01-ad9a-c13f24cc118a","pre-rebase.sample","f370f87a-668d-11f1-847c-1607ee4eb77e",56,["D",1781289528506],"#!/bin/sh\n#\n# Copyright (c) 2006, 2008 Junio C Hamano\n#\n# The \"pre-rebase\" hook is run just before \"git rebase\" starts doing\n# its job, and can prevent the command from running by exiting with\n# non-zero status.\n#\n# The hook is called with the following parameters:\n#\n# $1 -- the upstream the series was forked from.\n# $2 -- the branch being rebased (or empty when rebasing the current branch).\n#\n# This sample shows how to prevent topic branches that are already\n# merged to 'next' branch from getting rebased, because allowing it\n# would result in rebasing already published history.\n\npublish=next\nbasebranch=\"$1\"\nif test \"$#\" = 2\nthen\n\ttopic=\"refs/heads/$2\"\nelse\n\ttopic=`git symbolic-ref HEAD` ||\n\texit 0 ;# we do not interrupt rebasing detached HEAD\nfi\n\ncase \"$topic\" in\nrefs/heads/??/*)\n\t;;\n*)\n\texit 0 ;# we do not interrupt others.\n\t;;\nesac\n\n# Now we are dealing with a topic branch being rebased\n# on top of master. Is it OK to rebase it?\n\n# Does the topic really exist?\ngit show-ref -q \"$topic\" || {\n\techo >&2 \"No such branch $topic\"\n\texit 1\n}\n\n# Is topic fully merged to master?\nnot_in_master=`git rev-list --pretty=oneline ^master \"$topic\"`\nif test -z \"$not_in_master\"\nthen\n\techo >&2 \"$topic is fully merged to master; better remove it.\"\n\texit 1 ;# we could allow it, but there is no point.\nfi\n\n# Is topic ever merged to next? If so you should not be rebasing it.\nonly_next_1=`git rev-list ^master \"^$topic\" ${publish} | sort`\nonly_next_2=`git rev-list ^master ${publish} | sort`\nif test \"$only_next_1\" = \"$only_next_2\"\nthen\n\tnot_in_topic=`git rev-list \"^$topic\" master`\n\tif test -z \"$not_in_topic\"\n\tthen\n\t\techo >&2 \"$topic is already up to date with master\"\n\t\texit 1 ;# we could allow it, but there is no point.\n\telse\n\t\texit 0\n\tfi\nelse\n\tnot_in_next=`git rev-list --pretty=oneline ^${publish} \"$topic\"`\n\t/usr/bin/perl -e '\n\t\tmy $topic = $ARGV[0];\n\t\tmy $msg = \"* $topic has commits already merged to public branch:\\n\";\n\t\tmy (%not_in_next) = map {\n\t\t\t/^([0-9a-f]+) /;\n\t\t\t($1 => 1);\n\t\t} split(/\\n/, $ARGV[1]);\n\t\tfor my $elem (map {\n\t\t\t\t/^([0-9a-f]+) (.*)$/;\n\t\t\t\t[$1 => $2];\n\t\t\t} split(/\\n/, $ARGV[2])) {\n\t\t\tif (!exists $not_in_next{$elem->[0]}) {\n\t\t\t\tif ($msg) {\n\t\t\t\t\tprint STDERR $msg;\n\t\t\t\t\tundef $msg;\n\t\t\t\t}\n\t\t\t\tprint STDERR \" $elem->[1]\\n\";\n\t\t\t}\n\t\t}\n\t' \"$topic\" \"$not_in_next\" \"$not_in_master\"\n\texit 1\nfi\n\n<<\\DOC_END\n\nThis sample hook safeguards topic branches that have been\npublished from being rewound.\n\nThe workflow assumed here is:\n\n * Once a topic branch forks from \"master\", \"master\" is never\n merged into it again (either directly or indirectly).\n\n * Once a topic branch is fully cooked and merged into \"master\",\n it is deleted. If you need to build on top of it to correct\n earlier mistakes, a new topic branch is created by forking at\n the tip of the \"master\". This is not strictly necessary, but\n it makes it easier to keep your history simple.\n\n * Whenever you need to test or publish your changes to topic\n branches, merge them into \"next\" branch.\n\nThe script, being an example, hardcodes the publish branch name\nto be \"next\", but it is trivial to make it configurable via\n$GIT_DIR/config mechanism.