[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_627":628,"_629":630},"routes/_app.x.$handle.$name",{"_93":92,"_31":43,"_101":83,"_26":51,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":24,"_115":116,"_117":24,"_118":-5,"_119":-5,"_120":121},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":76,"_77":78,"_79":80,"_81":24},"version",55,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":20,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path",".git/hooks/pre-applypatch.sample","latestPath","fileId","f364ccbc-668d-11f1-9ab7-1607ee4eb77e","name","pre-applypatch.sample","fileType","content","#!/bin/sh\n#\n# An example hook script to verify what is about to be committed\n# by applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit.\n#\n# To enable this hook, rename this file to \"pre-applypatch\".\n\n. git-sh-setup\nprecommit=\"$(git rev-parse --git-path hooks/pre-commit)\"\ntest -x \"$precommit\" && exec \"$precommit\" ${1+\"$@\"}\n:\n","createdAt",["D",1781289528399],"branchVersion","branchId","92e19ade-ba2c-4861-a1cb-538d4dba0795","id","de13bec5-73e7-4691-ae8a-0dbe38e57ea0","discord-captcha-shield",["D",1781289523885],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","d06b6c80-f3a1-11ef-89a3-8735e07158f4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e03963fb-ecc4-48fb-bc25-0173a8b9a8c8","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_93":92,"_100":96},"org",{"_93":92,"_94":-5,"_95":96,"_18":53,"_97":98,"_99":24},"branch",{"_13":82,"_31":83,"_41":40,"_84":42,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":43,"_91":92},"isOwned",101,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","catalloc","handle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/0478d851-5bca-4d5e-6593-fb952af01c00/square512?exp=1789552799&sig=ef714e59195652bb817f43406b9a0c88fdbea9932a429ec9820e89449837aaea","tier","pro","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_41":42,"_31":43,"_36":623,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":-5,"_55":24,"_56":-5,"_57":-5,"_58":59,"_60":61,"_62":-5,"_63":-5,"_64":-5,"_65":-5,"_66":67,"_68":67,"_69":70,"_71":70,"_72":70,"_73":67,"_74":67,"_75":624,"_77":625,"_79":626,"_81":24},"tree",[218,264,265,266,267,268,269,270,271,272],"files",[218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264,265,266,267,268,269,270,271,272],"counts",{"_208":59,"_209":204,"_210":59,"_211":212,"_213":214},"contents",[122,123,124,125,126,127,128,129,130,131],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":201,"_31":202,"_29":203,"_135":-5,"_39":40,"_38":204,"_137":168,"_36":205,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_26":207},{"_41":194,"_31":195,"_29":196,"_135":-5,"_39":40,"_38":197,"_137":168,"_36":198,"_13":59,"_33":20,"_34":199,"_23":24,"_141":-5,"_26":200},{"_41":187,"_31":188,"_29":189,"_135":-5,"_39":40,"_38":190,"_137":168,"_36":191,"_13":59,"_33":20,"_34":192,"_23":24,"_141":-5,"_26":193},{"_41":180,"_31":181,"_29":182,"_135":-5,"_39":40,"_38":183,"_137":24,"_36":184,"_13":59,"_33":139,"_34":185,"_23":24,"_141":-5,"_26":186},{"_41":172,"_31":173,"_29":174,"_135":-5,"_39":40,"_38":175,"_137":24,"_36":176,"_13":59,"_33":177,"_34":178,"_23":24,"_141":-5,"_26":179},{"_41":164,"_31":165,"_29":166,"_135":-5,"_39":40,"_38":167,"_137":168,"_36":169,"_13":59,"_33":20,"_34":170,"_23":24,"_141":-5,"_26":171},{"_41":157,"_31":158,"_29":159,"_135":-5,"_39":40,"_38":160,"_137":24,"_36":161,"_13":59,"_33":139,"_34":162,"_23":24,"_141":-5,"_26":163},{"_41":150,"_31":151,"_29":152,"_135":-5,"_39":40,"_38":153,"_137":24,"_36":154,"_13":59,"_33":139,"_34":155,"_23":24,"_141":-5,"_26":156},{"_41":143,"_31":144,"_29":145,"_135":-5,"_39":40,"_38":146,"_137":24,"_36":147,"_13":59,"_33":139,"_34":148,"_23":24,"_141":-5,"_26":149},{"_41":132,"_31":133,"_29":134,"_135":-5,"_39":40,"_38":136,"_137":24,"_36":138,"_13":59,"_33":139,"_34":140,"_23":24,"_141":-5,"_26":142},"6cbbe2f3-a8a4-451f-a3d8-44dca2721c92","theme.ts","f2c7820e-668d-11f1-9138-1607ee4eb77e","parentId",33,"latest",["D",1781289527438],"script","/**\n * Branding + theme for the Discord CAPTCHA Shield.\n *\n * This is the ONE file you edit to make the template your own. It replaces the\n * site-specific `core/` dependencies the original was coupled to, so the shield\n * ships fully self-contained. Swap the colors, logo, copy, and rules below and\n * the portal page, the OG card, and every Discord embed re-skin together.\n *\n * Ships themed for `catalloc` — a warm \"tabby\" palette and cat-flavored copy —\n * as a worked example. Replace it with yours.\n */\n\n// ========================================\n// BRAND\n// ========================================\n\nexport const brand = {\n /** Display name. The DISCORD/portal env var VERIFY_SERVER_NAME overrides this\n * at runtime, so you can reuse one template for several servers. */\n name: \"catalloc\",\n\n /** Headline + tagline rendered onto the social (OG) card. */\n ogHeadline: \"ARE YOU HUMAN?\",\n ogTagline: \"Solve a quick CAPTCHA to unlock the Discord\",\n\n /** Square logo (≈300px+). Shown on the portal card, the OG card, and the\n * rules embed thumbnail. Defaults to a placeholder cat — swap for your own. */\n logoUrl: \"https://placecats.com/300/300\",\n\n /** Accent color — drives buttons, the portal header bar, and embed stripes.\n * `embedColor` is the same color as a Discord-friendly integer (0xRRGGBB). */\n accentColor: \"#F4A340\", // tabby orange\n accentColorBright: \"#FFC15E\",\n embedColor: 0xf4a340,\n\n /** Shown by crawlers before the cron first generates /og.png. */\n ogFallbackImage: \"https://placecats.com/1200/630\",\n};\n\n// ========================================\n// RULES (posted by post-rules.ts)\n// ========================================\n\nexport interface Rule {\n name: string;\n value: string;\n}\n\n/** Server rules rendered into the rules embed. Rewrite for your community. */\nexport const rules: Rule[] = [\n {\n name: \"1. BE KIND\",\n value:\n \"We're here to have a good time. If you have a problem with someone, try to sort it out civilly — and if that fails, ping a mod and we'll help mediate.\",\n },\n {\n name: \"2. KEEP IT ON-TOPIC\",\n value:\n \"No politics or hot-button drama. There are plenty of places on the internet for that; this isn't one of them.\",\n },\n {\n name: \"3. NO HATE SPEECH\",\n value:\n \"Everyone is welcome here. Zero tolerance for racism, sexism, homophobia, or hate speech of any kind.\",\n },\n {\n name: \"4. NO NSFW / NSFL CONTENT\",\n value:\n \"Don't post vulgar, obscene, or explicit content. Keep it SFW (cat pictures excepted).\",\n },\n {\n name: \"5. NO SPAM OR SELF-PROMO\",\n value:\n \"Don't flood channels, mass-DM members, or drop unsolicited invite links. Ask a mod before promoting anything.\",\n },\n {\n name: \"6. RESPECT THE MODS\",\n value:\n \"Mods enforce these rules as needed. Most violations get a warning; extreme or repeat cases may result in a ban.\",\n },\n];\n\n// ========================================\n// ABOUT (posted by post-about.ts)\n// ========================================\n\nexport interface AboutInfo {\n /** One-line hook under the title. */\n tagline: string;\n /** A paragraph (or two) describing the community. Markdown is allowed. */\n description: string;\n /** Optional bullet-style highlights rendered as embed fields. */\n highlights: Rule[];\n}\n\n/**\n * The \"About\" card the bot posts into a DMZ channel (one unverified members can\n * see) so newcomers know what they're joining before they verify. Rewrite for\n * your community.\n */\nexport const about: AboutInfo = {\n tagline: \"A cozy corner of the internet for cat people. 🐾\",\n description:\n \"**catalloc** is a laid-back community built around good vibes, good company, and an unreasonable number of cat pictures. Whether you're here to hang out, share your projects, or just lurk with a coffee, you're welcome.\\n\\nVerification keeps the bots and raiders out — pass a quick CAPTCHA and the rest of the server opens up.\",\n highlights: [\n { name: \"💬 Active chat\", value: \"Always someone around to talk to.\" },\n { name: \"🐱 Cat tax\", value: \"Pictures of your cat are strongly encouraged.\" },\n { name: \"🛡️ Bot-free\", value: \"CAPTCHA-gated so it stays human.\" },\n ],\n};\n\n// ========================================\n// STYLES (replaces core/styles.tsx getAllStyles)\n// ========================================\n\n/**\n * All CSS the portal needs, self-contained. Maps the brand accent onto theme\n * variables and ships the small `.btn` + portal layout the page references.\n * Soft, rounded, cat-friendly — no external stylesheet required.