\n\nWith this workflow, you would want to know:\n\n(1) ... if a topic branch has ever been merged to \"next\". Young\n topic branches can have stupid mistakes you would rather\n clean up before publishing, and things that have not been\n merged into other branches can be easily rebased without\n affecting other people. But once it is published, you would\n not want to rewind it.\n\n(2) ... if a topic branch has been fully merged to \"master\".\n Then you can delete it. More importantly, you should not\n build on top of it -- other people may already want to\n change things related to the topic as patches against your\n \"master\", so if you need further changes, it is better to\n fork the topic (perhaps with the same name) afresh from the\n tip of \"master\".\n\nLet's look at this example:\n\n\t\t o---o---o---o---o---o---o---o---o---o \"next\"\n\t\t / / / /\n\t\t / a---a---b A / /\n\t\t/ / / /\n\t / / c---c---c---c B /\n\t / / / \\ /\n\t / / / b---b C \\ /\n\t / / / / \\ /\n ---o---o---o---o---o---o---o---o---o---o---o \"master\"\n\n\nA, B and C are topic branches.\n\n * A has one fix since it was merged up to \"next\".\n\n * B has finished. It has been fully merged up to \"master\" and \"next\",\n and is ready to be deleted.\n\n * C has not merged to \"next\" at all.\n\nWe would want to allow C to be rebased, refuse A, and encourage\nB to be deleted.\n\nTo compute (1):\n\n\tgit rev-list ^master ^topic next\n\tgit rev-list ^master next\n\n\tif these match, topic has not merged in next at all.\n\nTo compute (2):\n\n\tgit rev-list master..topic\n\n\tif this is empty, it is fully merged to \"master\".\n\nDOC_END\n",[],[148,708,742],"33530d0d-d5c2-4cb8-ae11-d26f4df79d58","pre-push.sample","f377d88e-668d-11f1-9138-1607ee4eb77e",57,["D",1781289528611],"#!/bin/sh\n\n# An example hook script to verify what is about to be pushed. Called by \"git\n# push\" after it has checked the remote status, but before anything has been\n# pushed. If this script exits with a non-zero status nothing will be pushed.\n#\n# This hook is called with the following parameters:\n#\n# $1 -- Name of the remote to which the push is being done\n# $2 -- URL to which the push is being done\n#\n# If pushing without using a named remote those arguments will be equal.\n#\n# Information about the commits which are being pushed is supplied as lines to\n# the standard input in the form:\n#\n# \n#\n# This sample shows how to prevent push of commits where the log message starts\n# with \"WIP\" (work in progress).\n\nremote=\"$1\"\nurl=\"$2\"\n\nzero=$(git hash-object --stdin &2 \"Found WIP commit in $local_ref, not pushing\"\n\t\t\texit 1\n\t\tfi\n\tfi\ndone\n\nexit 0\n",[],[148,708,750],"50e3eebe-9912-4421-831b-75a13a9f21d6","pre-merge-commit.sample","f382276c-668d-11f1-befe-1607ee4eb77e",59,["D",1781289528646],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed.\n# Called by \"git merge\" with no arguments. The hook should\n# exit with non-zero status after issuing an appropriate message to\n# stderr if it wants to stop the merge commit.\n#\n# To enable this hook, rename this file to \"pre-merge-commit\".\n\n. git-sh-setup\ntest -x \"$GIT_DIR/hooks/pre-commit\" &&\n exec \"$GIT_DIR/hooks/pre-commit\"\n:\n",[],[148,708,758],"ac406464-d0b5-45b3-bf65-8dfac2837566","pre-commit.sample","f355039a-668d-11f1-b477-1607ee4eb77e",53,["D",1781289528300],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed.\n# Called by \"git commit\" with no arguments. The hook should\n# exit with non-zero status after issuing an appropriate message if\n# it wants to stop the commit.