\n */\nexport function portalCss(): string {\n return `\n :root {\n --accent: ${brand.accentColor};\n --accent-bright: ${brand.accentColorBright};\n --bg: #0E0D0B;\n --surface: #1C1A17;\n --surface-2: #2A2722;\n --text: #F5F1EA;\n --muted: rgba(245,241,234,0.65);\n }\n\n * { margin: 0; padding: 0; box-sizing: border-box; }\n html { scroll-behavior: smooth; }\n body {\n font-family: 'Quicksand', system-ui, sans-serif;\n background-color: var(--bg);\n color: var(--text);\n -webkit-font-smoothing: antialiased;\n }\n\n .btn {\n font-family: 'Quicksand', sans-serif;\n font-size: 1rem;\n font-weight: 600;\n letter-spacing: 1px;\n text-decoration: none;\n padding: 0.9rem 2rem;\n border: none;\n border-radius: 14px;\n cursor: pointer;\n transition: all 0.25s ease;\n }\n .btn-primary {\n background: linear-gradient(135deg, var(--accent), var(--accent-bright));\n color: #1a1206;\n }\n .btn-primary:hover {\n transform: translateY(-2px);\n box-shadow: 0 10px 28px rgba(244,163,64,0.35);\n }\n .btn-secondary {\n background: transparent;\n color: var(--text);\n border: 2px solid var(--accent);\n }\n .btn-secondary:hover {\n background: rgba(244,163,64,0.12);\n transform: translateY(-2px);\n }\n\n .verify-wrap {\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n padding: 24px;\n background:\n radial-gradient(ellipse at 50% 0%, rgba(244,163,64,0.16) 0%, transparent 60%),\n linear-gradient(160deg, #0E0D0B 0%, #15120E 60%, #0E0D0B 100%);\n }\n .verify-card {\n width: 100%;\n max-width: 440px;\n background: linear-gradient(150deg, var(--surface-2), var(--surface));\n border: 1px solid rgba(244,163,64,0.22);\n padding: 2.5rem 2rem;\n position: relative;\n overflow: hidden;\n text-align: center;\n border-radius: 24px;\n box-shadow: 0 24px 60px rgba(0,0,0,0.55);\n }\n .verify-card::before {\n content: '';\n position: absolute;\n top: 0; left: 0; right: 0;\n height: 4px;\n background: linear-gradient(90deg, var(--accent), var(--accent-bright), var(--accent));\n }\n .verify-logo {\n width: 92px;\n height: 92px;\n object-fit: cover;\n border-radius: 50%;\n margin: 0 auto 1.25rem;\n border: 3px solid rgba(244,163,64,0.5);\n box-shadow: 0 0 26px rgba(244,163,64,0.4);\n }\n .verify-card h1 {\n font-family: 'Fredoka', sans-serif;\n font-weight: 600;\n font-size: 2.1rem;\n letter-spacing: 1px;\n line-height: 1.05;\n margin-bottom: 0.4rem;\n }\n .verify-sub {\n font-weight: 600;\n font-size: 0.8rem;\n letter-spacing: 1.5px;\n text-transform: uppercase;\n color: var(--accent);\n margin-bottom: 1.75rem;\n }\n .verify-steps {\n list-style: none;\n text-align: left;\n max-width: 300px;\n margin: 0 auto 1.75rem;\n display: grid;\n gap: 0.65rem;\n }\n .verify-steps li {\n display: flex;\n align-items: center;\n gap: 0.8rem;\n font-size: 0.92rem;\n color: var(--muted);\n }\n .verify-steps .n {\n flex: none;\n width: 28px;\n height: 28px;\n background: var(--accent);\n color: #1a1206;\n font-family: 'Fredoka', sans-serif;\n font-weight: 600;\n font-size: 0.95rem;\n display: grid;\n place-items: center;\n border-radius: 50%;\n }\n .cf-holder {\n display: flex;\n justify-content: center;\n min-height: 70px;\n margin-bottom: 1.5rem;\n }\n .btn-block { width: 100%; display: inline-flex; align-items: center; justify-content: center; gap: 0.6rem; }\n .btn-block svg { width: 20px; height: 20px; }\n .btn:disabled { opacity: 0.4; cursor: not-allowed; transform: none !important; box-shadow: none !important; }\n .verify-err {\n display: none;\n margin-top: 1.1rem;\n color: var(--text);\n background: rgba(244,163,64,0.12);\n border: 1px solid rgba(244,163,64,0.4);\n border-radius: 12px;\n padding: 0.7rem 0.9rem;\n font-size: 0.85rem;\n line-height: 1.5;\n }\n .verify-foot {\n margin-top: 1.75rem;\n color: rgba(245,241,234,0.35);\n font-size: 0.7rem;\n letter-spacing: 1px;\n text-transform: uppercase;\n }\n .result-badge {\n width: 84px;\n height: 84px;\n margin: 0 auto 1.5rem;\n display: grid;\n place-items: center;\n border-radius: 50%;\n font-size: 2.6rem;\n line-height: 1;\n }\n .result-badge.ok { background: rgba(74,176,108,0.15); color: #4ab06c; border: 2px solid #4ab06c; }\n .result-badge.bad { background: rgba(244,163,64,0.15); color: var(--accent-bright); border: 2px solid var(--accent); }\n .result-msg { color: var(--muted); line-height: 1.7; font-size: 1.05rem; }\n .result-link { margin-top: 1.5rem; }\n`;\n}\n","label",[133],"06ef0440-8493-4fca-b62a-d33761a3cd71","store.ts","f2c267e2-668d-11f1-847c-1607ee4eb77e",32,["D",1781289527432],"/**\n * Per-key blob storage for the IDs the shield owns: the DMZ category, the four\n * DMZ channels, and the messages it posts into them.\n *\n * Persisting these gives two things:\n * 1. Idempotent setup — channel creation can skip channels it already made.\n * 2. In-place message updates — re-running a post tool EDITS the message it\n * posted last time instead of dropping a duplicate.\n *\n * Each ID lives under its OWN blob key (one channel, one message, one category\n * per key) rather than in a single aggregate object. That makes writes\n * independent: setup.ts can post all four DMZ messages concurrently without the\n * read-modify-write races a shared object would have.\n *\n * Channel-ID resolution order (see mod.ts `resolveChannel`) is:\n * explicit parameter -> this store -> the env var (config field)\n * so a server that ran setup.ts uses the bot-made channels, while a server that\n * wired channel IDs by hand still works via env.\n */\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst PREFIX = \"captcha_shield_v1\";\n\nexport type ChannelKind = \"about\" | \"rules\" | \"verify\" | \"honeypot\";\n\nconst channelKey = (kind: ChannelKind) => `${PREFIX}_channel_${kind}`;\nconst messageKey = (kind: ChannelKind) => `${PREFIX}_message_${kind}`;\nconst CATEGORY_KEY = `${PREFIX}_category`;\n\n/** Read a single stored ID. Undefined if it was never written. */\nasync function readId(key: string): Promise {\n try {\n const res = await blob.get(key);\n const text = (await res.text()).trim();\n return text || undefined;\n } catch {\n return undefined; // not written yet\n }\n}\n\n/** Write a single stored ID. One key per ID, so concurrent writes don't race. */\nasync function writeId(key: string, id: string): Promise {\n await blob.set(key, id);\n}\n\nexport const getChannel = (kind: ChannelKind): Promise =>\n readId(channelKey(kind));\nexport const getMessage = (kind: ChannelKind): Promise =>\n readId(messageKey(kind));\nexport const getCategory = (): Promise =>\n readId(CATEGORY_KEY);\n\nexport const rememberChannel = (kind: ChannelKind, id: string): Promise =>\n writeId(channelKey(kind), id);\nexport const rememberMessage = (kind: ChannelKind, id: string): Promise =>\n writeId(messageKey(kind), id);\nexport const rememberCategory = (id: string): Promise =>\n writeId(CATEGORY_KEY, id);\n",[144],"e4269faa-b436-4b1c-9972-f1a676a9092b","post-honeypot.ts","f2dc5f1c-668d-11f1-b0f1-1607ee4eb77e",36,["D",1781289527593],"// ============================================================================\n// Post the honeypot warning into Discord (manual trigger)\n// ============================================================================\n//\n// Run this file (Val Town \"Run\" button) and the bot posts a small \"do not post\n// here\" embed into DISCORD_HONEYPOT_CHANNEL_ID, pointing legit users to the\n// verify channel (and rules). The honeypot is a trap: bots that auto-spam every\n// channel post here and out themselves — pair it with an AutoMod rule or manual\n// review to ban anyone who posts.\n//\n// Requires: DISCORD_BOT_TOKEN, DISCORD_HONEYPOT_CHANNEL_ID. Uses\n// DISCORD_VERIFY_CHANNEL_ID and DISCORD_RULES_CHANNEL_ID for the in-embed links\n// (numeric ID, channel link, or #mention all accepted). Optional:\n// VERIFY_SERVER_NAME. Bot needs Send Messages + Embed Links in that channel.\n// ============================================================================\n\nimport { postHoneypotMessage, type VerifyConfig } from \"./mod.ts\";\nimport { env, optEnv } from \"./config.ts\";\n\nexport async function main() {\n const config = {\n botToken: env(\"DISCORD_BOT_TOKEN\"),\n serverName: optEnv(\"VERIFY_SERVER_NAME\"),\n honeypotChannelId: optEnv(\"DISCORD_HONEYPOT_CHANNEL_ID\"),\n verifyChannelId: optEnv(\"DISCORD_VERIFY_CHANNEL_ID\"),\n rulesChannelId: optEnv(\"DISCORD_RULES_CHANNEL_ID\"),\n } as VerifyConfig;\n\n const result = await postHoneypotMessage(config);\n console.log(\n result.ok\n ? `Honeypot message posted (${result.detail}).`\n : `Failed to post honeypot message: ${result.detail}`,\n );\n return result;\n}\n\nawait main();\n",[151],"af86108e-07f3-4d84-9333-1cb72a46c666","mod.ts","f2ebeaa4-668d-11f1-9138-1607ee4eb77e",38,["D",1781289527691],"/**\n * Discord CAPTCHA Shield — CAPTCHA + Discord OAuth verification module.\n *\n * A self-contained verification gate for a Discord server:\n * 1. Visitor solves a Cloudflare Turnstile CAPTCHA.\n * 2. Server verifies the Turnstile token and mints a one-time, short-lived\n * state nonce (SQLite) bound to that passed challenge.\n * 3. Visitor authorizes via Discord OAuth2 (identify scope only).\n * 4. On callback the nonce is validated + burned, identity is read, and the\n * configured bot grants the verified role to the (already-joined) member.\n *\n * Config-driven: everything visual lives in ./theme.ts, everything secret comes\n * from env (see ./config.ts). To shield a second Discord, clone the whole val\n * and set that copy's env — its project-scoped SQLite keeps storage isolated.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { about, brand, portalCss, rules } from \"./theme.ts\";\nimport {\n type ChannelKind,\n getChannel,\n getMessage,\n rememberChannel,\n rememberMessage,\n} from \"./store.ts\";\n\n// ========================================\n// CONSTANTS\n// ========================================\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\nconst TURNSTILE_VERIFY_URL =\n \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\nconst STATE_TTL_MS = 10 * 60 * 1000; // verification link valid for 10 minutes\n\nconst STATES_TABLE = \"captcha_verify_states\";\nconst LOG_TABLE = \"captcha_verify_log\";\nconst ALERTS_TABLE = \"captcha_verify_alerts\";\n\n// Raid detection: alert when an abnormal number of *successful* verifications\n// land within a short window (the pattern Turnstile can't catch — farmed\n// accounts solving real CAPTCHAs). Debounced so we send at most one alert per\n// cooldown. These are defaults; override per-deployment via VerifyConfig.