\n#\n# To enable this hook, rename this file to \"pre-commit\".\n\nif git rev-parse --verify HEAD >/dev/null 2>&1\nthen\n\tagainst=HEAD\nelse\n\t# Initial commit: diff against an empty tree object\n\tagainst=$(git hash-object -t tree /dev/null)\nfi\n\n# If you want to allow non-ASCII filenames set this variable to true.\nallownonascii=$(git config --type=bool hooks.allownonascii)\n\n# Redirect output to stderr.\nexec 1>&2\n\n# Cross platform projects tend to avoid non-ASCII filenames; prevent\n# them from being added to the repository. We exploit the fact that the\n# printable range starts at the space character and ends with tilde.\nif [ \"$allownonascii\" != \"true\" ] &&\n\t# Note that the use of brackets around a tr range is ok here, (it's\n\t# even required, for portability to Solaris 10's /usr/bin/tr), since\n\t# the square bracket bytes happen to fall in the designated range.\n\ttest $(git diff-index --cached --name-only --diff-filter=A -z $against |\n\t LC_ALL=C tr -d '[ -~]\\0' | wc -c) != 0\nthen\n\tcat <<\\EOF\nError: Attempt to add a non-ASCII file name.\n\nThis can cause problems if you want to work with people on other platforms.\n\nTo be portable it is advisable to rename the file.\n\nIf you know what you are doing you can disable this check using:\n\n git config hooks.allownonascii true\nEOF\n\texit 1\nfi\n\n# If there are whitespace errors, print the offending file names and fail.\nexec git diff-index --check --cached $against --\n",[],[148,708,766],"ae7b06d4-e829-462d-9f5a-17531f7f29d3","pre-applypatch.sample","f364ccbc-668d-11f1-9ab7-1607ee4eb77e",55,["D",1781289528399],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed\n# by applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit.\n#\n# To enable this hook, rename this file to \"pre-applypatch\".\n\n. git-sh-setup\nprecommit=\"$(git rev-parse --git-path hooks/pre-commit)\"\ntest -x \"$precommit\" && exec \"$precommit\" ${1+\"$@\"}\n:\n",[],[148,708,774],"24efb037-af1a-4c2d-9b7d-2a259a8f5fc7","post-update.sample","f336e0ea-668d-11f1-9084-1607ee4eb77e",50,["D",1781289528198],"#!/bin/sh\n#\n# An example hook script to prepare a packed repository for use over\n# dumb transports.\n#\n# To enable this hook, rename this file to \"post-update\".\n\nexec git update-server-info\n",[],[148,708,782],"1d50e554-f080-441a-a0ee-eccda5056cbc","fsmonitor-watchman.sample","f3f37034-668d-11f1-847c-1607ee4eb77e",71,["D",1781289528701],"#!/usr/bin/perl\n\nuse strict;\nuse warnings;\nuse IPC::Open2;\n\n# An example hook script to integrate Watchman\n# (https://facebook.github.io/watchman/) with git to speed up detecting\n# new and modified files.\n#\n# The hook is passed a version (currently 2) and last update token\n# formatted as a string and outputs to stdout a new update token and\n# all files that have been modified since the update token. Paths must\n# be relative to the root of the working tree and separated by a single NUL.\n#\n# To enable this hook, rename this file to \"query-watchman\" and set\n# 'git config core.fsmonitor .git/hooks/query-watchman'\n#\nmy ($version, $last_update_token) = @ARGV;\n\n# Uncomment for debugging\n# print STDERR \"$0 $version $last_update_token\\n\";\n\n# Check the hook interface version\nif ($version ne 2) {\n\tdie \"Unsupported query-fsmonitor hook version '$version'.\\n\" .\n\t \"Falling back to scanning...\\n\";\n}\n\nmy $git_work_tree = get_working_dir();\n\nmy $retry = 1;\n\nmy $json_pkg;\neval {\n\trequire JSON::XS;\n\t$json_pkg = \"JSON::XS\";\n\t1;\n} or do {\n\trequire JSON::PP;\n\t$json_pkg = \"JSON::PP\";\n};\n\nlaunch_watchman();\n\nsub launch_watchman {\n\tmy $o = watchman_query();\n\tif (is_work_tree_watched($o)) {\n\t\toutput_result($o->{clock}, @{$o->{files}});\n\t}\n}\n\nsub output_result {\n\tmy ($clockid, @files) = @_;\n\n\t# Uncomment for debugging watchman output\n\t# open (my $fh, \">\", \".git/watchman-output.out\");\n\t# binmode $fh, \":utf8\";\n\t# print $fh \"$clockid\\n@files\\n\";\n\t# close $fh;\n\n\tbinmode STDOUT, \":utf8\";\n\tprint $clockid;\n\tprint \"\\0\";\n\tlocal $, = \"\\0\";\n\tprint @files;\n}\n\nsub watchman_clock {\n\tmy $response = qx/watchman clock \"$git_work_tree\"/;\n\tdie \"Failed to get clock id on '$git_work_tree'.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $? != 0;\n\n\treturn $json_pkg->new->utf8->decode($response);\n}\n\nsub watchman_query {\n\tmy $pid = open2(\\*CHLD_OUT, \\*CHLD_IN, 'watchman -j --no-pretty')\n\tor die \"open2() failed: $!\\n\" .\n\t\"Falling back to scanning...\\n\";\n\n\t# In the query expression below we're asking for names of files that\n\t# changed since $last_update_token but not from the .git folder.\n\t#\n\t# To accomplish this, we're using the \"since\" generator to use the\n\t# recency index to select candidate nodes and \"fields\" to limit the\n\t# output to file names only. Then we're using the \"expression\" term to\n\t# further constrain the results.\n\tmy $last_update_line = \"\";\n\tif (substr($last_update_token, 0, 1) eq \"c\") {\n\t\t$last_update_token = \"\\\"$last_update_token\\\"\";\n\t\t$last_update_line = qq[\\n\"since\": $last_update_token,];\n\t}\n\tmy $query = <<\"\tEND\";\n\t\t[\"query\", \"$git_work_tree\", {$last_update_line\n\t\t\t\"fields\": [\"name\"],\n\t\t\t\"expression\": [\"not\", [\"dirname\", \".git\"]]\n\t\t}]\n\tEND\n\n\t# Uncomment for debugging the watchman query\n\t# open (my $fh, \">\", \".git/watchman-query.json\");\n\t# print $fh $query;\n\t# close $fh;\n\n\tprint CHLD_IN $query;\n\tclose CHLD_IN;\n\tmy $response = do {local $/; };\n\n\t# Uncomment for debugging the watch response\n\t# open ($fh, \">\", \".git/watchman-response.json\");\n\t# print $fh $response;\n\t# close $fh;\n\n\tdie \"Watchman: command returned no output.\\n\" .\n\t\"Falling back to scanning...\\n\" if $response eq \"\";\n\tdie \"Watchman: command returned invalid output: $response\\n\" .\n\t\"Falling back to scanning...\\n\" unless $response =~ /^\\{/;\n\n\treturn $json_pkg->new->utf8->decode($response);\n}\n\nsub is_work_tree_watched {\n\tmy ($output) = @_;\n\tmy $error = $output->{error};\n\tif ($retry > 0 and $error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) {\n\t\t$retry--;\n\t\tmy $response = qx/watchman watch \"$git_work_tree\"/;\n\t\tdie \"Failed to make watchman watch '$git_work_tree'.\\n\" .\n\t\t \"Falling back to scanning...\\n\" if $? != 0;\n\t\t$output = $json_pkg->new->utf8->decode($response);\n\t\t$error = $output->{error};\n\t\tdie \"Watchman: $error.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $error;\n\n\t\t# Uncomment for debugging watchman output\n\t\t# open (my $fh, \">\", \".git/watchman-output.out\");\n\t\t# close $fh;\n\n\t\t# Watchman will always return all files on the first query so\n\t\t# return the fast \"everything is dirty\" flag to git and do the\n\t\t# Watchman query just to get it over with now so we won't pay\n\t\t# the cost in git to look up each individual file.\n\t\tmy $o = watchman_clock();\n\t\t$error = $output->{error};\n\n\t\tdie \"Watchman: $error.