\nconst DEFAULT_RAID_WINDOW_MS = 5 * 60 * 1000; // look back 5 minutes\nconst DEFAULT_RAID_THRESHOLD = 15; // successes within window that trips alert\nconst DEFAULT_ALERT_COOLDOWN_MS = 15 * 60 * 1000; // min gap between alerts\n\n// ========================================\n// TYPES\n// ========================================\n\nexport interface VerifyConfig {\n clientId: string;\n clientSecret: string;\n botToken: string;\n guildId: string;\n roleId: string;\n turnstileSiteKey: string;\n turnstileSecretKey: string;\n /** Display name shown on the portal (defaults to the brand name). */\n serverName?: string;\n /** Override the derived `${origin}/callback` (use for custom domains). */\n redirectUriOverride?: string;\n /** Optional Discord webhook URL for raid alerts. No alerts if unset. */\n alertWebhookUrl?: string;\n /** Successful verifications within the window that trip a raid alert. */\n raidThreshold?: number;\n /** Raid-detection look-back window, in milliseconds. */\n raidWindowMs?: number;\n /** Minimum gap between raid alerts, in milliseconds. */\n alertCooldownMs?: number;\n /** Channel the bot posts the verification message into (for postVerifyMessage). */\n verifyChannelId?: string;\n /** Public base URL of the portal (for the Verify button + card image). */\n portalUrl?: string;\n /** Channel the bot posts the rules embed into (for postRulesMessage). */\n rulesChannelId?: string;\n /** Honeypot/trap channel the bot posts the \"do not post\" warning into. */\n honeypotChannelId?: string;\n /** DMZ channel the bot posts the \"about the community\" embed into. */\n aboutChannelId?: string;\n}\n\ninterface DiscordUser {\n id: string;\n username?: string;\n}\n\n/** Display name for this deployment: env override, else the brand default. */\nfunction displayName(config: VerifyConfig): string {\n return config.serverName ?? brand.name;\n}\n\n// ========================================\n// DATABASE\n// ========================================\n\nlet tablesInitialized = false;\n\nasync function ensureTables(): Promise {\n if (tablesInitialized) return;\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${STATES_TABLE} (\n state TEXT PRIMARY KEY,\n created_at INTEGER NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )\n `);\n\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${LOG_TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n discord_user_id TEXT NOT NULL,\n discord_username TEXT,\n created_at INTEGER NOT NULL,\n success INTEGER NOT NULL,\n detail TEXT\n )\n `);\n\n // Keeps the raid-detection COUNT (success + recent window) an index seek.\n await sqlite.execute(`\n CREATE INDEX IF NOT EXISTS idx_${LOG_TABLE}_success_created\n ON ${LOG_TABLE} (success, created_at)\n `);\n\n // Debounce state for alerts (one row per alert kind).\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${ALERTS_TABLE} (\n kind TEXT PRIMARY KEY,\n last_alert_at INTEGER NOT NULL\n )\n `);\n\n tablesInitialized = true;\n}\n\n/** Delete used or expired nonces. Cheap because the table only ever holds\n * in-flight verifications (we prune on every mint). Best-effort. */\nasync function pruneStates(): Promise {\n try {\n await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n } catch {\n // pruning is best-effort; never block a verification on it\n }\n}\n\n/** Mint a one-time state nonce. Only called after Turnstile has passed. */\nasync function mintState(): Promise {\n await ensureTables();\n await pruneStates();\n const state = crypto.randomUUID();\n await sqlite.execute({\n sql:\n `INSERT INTO ${STATES_TABLE} (state, created_at, used) VALUES (?, ?, 0)`,\n args: [state, Date.now()],\n });\n return state;\n}\n\n/** Validate and atomically burn a state nonce. Returns a reason on failure. */\nasync function consumeState(\n state: string,\n): Promise<{ ok: true } | { ok: false; reason: string }> {\n await ensureTables();\n const now = Date.now();\n\n // Atomic single-use: only the request that flips `used` from 0->1 on a\n // still-valid row wins. Concurrent callbacks for the same state can't both\n // succeed (no check-then-act race).\n const burn = await sqlite.execute({\n sql:\n `UPDATE ${STATES_TABLE} SET used = 1 WHERE state = ? AND used = 0 AND created_at > ?`,\n args: [state, now - STATE_TTL_MS],\n });\n if ((burn.rowsAffected || 0) === 1) {\n return { ok: true };\n }\n\n // The burn didn't take — figure out why for a helpful message (rare path).\n const res = await sqlite.execute({\n sql: `SELECT used, created_at FROM ${STATES_TABLE} WHERE state = ?`,\n args: [state],\n });\n if (!res.rows || res.rows.length === 0) {\n return { ok: false, reason: \"Invalid session. Please start over.\" };\n }\n if (Number(res.rows[0][0])) {\n return { ok: false, reason: \"This verification link was already used.\" };\n }\n return { ok: false, reason: \"Your session expired. Please start over.\" };\n}\n\nasync function logVerification(\n user: DiscordUser,\n success: boolean,\n detail: string,\n): Promise {\n try {\n await ensureTables();\n await sqlite.execute({\n sql:\n `INSERT INTO ${LOG_TABLE} (discord_user_id, discord_username, created_at, success, detail) VALUES (?, ?, ?, ?, ?)`,\n args: [user.id, user.username ?? null, Date.now(), success ? 1 : 0, detail],\n });\n } catch {\n // logging is best-effort\n }\n}\n\n/**\n * Prune ephemeral nonces and age out the audit log. Called by the cron.\n * Returns how many rows were deleted from each table.\n */\nexport async function cleanupVerifyData(\n logRetentionDays: number,\n): Promise<{ states: number; logs: number }> {\n await ensureTables();\n const states = await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n const logs = await sqlite.execute({\n sql: `DELETE FROM ${LOG_TABLE} WHERE created_at < ?`,\n args: [Date.now() - logRetentionDays * 24 * 60 * 60 * 1000],\n });\n return { states: states.rowsAffected || 0, logs: logs.rowsAffected || 0 };\n}\n\n// ========================================\n// DISCORD + TURNSTILE\n// ========================================\n\nasync function verifyTurnstile(\n secret: string,\n token: string,\n ip: string | null,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"secret\", secret);\n form.set(\"response\", token);\n if (ip) form.set(\"remoteip\", ip);\n\n const res = await fetch(TURNSTILE_VERIFY_URL, { method: \"POST\", body: form });\n const data = await res.json().catch(() => ({ success: false }));\n return data.success === true;\n}\n\nasync function exchangeCode(\n config: VerifyConfig,\n code: string,\n redirectUri: string,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"client_id\", config.clientId);\n form.set(\"client_secret\", config.clientSecret);\n form.set(\"grant_type\", \"authorization_code\");\n form.set(\"code\", code);\n form.set(\"redirect_uri\", redirectUri);\n\n const res = await fetch(`${DISCORD_API}/oauth2/token`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: form,\n });\n if (!res.ok) return null;\n const data = await res.json();\n return (data.access_token as string) ?? null;\n}\n\nasync function fetchDiscordUser(\n accessToken: string,\n): Promise {\n const res = await fetch(`${DISCORD_API}/users/@me`, {\n headers: { authorization: `Bearer ${accessToken}` },\n });\n if (!res.ok) return null;\n return await res.json() as DiscordUser;\n}\n\n/**\n * Grant the verified role to an existing guild member.\n * Returns the HTTP status and, on failure, the Discord error code so callers\n * can distinguish \"user not in guild\" from configuration problems.\n */\nasync function grantRole(\n config: VerifyConfig,\n userId: string,\n): Promise<{ status: number; body: string; code?: number }> {\n const res = await fetch(\n `${DISCORD_API}/guilds/${config.guildId}/members/${userId}/roles/${config.roleId}`,\n {\n method: \"PUT\",\n headers: {\n authorization: `Bot ${config.botToken}`,\n \"x-audit-log-reason\": \"Passed CAPTCHA verification portal\",\n },\n },\n );\n if (res.status === 204) return { status: 204, body: \"\" };\n const body = await res.text();\n let code: number | undefined;\n try {\n code = JSON.parse(body)?.code;\n } catch {\n // non-JSON error body\n }\n return { status: res.status, body, code };\n}\n\n/**\n * Fire a Discord webhook alert if the rate of successful verifications spikes\n * past RAID_THRESHOLD within RAID_WINDOW_MS. Debounced via an atomic update so\n * only one request per ALERT_COOLDOWN_MS sends. Best-effort and never blocks\n * the verifying user's response. No-op when no webhook is configured.\n */\nasync function maybeAlertRaid(\n config: VerifyConfig,\n serverName: string,\n): Promise {\n if (!config.alertWebhookUrl) return;\n const threshold = config.raidThreshold ?? DEFAULT_RAID_THRESHOLD;\n const windowMs = config.raidWindowMs ?? DEFAULT_RAID_WINDOW_MS;\n const cooldownMs = config.alertCooldownMs ?? DEFAULT_ALERT_COOLDOWN_MS;\n try {\n const now = Date.now();\n const countRes = await sqlite.execute({\n sql:\n `SELECT COUNT(*) FROM ${LOG_TABLE} WHERE success = 1 AND created_at > ?`,\n args: [now - windowMs],\n });\n const count = Number(countRes.rows?.[0]?.[0] ?? 0);\n if (count < threshold) return;\n\n // Atomic debounce: ensure a row exists, then only the request that moves\n // last_alert_at past the cooldown actually sends.\n await sqlite.execute({\n sql:\n `INSERT OR IGNORE INTO ${ALERTS_TABLE} (kind, last_alert_at) VALUES ('raid', 0)`,\n args: [],\n });\n const claimed = await sqlite.execute({\n sql:\n `UPDATE ${ALERTS_TABLE} SET last_alert_at = ? WHERE kind = 'raid' AND last_alert_at < ?`,\n args: [now, now - cooldownMs],\n });\n if ((claimed.rowsAffected || 0) !== 1) return;\n\n await sendDiscordAlert(config.alertWebhookUrl, serverName, count, windowMs, threshold);\n } catch {\n // alerting is best-effort\n }\n}\n\nasync function sendDiscordAlert(\n webhookUrl: string,\n serverName: string,\n count: number,\n windowMs: number,\n threshold: number,\n): Promise {\n const windowMin = Math.round(windowMs / 60000);\n await fetch(webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({\n username: \"Verification Shield\",\n allowed_mentions: { parse: [] },\n embeds: [{\n title: \"⚠️ Possible verification raid\",\n description:\n `**${count}** accounts verified in the last **${windowMin} min** on **${serverName}** — above the alert threshold of ${threshold}. This may be a coordinated raid using farmed accounts (Turnstile can't catch those). Consider pausing verification or tightening server join settings.`,\n color: brand.embedColor,\n timestamp: new Date().toISOString(),\n }],\n }),\n });\n}\n\n/**\n * Have the bot post the verification message (branded embed + a link \"Verify\"\n * button) into the configured channel. Triggered manually (post-verify.ts),\n * not on a schedule. The bot needs Send Messages + Embed Links in that channel.\n */\nexport async function postVerifyMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"verify\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No verify channel. Run setup.ts to create the DMZ channels, or set DISCORD_VERIFY_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n if (!config.portalUrl) {\n return {\n ok: false,\n detail: \"Set VERIFY_PORTAL_URL (or VERIFY_REDIRECT_URI) to the portal URL.\",\n };\n }\n const serverName = displayName(config);\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n\n const payload = {\n embeds: [{\n title: \"Server Verification\",\n description:\n `Welcome to **${serverName}**! To keep the community safe from bots and raids, new members verify before getting access.\\n\\nClick **Verify** below, complete a quick CAPTCHA, and your role is granted automatically.`,\n color: brand.embedColor,\n image: { url: `${base}/og.png` },\n }],\n components: [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"verify\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the server rules as a branded embed into the configured\n * channel. Triggered manually (post-rules.ts). The bot needs Send Messages\n * + Embed Links in that channel.\n */\nexport async function postRulesMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"rules\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No rules channel. Run setup.ts to create the DMZ channels, or set DISCORD_RULES_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n\n const serverName = displayName(config);\n\n const payload = {\n embeds: [{\n title: \"Discord Rules\",\n description:\n \"Our hope is that we rarely need to enforce these, but it's to everyone's benefit to be clear about who we are and what we expect. The mod team will enforce these rules as necessary.\",\n color: brand.embedColor,\n thumbnail: { url: brand.logoUrl },\n fields: rules,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"rules\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the \"About the community\" embed into a DMZ channel — one an\n * unverified member can see — so newcomers know what they're joining before\n * they verify. Triggered manually (post-about.ts). Pulls links to the verify +\n * rules channels (as #mentions) when those IDs are set, and adds a Verify\n * button when VERIFY_PORTAL_URL is configured. The bot needs Send Messages +\n * Embed Links in that channel.\n */\nexport async function postAboutMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"about\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No about channel. Run setup.ts to create the DMZ channels, or set DISCORD_ABOUT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const serverName = displayName(config);\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n\n // Point newcomers at the next step. Prefer channel mentions; fall back to a\n // plain instruction when those IDs aren't configured.\n const pointers: string[] = [];\n if (verifyId) pointers.push(`Ready? Verify in <#${verifyId}> to unlock the server.`);\n if (rulesId) pointers.push(`Read the rules in <#${rulesId}> first.`);\n\n const fields = [...about.highlights];\n if (pointers.length) {\n fields.push({ name: \"👉 Getting in\", value: pointers.join(\"\\n\") });\n }\n\n const embed: Record = {\n title: `About ${serverName}`,\n description: `*${about.tagline}*\\n\\n${about.description}`,\n color: brand.embedColor,\n thumbnail: { url: brand.logoUrl },\n fields,\n footer: { text: serverName },\n };\n\n const payload: Record = {\n embeds: [embed],\n allowed_mentions: { parse: [] },\n };\n // When we know the portal URL, give the About card its own Verify button so\n // the DMZ has a one-click path in.\n if (config.portalUrl) {\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n payload.components = [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }];\n }\n\n return await upsertMessage(\"about\", channelId, config, payload, opts);\n}\n\n// ========================================\n// CHANNEL + MESSAGE RESOLUTION\n// ========================================\n\nexport interface PostOpts {\n /** Override the resolved channel (raw ID, link, or #mention). */\n channelId?: string;\n /** Edit this specific message instead of the stored one. */\n messageId?: string;\n /** Always post a new message, ignoring any stored message ID. */\n forceNew?: boolean;\n}\n\n/** Extract a numeric channel ID from a raw ID, a #mention, or a channel link. */\nexport function parseChannelId(raw: string | undefined): string {\n if (!raw) return \"\";\n const t = raw.trim();\n const m = t.match(/channels\\/\\d+\\/(\\d+)/);\n return m ? m[1] : t.replace(/\\D/g, \"\");\n}\n\n/** The env-derived channel field on config for a given DMZ message kind. */\nfunction channelEnvField(\n config: VerifyConfig,\n kind: ChannelKind,\n): string | undefined {\n switch (kind) {\n case \"about\":\n return config.aboutChannelId;\n case \"rules\":\n return config.rulesChannelId;\n case \"verify\":\n return config.verifyChannelId;\n case \"honeypot\":\n return config.honeypotChannelId;\n }\n}\n\n/**\n * Resolve a DMZ channel ID in priority order:\n * 1. an explicit override (e.g. opts.channelId)\n * 2. a channel the bot created (blob store)\n * 3. the env var (config field)\n * Returns \"\" when none is known.\n */\nexport async function resolveChannel(\n kind: ChannelKind,\n config: VerifyConfig,\n explicit?: string,\n): Promise {\n const direct = parseChannelId(explicit);\n if (direct) return direct;\n const stored = await getChannel(kind);\n if (stored) return stored;\n return parseChannelId(channelEnvField(config, kind));\n}\n\n/**\n * Post `payload` into `channelId`, or EDIT the message we last posted for this\n * kind — so re-running a post tool updates in place instead of duplicating.\n * Which message to edit: opts.messageId, else the stored id (unless\n * opts.forceNew). A stored-but-deleted message (404) falls back to a fresh\n * post. Remembers the resulting channel + message IDs in the blob store.\n */\nasync function upsertMessage(\n kind: ChannelKind,\n channelId: string,\n config: VerifyConfig,\n payload: Record,\n opts: PostOpts,\n): Promise<{ ok: boolean; detail: string }> {\n const headers = {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n const targetId = opts.messageId ??\n (opts.forceNew ? undefined : await getMessage(kind));\n\n if (targetId) {\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages/${targetId}`,\n { method: \"PATCH\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n await rememberMessage(kind, targetId);\n await rememberChannel(kind, channelId);\n return {\n ok: true,\n detail: `updated message ${targetId} in channel ${channelId}`,\n };\n }\n // A 404 means the stored message was deleted — fall through to a fresh post.\n if (res.status !== 404) {\n return {\n ok: false,\n detail:\n `Discord ${res.status} editing message ${targetId} in channel ${channelId}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n }\n\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages`,\n { method: \"POST\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n const msg = await res.json().catch(() => ({} as { id?: string }));\n if (msg?.id) await rememberMessage(kind, String(msg.id));\n await rememberChannel(kind, channelId);\n return {\n ok: true,\n detail: `posted to channel ${channelId}${msg?.id ? ` (message ${msg.id})` : \"\"}`,\n };\n }\n return {\n ok: false,\n detail:\n `Discord ${res.status} posting to channel ${channelId}: ${(await res.text()).slice(0, 200)} — check the ID is correct and the bot can view + post in that channel.`,\n };\n}\n\n/**\n * Have the bot post a \"do not post here\" warning into a honeypot/trap channel,\n * pointing legit users to verification (and the rules). Bots that auto-spam\n * every channel reveal themselves here. Triggered manually (post-honeypot.ts).\n * The verify/rules links use channel mentions resolved from the existing\n * DISCORD_VERIFY_CHANNEL_ID / DISCORD_RULES_CHANNEL_ID.\n */\nexport async function postHoneypotMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"honeypot\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No honeypot channel. Run setup.ts to create the DMZ channels, or set DISCORD_HONEYPOT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n const serverName = displayName(config);\n\n const lines = [\"**Please do not post in this channel.**\", \"\"];\n lines.push(\n verifyId\n ? `To unlock ${serverName}, head to <#${verifyId}> and complete verification.`\n : `To unlock ${serverName}, complete verification in the verification channel.`,\n );\n if (rulesId) lines.push(`New here? Read the rules in <#${rulesId}>.`);\n lines.push(\"\", \"This channel is monitored — anything posted here may be treated as spam.\");\n\n const payload = {\n embeds: [{\n title: \"Do Not Post In This Channel\",\n description: lines.join(\"\\n\"),\n color: brand.embedColor,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"honeypot\", channelId, config, payload, opts);\n}\n\n// ========================================\n// RENDERING\n// ========================================\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nconst DISCORD_GLYPH =\n ``;\n\nfunction shell(name: string, innerHtml: string, ogImage: string): string {\n return `\n\n\n \n \n \n Verify · ${escapeHtml(name)}\n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n

\n ${innerHtml}\n

\n\n`;\n}\n\n// The portal page is identical for every visitor (depends only on static\n// config), so build it once per config and reuse the string.\nconst portalPageCache = new Map();\n\nexport function renderPortalPage(config: VerifyConfig, ogImage: string): string {\n const serverName = displayName(config);\n const cacheKey = `${config.turnstileSiteKey}|${serverName}|${ogImage}`;\n const cached = portalPageCache.get(cacheKey);\n if (cached) return cached;\n const inner = `\n $\"${escapeHtml(serverName)}\"$ \n

Are you human?

${escapeHtml(serverName)} · Access Check

1 Pass the CAPTCHA below
2 Authorize with Discord
3 Receive your verified role

\n \n

Protected by Cloudflare Turnstile

\n \n `;\n const html = shell(serverName, inner, ogImage);\n portalPageCache.set(cacheKey, html);\n return html;\n}\n\nexport function renderResultPage(success: boolean, message: string): string {\n const inner = `\n

${success ? \"✓\" : \"✕\"}

${success ? \"Verified\" : \"Verification failed\"}

${escapeHtml(message)}

\n ${success ? \"\" : `

Start Over

`}`;\n return shell(brand.name, inner, brand.ogFallbackImage);\n}\n\n// ========================================\n// RESPONSE HELPERS\n// ========================================\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction htmlResponse(body: string, status = 200): Response {\n return new Response(body, {\n status,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\nfunction redirectUriFor(config: VerifyConfig, url: URL): string {\n return config.redirectUriOverride ?? `${url.origin}/callback`;\n}\n\n// ========================================\n// ROUTE HANDLERS\n// ========================================\n\nasync function handleStart(\n req: Request,\n url: URL,\n config: VerifyConfig,\n): Promise {\n let token = \"\";\n try {\n const body = await req.json();\n token = String(body?.token ?? \"\");\n } catch {\n return jsonResponse({ error: \"Bad request.\" }, 400);\n }\n if (!token) {\n return jsonResponse({ error: \"Please complete the CAPTCHA first.\" }, 400);\n }\n\n const ok = await verifyTurnstile(\n config.turnstileSecretKey,\n token,\n req.headers.get(\"cf-connecting-ip\"),\n );\n if (!ok) {\n return jsonResponse({ error: \"CAPTCHA check failed. Please try again.\" }, 400);\n }\n\n const state = await mintState();\n const authUrl = new URL(\"https://discord.com/oauth2/authorize\");\n authUrl.searchParams.set(\"client_id\", config.clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUriFor(config, url));\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", \"identify\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"prompt\", \"consent\");\n\n return jsonResponse({ url: authUrl.toString() });\n}\n\nasync function handleCallback(\n url: URL,\n config: VerifyConfig,\n): Promise {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const oauthError = url.searchParams.get(\"error\");\n\n if (oauthError) {\n return htmlResponse(renderResultPage(false, \"Discord authorization was cancelled.\"));\n }\n if (!code || !state) {\n return htmlResponse(renderResultPage(false, \"Missing authorization data. Please start over.\"));\n }\n\n const consumed = await consumeState(state);\n if (!consumed.ok) {\n return htmlResponse(renderResultPage(false, consumed.reason));\n }\n\n const accessToken = await exchangeCode(config, code, redirectUriFor(config, url));\n if (!accessToken) {\n return htmlResponse(renderResultPage(false, \"Could not authenticate with Discord. Please start over.\"));\n }\n\n const user = await fetchDiscordUser(accessToken);\n if (!user) {\n return htmlResponse(renderResultPage(false, \"Could not read your Discord profile. Please start over.\"));\n }\n\n const { status, body, code: errorCode } = await grantRole(config, user.id);\n\n if (status === 204) {\n await logVerification(user, true, \"role granted\");\n await maybeAlertRaid(config, displayName(config));\n const name = user.username ? `, ${user.username}` : \"\";\n return htmlResponse(\n renderResultPage(\n true,\n `You're all set${name}! Head back to Discord — your verified role has been granted. You can close this tab.`,\n ),\n );\n }\n\n // Record the precise failure for diagnostics (Discord error codes:\n // 10004 Unknown Guild, 10007 Unknown Member, 10011 Unknown Role,\n // 50013 Missing Permissions, 50001 Missing Access).\n await logVerification(\n user,\n false,\n `role grant failed: status=${status} code=${errorCode ?? \"?\"} body=${body.slice(0, 400)}`,\n );\n\n // Only a genuine \"Unknown Member\" means the user must join first.\n if (status === 404 && errorCode === 10007) {\n return htmlResponse(\n renderResultPage(false, \"You're not in the server yet. Join the Discord first, then come back and verify.\"),\n );\n }\n // Everything else is a server-side configuration problem.\n let adminMessage = \"Couldn't assign your role. The verification bot is misconfigured — please contact a moderator.\";\n if (errorCode === 10004) {\n adminMessage = \"The verification bot isn't connected to this server yet. Please contact a moderator.\";\n } else if (errorCode === 10011) {\n adminMessage = \"The verified role no longer exists or is misconfigured. Please contact a moderator.\";\n } else if (status === 403 || errorCode === 50013 || errorCode === 50001) {\n adminMessage = \"The bot doesn't have permission to grant the role (check its permissions and role position). Please contact a moderator.\";\n }\n return htmlResponse(renderResultPage(false, adminMessage));\n}\n\n// ========================================\n// PUBLIC ENTRY POINT\n// ========================================\n\nexport async function handleVerifyRequest(\n req: Request,\n config: VerifyConfig,\n): Promise {\n const url = new URL(req.url);\n\n try {\n if (req.method === \"GET\" && url.pathname === \"/\") {\n return new Response(renderPortalPage(config, `${url.origin}/og.png`), {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"public, max-age=3600\",\n },\n });\n }\n if (req.method === \"GET\" && url.pathname === \"/og.png\") {\n try {\n const { readVerifyOgImage } = await import(\"./og.ts\");\n const png = await readVerifyOgImage();\n if (png) {\n // A Uint8Array is a valid BodyInit at runtime; the cast satisfies the\n // DOM lib's narrower BufferSource typing.\n return new Response(png as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400, immutable\",\n },\n });\n }\n } catch (e) {\n console.error(\"og read failed:\", e);\n }\n // Not generated yet (the cron builds it) — fall back to the brand image.\n return new Response(null, {\n status: 302,\n headers: { location: brand.ogFallbackImage },\n });\n }\n if (req.method === \"POST\" && url.pathname === \"/start\") {\n return await handleStart(req, url, config);\n }\n if (req.method === \"GET\" && url.pathname === \"/callback\") {\n return await handleCallback(url, config);\n }\n return htmlResponse(renderResultPage(false, \"Page not found.\"), 404);\n } catch (e) {\n console.error(\"verify error:\", e);\n return htmlResponse(\n renderResultPage(false, \"Something went wrong on our end. Please try again later.\"),\n 500,\n );\n }\n}\n",[158],"cc177afb-267a-48a6-a22b-a37ff025340b","deno.json","f329fa10-668d-11f1-befe-1607ee4eb77e",48,true,["D",1781289527448],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/98f62cee78e85bfc47c62ed703777c6bc8794f1c/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}\n",[165],"a4439ead-64d7-4a0e-b4dd-70e7a6fe5fdb","cron.ts","f2d5c9ae-668d-11f1-9138-1607ee4eb77e",35,["D",1781289527562],"interval","// ============================================================================\n// Discord CAPTCHA Shield — data cleanup + OG card refresh (Val Town Cron)\n// ============================================================================\n//\n// Set this file as the val's Cron trigger (daily is plenty). It prunes\n// ephemeral state nonces, ages out the verification audit log, and regenerates\n// the social card. Card generation is heavy (satori + resvg cold loads) and\n// exceeds an HTTP request's wall-clock, so it lives here where the cron runs to\n// completion; the /og.png route only serves the cached blob.\n// ============================================================================\n\nimport { cleanupVerifyData } from \"./mod.ts\";\nimport { refreshVerifyOgImage } from \"./og.ts\";\n\nconst LOG_RETENTION_DAYS = 7;\n\nexport default async function () {\n const result = await cleanupVerifyData(LOG_RETENTION_DAYS);\n console.log(\n `verify cleanup: deleted ${result.states} state nonce(s), ${result.logs} log row(s) older than ${LOG_RETENTION_DAYS}d`,\n );\n\n try {\n const bytes = await refreshVerifyOgImage();\n console.log(`verify og.png refreshed: ${bytes} bytes`);\n } catch (e) {\n console.error(\"verify og refresh failed:\", e);\n }\n}\n",[173],"4746fa3d-ea03-4489-99da-fd7418c3594d","channels.ts","f2f643a0-668d-11f1-bf75-1607ee4eb77e",40,["D",1781289527441],"/**\n * One-shot creation of the DMZ channels the shield posts into.\n *\n * Run via setup.ts. Creates a category + four text channels (about, rules,\n * verify, honeypot) with sensible @everyone permission overwrites, and stores\n * every ID in the blob store so the post tools find them automatically and the\n * run is idempotent (re-running skips channels that still exist).\n *\n * Requires the bot to have **Manage Channels** (in addition to the permissions\n * the rest of the shield needs). The shield never creates channels on its own —\n * only this explicit setup path does.\n */\n\nimport type { VerifyConfig } from \"./mod.ts\";\nimport {\n type ChannelKind,\n getCategory,\n getChannel,\n rememberCategory,\n rememberChannel,\n} from \"./store.ts\";\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\n\n// Discord permission bits (as strings, since they're 53-bit-safe here).\nconst VIEW_CHANNEL = 1 << 10; // 1024\nconst SEND_MESSAGES = 1 << 11; // 2048\nconst EMBED_LINKS = 1 << 14; // 16384\n\nconst CHANNEL_TYPE_TEXT = 0;\nconst CHANNEL_TYPE_CATEGORY = 4;\nconst OVERWRITE_ROLE = 0;\nconst OVERWRITE_MEMBER = 1;\n\ninterface ChannelSpec {\n kind: ChannelKind;\n name: string;\n topic: string;\n /** Honeypot lets @everyone post (that's the trap); the rest are read-only. */\n everyoneCanSend: boolean;\n}\n\nconst DMZ_CHANNELS: ChannelSpec[] = [\n {\n kind: \"about\",\n name: \"about\",\n topic: \"What this community is about. Read before you verify.\",\n everyoneCanSend: false,\n },\n {\n kind: \"rules\",\n name: \"rules\",\n topic: \"The server rules. By being here you agree to them.\",\n everyoneCanSend: false,\n },\n {\n kind: \"verify\",\n name: \"verify\",\n topic: \"Click Verify, pass a quick CAPTCHA, and the server unlocks.\",\n everyoneCanSend: false,\n },\n {\n kind: \"honeypot\",\n name: \"do-not-post\",\n topic: \"Do not post here. This channel is a spam trap.\",\n everyoneCanSend: true,\n },\n];\n\nconst CATEGORY_NAME = \"Welcome\";\n\nexport interface CreateResult {\n kind: ChannelKind | \"category\";\n name: string;\n status: \"created\" | \"exists\" | \"failed\";\n id?: string;\n detail?: string;\n}\n\nfunction authHeaders(config: VerifyConfig): HeadersInit {\n return {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n}\n\n/** True if a channel with this ID still exists and the bot can see it. */\nasync function channelExists(config: VerifyConfig, id: string): Promise {\n const res = await fetch(`${DISCORD_API}/channels/${id}`, {\n headers: authHeaders(config),\n });\n return res.ok;\n}\n\n/** Overwrites that make a channel visible to everyone but writable only by the\n * bot (read-only), or writable by everyone (the honeypot trap). The bot always\n * keeps an explicit allow so a read-only @everyone deny can't mute it. */\nfunction overwritesFor(config: VerifyConfig, everyoneCanSend: boolean) {\n const everyoneAllow = VIEW_CHANNEL | (everyoneCanSend ? SEND_MESSAGES : 0);\n const everyoneDeny = everyoneCanSend ? 0 : SEND_MESSAGES;\n return [\n {\n id: config.guildId, // @everyone role id == guild id\n type: OVERWRITE_ROLE,\n allow: String(everyoneAllow),\n deny: String(everyoneDeny),\n },\n {\n id: config.clientId, // a bot's user id == its application/client id\n type: OVERWRITE_MEMBER,\n allow: String(VIEW_CHANNEL | SEND_MESSAGES | EMBED_LINKS),\n deny: \"0\",\n },\n ];\n}\n\n/** Ensure the DMZ category exists; return its ID (or \"\" if creation failed). */\nasync function ensureCategory(\n config: VerifyConfig,\n results: CreateResult[],\n): Promise {\n const existing = await getCategory();\n if (existing && await channelExists(config, existing)) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"exists\",\n id: existing,\n });\n return existing;\n }\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify({ name: CATEGORY_NAME, type: CHANNEL_TYPE_CATEGORY }),\n });\n if (!res.ok) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n });\n return \"\";\n }\n const created = await res.json();\n await rememberCategory(created.id);\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"created\",\n id: created.id,\n });\n return created.id;\n}\n\n/** Create (or confirm) one DMZ channel, storing its ID in blob. */\nasync function ensureChannel(\n config: VerifyConfig,\n spec: ChannelSpec,\n parentId: string,\n): Promise {\n const existingId = await getChannel(spec.kind);\n if (existingId && await channelExists(config, existingId)) {\n return { kind: spec.kind, name: spec.name, status: \"exists\", id: existingId };\n }\n\n const body: Record = {\n name: spec.name,\n type: CHANNEL_TYPE_TEXT,\n topic: spec.topic,\n permission_overwrites: overwritesFor(config, spec.everyoneCanSend),\n };\n if (parentId) body.parent_id = parentId;\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify(body),\n });\n if (!res.ok) {\n return {\n kind: spec.kind,\n name: spec.name,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n const created = await res.json();\n await rememberChannel(spec.kind, created.id);\n return { kind: spec.kind, name: spec.name, status: \"created\", id: created.id };\n}\n\n/**\n * Create (or confirm) the DMZ category + channels, storing every ID in blob.\n * Idempotent: a channel already recorded and still present is left untouched.\n * The category is created first (channels nest under it); the channels then go\n * up concurrently — safe because each writes its own per-kind blob key.\n */\nexport async function createDmzChannels(\n config: VerifyConfig,\n): Promise {\n const results: CreateResult[] = [];\n const parentId = await ensureCategory(config, results);\n\n const channelResults = await Promise.all(\n DMZ_CHANNELS.map((spec) => ensureChannel(config, spec, parentId)),\n );\n results.push(...channelResults);\n return results;\n}\n",[181],"ff1b743d-25d4-4e7a-98d3-4039a2151f87","LICENSE","f2cfba00-668d-11f1-8d84-1607ee4eb77e",34,["D",1781289527444],"MIT License\n\nCopyright (c) 2026 catalloc\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",[188],"78e7f1cd-c6b6-40ee-838f-d72c1cb64a99",".gitignore","f2e6812c-668d-11f1-8d84-1607ee4eb77e",37,["D",1781289527671],"# Secrets — never commit these; set them as Val Town environment variables\n.env\n.env.local\n*.key\n*.pem\nsecrets.json\n\n# Val Town local state\n.vt/\n\n# Editor / OS\n.vscode/\n.idea/\n.DS_Store\n*.Identifier\n\n# Deno / Node\nnode_modules/\nvendor/\ndeno.lock\n",[195],"be765c6f-8517-40f1-8375-a56c0b5f1644",".git","f0e58c10-668d-11f1-84f3-1607ee4eb77e",1,["D",1781289524292],"directory",[202],"pulls","branches","forks","envVars",{"_215":59,"_217":59},"connections",{"_215":59,"_216":59},"count","unfilledCount","emptyCount",{"_41":201,"_31":202,"_29":203,"_135":-5,"_39":40,"_38":204,"_137":168,"_36":620,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":621,"_26":622},{"_41":615,"_31":570,"_29":564,"_135":203,"_39":40,"_38":616,"_137":168,"_36":617,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":618,"_26":619},{"_41":607,"_31":608,"_29":609,"_135":564,"_39":40,"_38":610,"_137":168,"_36":611,"_13":59,"_33":20,"_34":612,"_23":24,"_141":-5,"_274":613,"_26":614},{"_41":599,"_31":600,"_29":601,"_135":564,"_39":40,"_38":602,"_137":168,"_36":603,"_13":59,"_33":20,"_34":604,"_23":24,"_141":-5,"_274":605,"_26":606},{"_41":591,"_31":592,"_29":593,"_135":564,"_39":40,"_38":594,"_137":168,"_36":595,"_13":59,"_33":20,"_34":596,"_23":24,"_141":-5,"_274":597,"_26":598},{"_41":587,"_31":32,"_29":30,"_135":564,"_39":40,"_38":14,"_137":168,"_36":588,"_13":59,"_33":20,"_34":35,"_23":24,"_141":-5,"_274":589,"_26":590},{"_41":579,"_31":580,"_29":581,"_135":564,"_39":40,"_38":582,"_137":168,"_36":583,"_13":59,"_33":20,"_34":584,"_23":24,"_141":-5,"_274":585,"_26":586},{"_41":571,"_31":572,"_29":573,"_135":564,"_39":40,"_38":574,"_137":168,"_36":575,"_13":59,"_33":20,"_34":576,"_23":24,"_141":-5,"_274":577,"_26":578},{"_41":561,"_31":562,"_29":563,"_135":564,"_39":40,"_38":565,"_137":168,"_36":566,"_13":59,"_33":20,"_34":567,"_23":24,"_141":-5,"_274":568,"_26":569},{"_41":556,"_31":363,"_29":550,"_135":203,"_39":40,"_38":557,"_137":168,"_36":558,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":559,"_26":560},{"_41":547,"_31":548,"_29":549,"_135":550,"_39":40,"_38":551,"_137":168,"_36":552,"_13":59,"_33":20,"_34":553,"_23":24,"_141":-5,"_274":554,"_26":555},{"_41":542,"_31":523,"_29":517,"_135":203,"_39":40,"_38":543,"_137":168,"_36":544,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":545,"_26":546},{"_41":537,"_31":333,"_29":532,"_135":517,"_39":40,"_38":538,"_137":168,"_36":539,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":540,"_26":541},{"_41":531,"_31":342,"_29":526,"_135":532,"_39":40,"_38":533,"_137":168,"_36":534,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":535,"_26":536},{"_41":524,"_31":83,"_29":525,"_135":526,"_39":40,"_38":527,"_137":168,"_36":528,"_13":59,"_33":20,"_34":520,"_23":24,"_141":-5,"_274":529,"_26":530},{"_41":515,"_31":310,"_29":516,"_135":517,"_39":40,"_38":518,"_137":168,"_36":519,"_13":59,"_33":20,"_34":520,"_23":24,"_141":-5,"_274":521,"_26":522},{"_41":510,"_31":361,"_29":356,"_135":203,"_39":40,"_38":511,"_137":168,"_36":512,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":513,"_26":514},{"_41":503,"_31":504,"_29":505,"_135":356,"_39":40,"_38":506,"_137":168,"_36":507,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":508,"_26":509},{"_41":496,"_31":497,"_29":498,"_135":356,"_39":40,"_38":499,"_137":168,"_36":500,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":501,"_26":502},{"_41":489,"_31":490,"_29":491,"_135":356,"_39":40,"_38":492,"_137":168,"_36":493,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":494,"_26":495},{"_41":482,"_31":483,"_29":484,"_135":356,"_39":40,"_38":485,"_137":168,"_36":486,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":487,"_26":488},{"_41":475,"_31":476,"_29":477,"_135":356,"_39":40,"_38":478,"_137":168,"_36":479,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":480,"_26":481},{"_41":468,"_31":469,"_29":470,"_135":356,"_39":40,"_38":471,"_137":168,"_36":472,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":473,"_26":474},{"_41":461,"_31":462,"_29":463,"_135":356,"_39":40,"_38":464,"_137":168,"_36":465,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":466,"_26":467},{"_41":456,"_31":455,"_29":449,"_135":356,"_39":40,"_38":457,"_137":168,"_36":458,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":459,"_26":460},{"_41":446,"_31":447,"_29":448,"_135":449,"_39":40,"_38":450,"_137":168,"_36":451,"_13":59,"_33":20,"_34":452,"_23":24,"_141":-5,"_274":453,"_26":454},{"_41":439,"_31":440,"_29":441,"_135":356,"_39":40,"_38":442,"_137":168,"_36":443,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":444,"_26":445},{"_41":432,"_31":433,"_29":434,"_135":356,"_39":40,"_38":435,"_137":168,"_36":436,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":437,"_26":438},{"_41":425,"_31":426,"_29":427,"_135":356,"_39":40,"_38":428,"_137":168,"_36":429,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":430,"_26":431},{"_41":418,"_31":419,"_29":420,"_135":356,"_39":40,"_38":421,"_137":168,"_36":422,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":423,"_26":424},{"_41":411,"_31":412,"_29":413,"_135":356,"_39":40,"_38":414,"_137":168,"_36":415,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":416,"_26":417},{"_41":404,"_31":405,"_29":406,"_135":356,"_39":40,"_38":407,"_137":168,"_36":408,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":409,"_26":410},{"_41":397,"_31":398,"_29":399,"_135":356,"_39":40,"_38":400,"_137":168,"_36":401,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":402,"_26":403},{"_41":390,"_31":391,"_29":392,"_135":356,"_39":40,"_38":393,"_137":168,"_36":394,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":395,"_26":396},{"_41":383,"_31":384,"_29":385,"_135":356,"_39":40,"_38":386,"_137":168,"_36":387,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":388,"_26":389},{"_41":376,"_31":377,"_29":378,"_135":356,"_39":40,"_38":379,"_137":168,"_36":380,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":381,"_26":382},{"_41":369,"_31":370,"_29":371,"_135":356,"_39":40,"_38":372,"_137":168,"_36":373,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":374,"_26":375},{"_41":362,"_31":363,"_29":364,"_135":356,"_39":40,"_38":365,"_137":168,"_36":366,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":367,"_26":368},{"_41":353,"_31":354,"_29":355,"_135":356,"_39":40,"_38":357,"_137":168,"_36":358,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":359,"_26":360},{"_41":348,"_31":333,"_29":328,"_135":203,"_39":40,"_38":349,"_137":168,"_36":350,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":351,"_26":352},{"_41":343,"_31":342,"_29":336,"_135":328,"_39":40,"_38":344,"_137":168,"_36":345,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":346,"_26":347},{"_41":334,"_31":83,"_29":335,"_135":336,"_39":40,"_38":337,"_137":168,"_36":338,"_13":59,"_33":20,"_34":339,"_23":24,"_141":-5,"_274":340,"_26":341},{"_41":325,"_31":326,"_29":327,"_135":328,"_39":40,"_38":329,"_137":168,"_36":330,"_13":59,"_33":206,"_34":-5,"_23":24,"_141":-5,"_274":331,"_26":332},{"_41":317,"_31":318,"_29":319,"_135":203,"_39":40,"_38":320,"_137":168,"_36":321,"_13":59,"_33":20,"_34":322,"_23":24,"_141":-5,"_274":323,"_26":324},{"_41":309,"_31":310,"_29":311,"_135":203,"_39":40,"_38":312,"_137":168,"_36":313,"_13":59,"_33":20,"_34":314,"_23":24,"_141":-5,"_274":315,"_26":316},{"_41":301,"_31":302,"_29":303,"_135":203,"_39":40,"_38":304,"_137":168,"_36":305,"_13":59,"_33":20,"_34":306,"_23":24,"_141":-5,"_274":307,"_26":308},{"_41":194,"_31":195,"_29":196,"_135":-5,"_39":40,"_38":197,"_137":168,"_36":298,"_13":59,"_33":20,"_34":199,"_23":24,"_141":-5,"_274":299,"_26":300},{"_41":187,"_31":188,"_29":189,"_135":-5,"_39":40,"_38":190,"_137":168,"_36":295,"_13":59,"_33":20,"_34":192,"_23":24,"_141":-5,"_274":296,"_26":297},{"_41":180,"_31":181,"_29":182,"_135":-5,"_39":40,"_38":183,"_137":24,"_36":292,"_13":59,"_33":139,"_34":185,"_23":24,"_141":-5,"_274":293,"_26":294},{"_41":172,"_31":173,"_29":174,"_135":-5,"_39":40,"_38":175,"_137":24,"_36":289,"_13":59,"_33":177,"_34":178,"_23":24,"_141":-5,"_274":290,"_26":291},{"_41":164,"_31":165,"_29":166,"_135":-5,"_39":40,"_38":167,"_137":168,"_36":286,"_13":59,"_33":20,"_34":170,"_23":24,"_141":-5,"_274":287,"_26":288},{"_41":157,"_31":158,"_29":159,"_135":-5,"_39":40,"_38":160,"_137":24,"_36":283,"_13":59,"_33":139,"_34":162,"_23":24,"_141":-5,"_274":284,"_26":285},{"_41":150,"_31":151,"_29":152,"_135":-5,"_39":40,"_38":153,"_137":24,"_36":280,"_13":59,"_33":139,"_34":155,"_23":24,"_141":-5,"_274":281,"_26":282},{"_41":143,"_31":144,"_29":145,"_135":-5,"_39":40,"_38":146,"_137":24,"_36":277,"_13":59,"_33":139,"_34":148,"_23":24,"_141":-5,"_274":278,"_26":279},{"_41":132,"_31":133,"_29":134,"_135":-5,"_39":40,"_38":136,"_137":24,"_36":273,"_13":59,"_33":139,"_34":140,"_23":24,"_141":-5,"_274":275,"_26":276},["D",1781289527438],"children",[],[133],["D",1781289527432],[],[144],["D",1781289527593],[],[151],["D",1781289527691],[],[158],["D",1781289527448],[],[165],["D",1781289527562],[],[173],["D",1781289527441],[],[181],["D",1781289527444],[],[188],["D",1781289527671],[],[195],"68756796-d50a-4ca7-8b72-6101a929af95","config","f3061fa0-668d-11f1-bf75-1607ee4eb77e",43,["D",1781289527877],"[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = false\n\tlogallrefupdates = true\n[remote \"origin\"]\n\turl = git@github.com:catalloc/discord-captcha-shield.git\n\tfetch = +refs/heads/*:refs/remotes/origin/*\n",[],[202,302],"20447dd9-ed12-4b41-b42f-c071593bc56b","HEAD","f3197b40-668d-11f1-bf75-1607ee4eb77e",46,["D",1781289527991],"ref: refs/heads/main\n",[],[202,310],"c3e87590-de2b-4560-9877-0181c1608273","COMMIT_EDITMSG","f35ace6a-668d-11f1-9138-1607ee4eb77e",54,["D",1781289527790],"Initial commit: Discord CAPTCHA Shield template\n\nA self-hostable CAPTCHA + Discord OAuth verification gate for Val Town.\nNew members solve a Cloudflare Turnstile CAPTCHA, authorize via Discord\n(identify scope), and a bot grants the Verified role.\n\nIncludes:\n- Portal + OAuth routes (http.ts), daily cleanup + OG card cron (cron.ts)\n- One-click DMZ bootstrap (setup.ts): bot creates the about/rules/verify/\n honeypot channels and posts every message\n- Per-key blob storage (store.ts) so post tools edit messages in place and\n setup posts concurrently\n- Raid alerts, audit log, dynamic social card\n- Single-file branding via theme.ts; README with full install guide\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n",[],[202,318],"261dc8ea-208c-4fed-ba41-2f4ecd45fedf","tags","f14c94d2-668d-11f1-84f3-1607ee4eb77e","f0f60360-668d-11f1-b249-1607ee4eb77e",8,["D",1781289524988],[],[202,333,326],"refs","e0a7603c-9e1f-4cde-9434-f671ca1d1d04","f2f18d4c-668d-11f1-9ab7-1607ee4eb77e","f1404754-668d-11f1-84f3-1607ee4eb77e",39,["D",1781289527732],"2f5f9232437b9da397467e05c22798a95a66f830\n",[],[202,333,342,83],"heads","ab3fc845-ea05-4515-9b9a-d0f31f7d8cb4",7,["D",1781289524906],[259],[202,333,342],"6d32b545-cba3-460c-91e9-b0f019b115ef",2,["D",1781289524416],[258,260],[202,333],"453f6ffb-ff9f-423f-8821-ebc5f1164704","pack","f17a4698-668d-11f1-b249-1607ee4eb77e","f105437a-668d-11f1-b68b-1607ee4eb77e",11,["D",1781289525287],[],[202,361,354],"objects","8983f4aa-0184-4fd3-9fad-6c6ff4512348","info","f207f330-668d-11f1-bfda-1607ee4eb77e",20,["D",1781289526212],[],[202,361,363],"43275c82-b244-46c3-be78-60065082bb32","e5","f16dd0f2-668d-11f1-b68b-1607ee4eb77e",10,["D",1781289525204],[],[202,361,370],"1d3b9d3a-41e1-4c49-9369-071a1b811284","d8","f217cca6-668d-11f1-bfda-1607ee4eb77e",21,["D",1781289526319],[],[202,361,377],"49a59a5c-1dc0-4fc2-aa35-edcfc4372191","d4","f235eb96-668d-11f1-b249-1607ee4eb77e",23,["D",1781289526509],[],[202,361,384],"ff7bb85e-ce20-4a25-bf35-d737a027b36d","d1","f1d7748a-668d-11f1-b7b6-1607ee4eb77e",17,["D",1781289525896],[],[202,361,391],"04a1e9da-0fcc-4227-ac5d-bd269e7e96f1","bd","f27d7e48-668d-11f1-84f3-1607ee4eb77e",28,["D",1781289526986],[],[202,361,398],"17c8169b-0642-4df8-a28d-8fed84e55170","a5","f1a9e7ea-668d-11f1-b249-1607ee4eb77e",14,["D",1781289525586],[],[202,361,405],"8c8b06ee-889a-4a8d-b02c-8ad2b34da028","99","f1580db2-668d-11f1-b68b-1607ee4eb77e",9,["D",1781289525063],[],[202,361,412],"46196381-57bf-4c1e-88c8-0f72133e2951","94","f1c6b00a-668d-11f1-b7b6-1607ee4eb77e",16,["D",1781289525788],[],[202,361,419],"1c295602-7354-4267-9958-129b8f1d5979","7e","f27255e0-668d-11f1-84f3-1607ee4eb77e",27,["D",1781289526897],[],[202,361,426],"406788c5-95be-4480-bb54-bf2957f628e4","73","f25e8cc2-668d-11f1-84f3-1607ee4eb77e",26,["D",1781289526784],[],[202,361,433],"cdb1f050-5cbb-49e5-9eed-99ffcf8cb173","6f","f289ca0e-668d-11f1-84f3-1607ee4eb77e",29,["D",1781289527068],[],[202,361,440],"868a8827-1df3-4934-8464-2055623e56af","4f1dc9a93d9d0c02c0b957ed86cacd50063dc9","f2fb6ccc-668d-11f1-9084-1607ee4eb77e","f1b92ce6-668d-11f1-b7b6-1607ee4eb77e",41,["D",1781289527796],"x\u0001�T�n�@\u0014��_1r{�U�(�T\u0002EU\n��@\u00054RO��\u000f��z��I��۵IPr��oޛ73�Z�5ο��pv��\u0013�\"��\u000e�P�} \u000b�(�!�3\u0018ɺ0�DR\t�\b\u0005g�vK6��\u0013��~��LD��HEHny��\u001c�m�D7\u0015YY`<꡸\u0013Z��=\u0018��\u0015i'��P\n�(h�L3Lw�T�>n��r��rry�#�\u0018��\u0005�\r\u000b6�+��\u001asbqn��Ŗ=��<�{�㼣��p\u0007\u001e\u0001}R\u0013#Y�ux\u000e��|�:*=��\u001dᖵ�<\r��-��^!��*S�S��\u0015O��ٹ\\?\u001c�\u0015\u0001ؖF�/�\u0012��.�it\u0011d��I��\b�j�u��E8�Wja�I��#��q�c(�Wa\"*�w<��\u0013�ꐽak�|E\u001cڿ�E��h\u001eK2�^hs�\u001a嘶x\u0014�D\u001f�c=�v�t�\u0001��L�m\u0012��܇;�\u001bV\u0001��E��oA��+-�\t��i�� }��#��w\u001f��C\u001fo�+/[�c�5V��<��QԮ�:3��\u0003%�v\"",[],[202,361,455,447],"6d","b2ce834d-8174-4e01-b284-9970a417a70a",15,["D",1781289525691],[243],[202,361,455],"3da80ccb-2eb8-43be-93e8-05fbe77bb83b","5d","f251ea9e-668d-11f1-b7b6-1607ee4eb77e",25,["D",1781289526701],[],[202,361,462],"30addad7-63dc-4b0b-ab0d-43c95775d7b9","5a","f1f6008a-668d-11f1-b7b6-1607ee4eb77e",19,["D",1781289526097],[],[202,361,469],"55902c88-4ded-4836-8000-d142b6ebb3d7","50","f2455dec-668d-11f1-b249-1607ee4eb77e",24,["D",1781289526617],[],[202,361,476],"b9392db2-82b3-4226-8723-9481ed9b52c0","39","f1901dec-668d-11f1-9228-1607ee4eb77e",12,["D",1781289525415],[],[202,361,483],"9b410a66-394b-47d9-802a-3e71d0fee8c7","38","f1e4f9ca-668d-11f1-b7b6-1607ee4eb77e",18,["D",1781289525987],[],[202,361,490],"10f4166b-3911-4750-8857-33df75b0a4e7","2f","f2263796-668d-11f1-bfda-1607ee4eb77e",22,["D",1781289526408],[],[202,361,497],"a6028611-b62c-44ed-b2e4-420d0008ba78","1e","f19abfc2-668d-11f1-9228-1607ee4eb77e",13,["D",1781289525501],[],[202,361,504],"ff63dd59-7707-44b7-9589-a093017a0efa",3,["D",1781289524514],[235,236,237,238,239,240,241,242,244,245,246,247,248,249,250,251,252,253,254,255,256],[202,361],"8691a00c-5a32-4490-9fc8-721850764554","f315167c-668d-11f1-9ab7-1607ee4eb77e","f11f0f8a-668d-11f1-b68b-1607ee4eb77e",45,["D",1781289527943],"0000000000000000000000000000000000000000 2f5f9232437b9da397467e05c22798a95a66f830 catalloc <80437062+catalloc@users.noreply.github.com> 1781289324 -0400\tcommit (initial): Initial commit: Discord CAPTCHA Shield template\n",[],[202,523,310],"logs","9254b389-b3e2-4813-8e37-176c5b1c144c","f30f250a-668d-11f1-9084-1607ee4eb77e","f2af6c96-668d-11f1-84f3-1607ee4eb77e",44,["D",1781289527922],[],[202,523,333,342,83],"99e8e0d7-467d-4ac1-a391-4a07c953caae","f29c48fa-668d-11f1-84f3-1607ee4eb77e",31,["D",1781289527310],[232],[202,523,333,342],"07ce5f94-6b8a-4fe2-8a0c-d8c3025814d8",30,["D",1781289527188],[231],[202,523,333],"b811d182-cf8b-44ac-bd93-1a21c79a6883",5,["D",1781289524687],[230,233],[202,523],"a7881e2c-ee16-48a8-be0b-696bd8787f0f","exclude","f3005e94-668d-11f1-9ab7-1607ee4eb77e","f1111d4e-668d-11f1-b68b-1607ee4eb77e",42,["D",1781289527827],"# git ls-files --others --exclude-from=.git/info/exclude\n# Lines that start with '#' are comments.\n# For a project mostly in C, the following would be a good set of\n# exclude patterns (uncomment them if you want to use them):\n# *.[oa]\n# *~\n",[],[202,363,548],"ee16ca23-3c5c-4bf2-9f08-20764efed1e2",4,["D",1781289524598],[228],[202,363],"e42e3f66-772a-40b7-bfc5-f098b4929ef5","push-to-checkout.sample","f34d6e64-668d-11f1-847c-1607ee4eb77e","f12e6dfe-668d-11f1-84f3-1607ee4eb77e",52,["D",1781289528314],"#!/bin/sh\n\n# An example hook script to update a checked-out tree on a git push.\n#\n# This hook is invoked by git-receive-pack(1) when it reacts to git\n# push and updates reference(s) in its repository, and when the push\n# tries to update the branch that is currently checked out and the\n# receive.denyCurrentBranch configuration variable is set to\n# updateInstead.\n#\n# By default, such a push is refused if the working tree and the index\n# of the remote repository has any difference from the currently\n# checked out commit; when both the working tree and the index match\n# the current commit, they are updated to match the newly pushed tip\n# of the branch. This hook is to be used to override the default\n# behaviour; however the code below reimplements the default behaviour\n# as a starting point for convenient modification.\n#\n# The hook receives the commit with which the tip of the current\n# branch is going to be updated:\ncommit=$1\n\n# It can exit with a non-zero status to refuse the push (when it does\n# so, it must not modify the index or the working tree).\ndie () {\n\techo >&2 \"$*\"\n\texit 1\n}\n\n# Or it can make any necessary changes to the working tree and to the\n# index to bring them to the desired state when the tip of the current\n# branch is updated to the new commit, and exit with a zero status.\n#\n# For example, the hook can simply run git read-tree -u -m HEAD \"$1\"\n# in order to emulate git fetch that is run in the reverse direction\n# with git push, as the two-tree form of git read-tree -u -m is\n# essentially the same as git switch or git checkout that switches\n# branches while keeping the local changes in the working tree that do\n# not interfere with the difference between the branches.\n\n# The below is a more-or-less exact translation to shell of the C code\n# for the default behaviour for git's push-to-checkout hook defined in\n# the push_to_deploy() function in builtin/receive-pack.c.\n#\n# Note that the hook will be executed from the repository directory,\n# not from the working tree, so if you want to perform operations on\n# the working tree, you will have to adapt your code accordingly, e.g.\n# by adding \"cd ..\" or using relative paths.\n\nif ! git update-index -q --ignore-submodules --refresh\nthen\n\tdie \"Up-to-date check failed\"\nfi\n\nif ! git diff-files --quiet --ignore-submodules --\nthen\n\tdie \"Working directory has unstaged changes\"\nfi\n\n# This is a rough translation of:\n#\n# head_has_history() ? \"HEAD\" : EMPTY_TREE_SHA1_HEX\nif git cat-file -e HEAD 2>/dev/null\nthen\n\thead=HEAD\nelse\n\thead=$(git hash-object -t tree --stdin \\).*$/Signed-off-by: \\1/p')\n# grep -qs \"^$SOB\" \"$1\" || echo \"$SOB\" >> \"$1\"\n\n# This example catches duplicate Signed-off-by lines.\n\ntest \"\" = \"$(grep '^Signed-off-by: ' \"$1\" |\n\t sort | uniq -c | sed -e '/^[ \t]*1[ \t]/d')\" || {\n\techo >&2 Duplicate Signed-off-by lines.\n\texit 1\n}\n",[],[202,570,600],"0e2a4d05-5854-464f-8148-b174b1c06df5","applypatch-msg.sample","f321bd28-668d-11f1-9245-1607ee4eb77e",47,["D",1781289528031],"#!/bin/sh\n#\n# An example hook script to check the commit log message taken by\n# applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit. The hook is\n# allowed to edit the commit message file.\n#\n# To enable this hook, rename this file to \"applypatch-msg\".\n\n. git-sh-setup\ncommitmsg=\"$(git rev-parse --git-path hooks/commit-msg)\"\ntest -x \"$commitmsg\" && exec \"$commitmsg\" ${1+\"$@\"}\n:\n",[],[202,570,608],"d80b0eca-1ee6-4307-9d88-d85d0828f8d7",6,["D",1781289524788],[220,221,222,223,224,225,226],[202,570],["D",1781289524292],[219,227,229,234,257,261,262,263],[202],["D",1781289523885],{"_93":92,"_100":96},{"_93":92,"_94":-5,"_95":96,"_18":53,"_97":98,"_99":24},{"_13":82,"_31":83,"_41":40,"_84":42,"_85":-5,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":43,"_91":92},"ctx",{"_75":-5,"_119":660,"_661":662,"_663":664,"_665":24,"_666":24,"_667":24,"_668":168,"_669":-5,"_670":-7,"_671":-7,"_672":59,"_673":24,"_674":24,"_675":-5,"_676":24,"_677":24,"_678":24,"_679":-5},"ENV",{"_631":632,"_633":634,"_635":83,"_636":637,"_638":639,"_640":641,"_642":643,"_644":645,"_646":647,"_648":649,"_650":651,"_652":653,"_654":655,"_656":657,"_658":659},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v55