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $error;\n\n\t\toutput_result($o->{clock}, (\"/\"));\n\t\t$last_update_token = $o->{clock};\n\n\t\teval { launch_watchman() };\n\t\treturn 0;\n\t}\n\n\tdie \"Watchman: $error.\\n\" .\n\t\"Falling back to scanning...\\n\" if $error;\n\n\treturn 1;\n}\n\nsub get_working_dir {\n\tmy $working_dir;\n\tif ($^O =~ 'msys' || $^O =~ 'cygwin') {\n\t\t$working_dir = Win32::GetCwd();\n\t\t$working_dir =~ tr/\\\\/\\//;\n\t} else {\n\t\trequire Cwd;\n\t\t$working_dir = Cwd::cwd();\n\t}\n\n\treturn $working_dir;\n}\n",[],[148,708,790],"f2acb98a-4098-4ff5-8939-ed2f4246d70e","commit-msg.sample","f33d6578-668d-11f1-9ab7-1607ee4eb77e",51,["D",1781289528218],"#!/bin/sh\n#\n# An example hook script to check the commit log message.\n# Called by \"git commit\" with one argument, the name of the file\n# that has the commit message. The hook should exit with non-zero\n# status after issuing an appropriate message if it wants to stop the\n# commit. The hook is allowed to edit the commit message file.\n#\n# To enable this hook, rename this file to \"commit-msg\".\n\n# Uncomment the below to add a Signed-off-by line to the message.\n# Doing this in a hook is a bad idea in general, but the prepare-commit-msg\n# hook is more suited to it.\n#\n# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\$.*>\$.*$/Signed-off-by: \\1/p')\n# grep -qs \"^$SOB\" \"$1\" || echo \"$SOB\" >> \"$1\"\n\n# This example catches duplicate Signed-off-by lines.\n\ntest \"\" = \"$(grep '^Signed-off-by: ' \"$1\" |\n\t sort | uniq -c | sed -e '/^[ \t]*1[ \t]/d')\" || {\n\techo >&2 Duplicate Signed-off-by lines.\n\texit 1\n}\n",[],[148,708,798],"0e2a4d05-5854-464f-8148-b174b1c06df5","applypatch-msg.sample","f321bd28-668d-11f1-9245-1607ee4eb77e",47,["D",1781289528031],"#!/bin/sh\n#\n# An example hook script to check the commit log message taken by\n# applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit. The hook is\n# allowed to edit the commit message file.\n#\n# To enable this hook, rename this file to \"applypatch-msg\".\n\n. git-sh-setup\ncommitmsg=\"$(git rev-parse --git-path hooks/commit-msg)\"\ntest -x \"$commitmsg\" && exec \"$commitmsg\" ${1+\"$@\"}\n:\n",[],[148,708,806],"d80b0eca-1ee6-4307-9d88-d85d0828f8d7",6,["D",1781289524788],[164,165,166,167,168,169,170,171,172,173,174,175,176,177],[148,708],"be765c6f-8517-40f1-8375-a56c0b5f1644",["D",1781289524292],[163,178,180,185,208,212,213,214,215],[148],"18726005-4675-41be-86fe-e404657d2f2f","settings.local.json","55ef6624-66b3-11f1-9fc1-1607ee4eb77e","55d19a0e-66b3-11f1-a5fa-1607ee4eb77e",76,["D",1781305585156],"{\n \"permissions\": {\n \"allow\": [\n \"Bash(deno --version)\",\n \"Bash(deno check *)\",\n \"Bash(deno lint *)\"\n ]\n }\n}\n",[],[831,823],".claude","3118c159-fcf7-4b6b-8025-4e502a888585",73,["D",1781305585000],[161],[831],["D",1781289523885],{"_11":12,"_116":68},{"_11":12,"_112":-5,"_67":68,"_30":66,"_113":114,"_115":24},{"_38":103,"_13":16,"_32":35,"_104":70,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"ctx",{"_51":-5,"_136":874,"_875":876,"_877":878,"_879":24,"_880":24,"_881":24,"_882":134,"_883":-5,"_884":-7,"_885":-7,"_886":26,"_887":24,"_888":24,"_889":-5,"_890":24,"_891":24,"_892":24,"_893":-5},"ENV",{"_845":846,"_847":848,"_849":16,"_850":851,"_852":853,"_854":855,"_856":857,"_858":859,"_860":861,"_862":863,"_864":865,"_866":867,"_868":869,"_870":871,"_872":873},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · description