[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_876":877,"_878":879},"routes/_app.x.$handle.$name",{"_94":93,"_32":44,"_102":84,"_27":52,"_13":14,"_103":-5,"_11":104,"_105":106,"_107":108,"_109":110,"_111":112,"_20":-5,"_113":-5,"_114":-5,"_115":25,"_116":117,"_118":119,"_120":-5,"_121":-5,"_122":123},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",92,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":20,"_34":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":20,"_34":35},"deleted",false,"deletedHere","path","HARDENING.md","latestPath","fileId","f4016d42-668d-11f1-8d84-1607ee4eb77e","name","fileType","content","# Verification Hardening — closing the gaps\n\nThe CAPTCHA shield is an **\"already-members\" gate**, and that model has known\nlimits. This doc explains exactly what it does and does not stop, and the options\nfor tightening it. None of this is required to run the shield — it works as-is —\nbut read it before relying on it as your only line of defense.\n\n## What the shield does\n\nA user joins the Discord → solves the CAPTCHA → Discord OAuth → the bot grants\nthe **Verified** role, which *unlocks* channels.\n\n- **Stops:** posting/participating in channels gated behind the Verified role\n (assuming `@everyone` is locked down).\n- **Does NOT stop (the gap):** a member who has *joined but not verified* can\n still (a) appear in / read the **member list** of any channel they can view,\n and (b) **DM** other members they share the server with.\n\nRoles gate *channel access*, not DMs or member-list visibility. Discord has **no\n\"cannot DM\" permission** — DMs are allowed between users who share a server\n(subject to each user's privacy settings + the server DM spam filter).\n\n## What actually restricts a joined user\n\nOnly two things meaningfully limit a joined-but-unverified user:\n\n1. **Membership Screening \"pending\" state** — Discord's native gate. New joins\n are \"pending\" until they complete screening; pending members **cannot DM\n other members or interact**. This is the real lever for the DM/member-list\n vector.\n2. **Hard channel-permission lockdown** — `@everyone` can view only a single\n `#verify` channel, so member-list exposure is limited to who can see that one\n channel. Still does not block DMs.\n\n## Options (with tradeoffs)\n\n### A. Server-config lockdown — do this regardless (little/no code)\n- `@everyone`: deny **View Channel** everywhere except one `#verify` channel;\n strip most perms. Verified role grants View on the real channels.\n- Stack native levers: raise **Verification Level** (Medium/High), enable\n **AutoMod** + **DM spam filter**, enable **Membership Screening** +\n **Onboarding**.\n- Limits member-list exposure; does not by itself stop DMs.\n\n### B. Membership Screening (the real DM blocker)\n- New joins are \"pending\" until they pass screening → can't DM/interact.\n- **Caveat:** native screening completion is \"agree to the rules\" (a client\n gesture a determined bot can automate), so it isn't bot-proof on its own. Pair\n it with the CAPTCHA: screening blocks DMs, the CAPTCHA blocks bots.\n\n### C. Gateway bot for join handling (quarantine + auto-kick)\n- React to `GUILD_MEMBER_ADD`: assign a **Quarantine** role (View denied\n everywhere except `#verify`) and auto-kick if unverified within N minutes.\n- Quarantine limits member-list exposure and the auto-kick shrinks the DM\n window, but does **not** fully block DMs (mutual server).\n- **Cost:** needs a persistent gateway (WebSocket) connection. **Val Town is\n serverless and not suited to an always-on gateway.** You'd need a separate\n always-on host (a small VPS, Fly/Railway, a Cloudflare Durable Object with a\n gateway lib, or a hosted bot framework). The CAPTCHA portal can stay on Val\n Town as the unlock step. Requires the **GUILD_MEMBERS** privileged intent.\n\n### D. Combine (recommended target)\n- Membership Screening / Onboarding holds joiners pending (blocks DMs +\n member-list) and routes them to the CAPTCHA portal; the bot grants Verified\n after CAPTCHA.\n\n## A quick win available now\n\nOn successful verify, also **remove** an \"Unverified\"/\"Quarantine\" role (not just\nadd Verified): add a `DISCORD_UNVERIFIED_ROLE_ID` env var and a `DELETE\n/guilds/{guild}/members/{user}/roles/{roleId}` call on success in `mod.ts`.\n(Auto-*assigning* that role on join still needs a gateway bot or an Onboarding\ndefault role.)\n","# Verification Hardening — closing the gaps\n\nThe CAPTCHA shield is an **\"already-members\" gate**, and that model has known\nlimits. This doc explains exactly what it does and does not stop, and the options\nfor tightening it. None of this is required to run the shield — it works as-is —\nbut read it before relying on it as your only line of defense.\n\n## What the shield does\n\nA user joins the Discord → solves the CAPTCHA → Discord OAuth → the bot grants\nthe **Verified** role, which *unlocks* channels.\n\n- **Stops:** posting/participating in channels gated behind the Verified role\n (assuming `@everyone` is locked down).\n- **Does NOT stop (the gap):** a member who has *joined but not verified* can\n still (a) appear in / read the **member list** of any channel they can view,\n and (b) **DM** other members they share the server with.\n\nRoles gate *channel access*, not DMs or member-list visibility. Discord has **no\n\"cannot DM\" permission** — DMs are allowed between users who share a server\n(subject to each user's privacy settings + the server DM spam filter).\n\n## What actually restricts a joined user\n\nOnly two things meaningfully limit a joined-but-unverified user:\n\n1. **Membership Screening \"pending\" state** — Discord's native gate. New joins\n are \"pending\" until they complete screening; pending members **cannot DM\n other members or interact**. This is the real lever for the DM/member-list\n vector.\n2. **Hard channel-permission lockdown** — `@everyone` can view only a single\n `#verify` channel, so member-list exposure is limited to who can see that one\n channel. Still does not block DMs.\n\n## Options (with tradeoffs)\n\n### A. Server-config lockdown — do this regardless (little/no code)\n- `@everyone`: deny **View Channel** everywhere except one `#verify` channel;\n strip most perms. Verified role grants View on the real channels.\n- Stack native levers: raise **Verification Level** (Medium/High), enable\n **AutoMod** + **DM spam filter**, enable **Membership Screening** +\n **Onboarding**.\n- Limits member-list exposure; does not by itself stop DMs.\n\n### B. Membership Screening (the real DM blocker)\n- New joins are \"pending\" until they pass screening → can't DM/interact.\n- **Caveat:** native screening completion is \"agree to the rules\" (a client\n gesture a determined bot can automate), so it isn't bot-proof on its own. Pair\n it with the CAPTCHA: screening blocks DMs, the CAPTCHA blocks bots.\n\n### C. Gateway bot for join handling (quarantine + auto-kick)\n- React to `GUILD_MEMBER_ADD`: assign a **Quarantine** role (View denied\n everywhere except `#verify`) and auto-kick if unverified within N minutes.\n- Quarantine limits member-list exposure and the auto-kick shrinks the DM\n window, but does **not** fully block DMs (mutual server).\n- **Cost:** needs a persistent gateway (WebSocket) connection. **Val Town is\n serverless and not suited to an always-on gateway.** You'd need a separate\n always-on host (a small VPS, Fly/Railway, a Cloudflare Durable Object with a\n gateway lib, or a hosted bot framework). The CAPTCHA portal can stay on Val\n Town as the unlock step. Requires the **GUILD_MEMBERS** privileged intent.\n\n### D. Combine (recommended target)\n- Membership Screening / Onboarding holds joiners pending (blocks DMs +\n member-list) and routes them to the CAPTCHA portal; the bot grants Verified\n after CAPTCHA.\n\n## A quick win available now\n\nOn successful verify, also **remove** an \"Unverified\"/\"Quarantine\" role (not just\nadd Verified): add an `unverifiedRoleId` field to the per-server config (a column\nin `captcha_guilds` + the admin API, alongside `roleId`) and a `DELETE\n/guilds/{guild}/members/{user}/roles/{roleId}` call on success in `mod.ts`. Keep\nit per-server, not an env var, so each shielded server can use its own quarantine\nrole. (Auto-*assigning* that role on join still needs a gateway bot or an\nOnboarding default role.)\n","createdAt",["D",1781305586310],"branchVersion","branchId","92e19ade-ba2c-4861-a1cb-538d4dba0795","id","de13bec5-73e7-4691-ae8a-0dbe38e57ea0","discord-captcha-shield",["D",1781289523885],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","d06b6c80-f3a1-11ef-89a3-8735e07158f4","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","e03963fb-ecc4-48fb-bc25-0173a8b9a8c8","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_101":97},"org",{"_94":93,"_95":-5,"_96":97,"_18":54,"_98":99,"_100":25},"branch",{"_13":83,"_32":84,"_42":41,"_85":43,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":44,"_92":93},"isOwned",101,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","catalloc","handle","displayName","avatar","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/0478d851-5bca-4d5e-6593-fb952af01c00/square512?exp=1789545599&sig=72e7cb91f4eb2c7525dc7f353cbf4f0b8ddb0a712ccb4f1bf955fdca29b8410c","tier","pro","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_42":43,"_32":44,"_37":872,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":873,"_78":874,"_80":875,"_82":25},"tree",[327,329,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404],"files",[327,328,329,330,331,332,333,334,335,336,337,338,339,340,341,342,343,344,345,346,347,348,349,350,351,352,353,354,355,356,357,358,359,360,361,362,363,364,365,366,367,368,369,370,371,372,373,374,375,376,377,378,379,380,381,382,383,384,385,386,387,388,389,390,391,392,393,394,395,396,397,398,399,400,401,402,403,404],"counts",{"_317":60,"_318":155,"_319":60,"_320":321,"_322":323},"contents",[124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_42":311,"_32":312,"_30":313,"_151":-5,"_40":41,"_39":314,"_153":119,"_37":315,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_27":316},{"_42":305,"_32":306,"_30":307,"_151":-5,"_40":41,"_39":155,"_153":119,"_37":308,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_27":310},{"_42":298,"_32":299,"_30":300,"_151":-5,"_40":41,"_39":301,"_153":119,"_37":302,"_13":60,"_33":20,"_34":303,"_24":25,"_158":-5,"_27":304},{"_42":291,"_32":292,"_30":293,"_151":-5,"_40":41,"_39":294,"_153":119,"_37":295,"_13":60,"_33":20,"_34":296,"_24":25,"_158":-5,"_27":297},{"_42":288,"_32":28,"_30":31,"_151":-5,"_40":41,"_39":14,"_153":25,"_37":289,"_13":155,"_33":20,"_34":36,"_24":25,"_158":-5,"_27":290},{"_42":281,"_32":282,"_30":283,"_151":-5,"_40":41,"_39":284,"_153":119,"_37":285,"_13":60,"_33":20,"_34":286,"_24":25,"_158":-5,"_27":287},{"_42":274,"_32":275,"_30":276,"_151":-5,"_40":41,"_39":277,"_153":25,"_37":278,"_13":155,"_33":20,"_34":279,"_24":25,"_158":-5,"_27":280},{"_42":267,"_32":268,"_30":269,"_151":-5,"_40":41,"_39":270,"_153":25,"_37":271,"_13":60,"_33":156,"_34":272,"_24":25,"_158":-5,"_27":273},{"_42":260,"_32":261,"_30":262,"_151":-5,"_40":41,"_39":263,"_153":119,"_37":264,"_13":155,"_33":156,"_34":265,"_24":25,"_158":-5,"_27":266},{"_42":253,"_32":254,"_30":255,"_151":-5,"_40":41,"_39":256,"_153":119,"_37":257,"_13":155,"_33":156,"_34":258,"_24":25,"_158":-5,"_27":259},{"_42":245,"_32":246,"_30":247,"_151":-5,"_40":41,"_39":248,"_153":119,"_37":249,"_13":155,"_33":250,"_34":251,"_24":25,"_158":-5,"_27":252},{"_42":238,"_32":239,"_30":240,"_151":-5,"_40":41,"_39":241,"_153":119,"_37":242,"_13":60,"_33":20,"_34":243,"_24":25,"_158":-5,"_27":244},{"_42":231,"_32":232,"_30":233,"_151":-5,"_40":41,"_39":234,"_153":25,"_37":235,"_13":60,"_33":156,"_34":236,"_24":25,"_158":-5,"_27":237},{"_42":223,"_32":224,"_30":225,"_151":-5,"_40":41,"_39":226,"_153":119,"_37":227,"_13":155,"_33":228,"_34":229,"_24":25,"_158":-5,"_27":230},{"_42":216,"_32":217,"_30":218,"_151":-5,"_40":41,"_39":219,"_153":119,"_37":220,"_13":155,"_33":156,"_34":221,"_24":25,"_158":-5,"_27":222},{"_42":209,"_32":210,"_30":211,"_151":-5,"_40":41,"_39":212,"_153":25,"_37":213,"_13":60,"_33":156,"_34":214,"_24":25,"_158":-5,"_27":215},{"_42":202,"_32":203,"_30":204,"_151":-5,"_40":41,"_39":205,"_153":119,"_37":206,"_13":155,"_33":156,"_34":207,"_24":25,"_158":-5,"_27":208},{"_42":195,"_32":196,"_30":197,"_151":-5,"_40":41,"_39":198,"_153":119,"_37":199,"_13":155,"_33":156,"_34":200,"_24":25,"_158":-5,"_27":201},{"_42":188,"_32":189,"_30":190,"_151":-5,"_40":41,"_39":191,"_153":119,"_37":192,"_13":155,"_33":156,"_34":193,"_24":25,"_158":-5,"_27":194},{"_42":181,"_32":182,"_30":183,"_151":-5,"_40":41,"_39":184,"_153":119,"_37":185,"_13":155,"_33":156,"_34":186,"_24":25,"_158":-5,"_27":187},{"_42":174,"_32":175,"_30":176,"_151":-5,"_40":41,"_39":177,"_153":25,"_37":178,"_13":60,"_33":156,"_34":179,"_24":25,"_158":-5,"_27":180},{"_42":167,"_32":168,"_30":169,"_151":-5,"_40":41,"_39":170,"_153":119,"_37":171,"_13":155,"_33":156,"_34":172,"_24":25,"_158":-5,"_27":173},{"_42":160,"_32":161,"_30":162,"_151":-5,"_40":41,"_39":163,"_153":119,"_37":164,"_13":155,"_33":156,"_34":165,"_24":25,"_158":-5,"_27":166},{"_42":148,"_32":149,"_30":150,"_151":-5,"_40":41,"_39":152,"_153":25,"_37":154,"_13":155,"_33":156,"_34":157,"_24":25,"_158":-5,"_27":159},"8c848a1d-d2f3-4c6c-96a1-ae9b7ab5fe59","theme.ts","f2c7820e-668d-11f1-9138-1607ee4eb77e","parentId",80,"latest",["D",1781305585375],1,"script","/**\n * Branding + theme for the Discord CAPTCHA Shield.\n *\n * This is the ONE file you edit to make the template your own. It replaces the\n * site-specific `core/` dependencies the original was coupled to, so the shield\n * ships fully self-contained. Swap the colors, logo, copy, and rules below and\n * the portal page, the OG card, and every Discord embed re-skin together.\n *\n * Ships themed for `catalloc` — a warm \"tabby\" palette and cat-flavored copy —\n * as a worked example. Replace it with yours.\n */\n\n// ========================================\n// BRAND\n// ========================================\n\nexport const brand = {\n /** Display name. The DISCORD/portal env var VERIFY_SERVER_NAME overrides this\n * at runtime, so you can reuse one template for several servers. */\n name: \"catalloc\",\n\n /** Headline + tagline rendered onto the social (OG) card. */\n ogHeadline: \"ARE YOU HUMAN?\",\n ogTagline: \"Solve a quick CAPTCHA to unlock the Discord\",\n\n /** Square logo (≈300px+). Shown on the portal card, the OG card, and the\n * rules embed thumbnail. Defaults to a placeholder cat — swap for your own. */\n logoUrl: \"https://placecats.com/300/300\",\n\n /** Accent color — drives buttons, the portal header bar, and embed stripes.\n * `embedColor` is the same color as a Discord-friendly integer (0xRRGGBB). */\n accentColor: \"#F4A340\", // tabby orange\n accentColorBright: \"#FFC15E\",\n embedColor: 0xf4a340,\n\n /** Shown by crawlers before the cron first generates /og.png. */\n ogFallbackImage: \"https://placecats.com/1200/630\",\n};\n\n// ========================================\n// RULES (posted by post-rules.ts)\n// ========================================\n\nexport interface Rule {\n name: string;\n value: string;\n}\n\n/** Server rules rendered into the rules embed. Rewrite for your community. */\nexport const rules: Rule[] = [\n {\n name: \"1. BE KIND\",\n value:\n \"We're here to have a good time. If you have a problem with someone, try to sort it out civilly — and if that fails, ping a mod and we'll help mediate.\",\n },\n {\n name: \"2. KEEP IT ON-TOPIC\",\n value:\n \"No politics or hot-button drama. There are plenty of places on the internet for that; this isn't one of them.\",\n },\n {\n name: \"3. NO HATE SPEECH\",\n value:\n \"Everyone is welcome here. Zero tolerance for racism, sexism, homophobia, or hate speech of any kind.\",\n },\n {\n name: \"4. NO NSFW / NSFL CONTENT\",\n value:\n \"Don't post vulgar, obscene, or explicit content. Keep it SFW (cat pictures excepted).\",\n },\n {\n name: \"5. NO SPAM OR SELF-PROMO\",\n value:\n \"Don't flood channels, mass-DM members, or drop unsolicited invite links. Ask a mod before promoting anything.\",\n },\n {\n name: \"6. RESPECT THE MODS\",\n value:\n \"Mods enforce these rules as needed. Most violations get a warning; extreme or repeat cases may result in a ban.\",\n },\n];\n\n// ========================================\n// ABOUT (posted by post-about.ts)\n// ========================================\n\nexport interface AboutInfo {\n /** One-line hook under the title. */\n tagline: string;\n /** A paragraph (or two) describing the community. Markdown is allowed. */\n description: string;\n /** Optional bullet-style highlights rendered as embed fields. */\n highlights: Rule[];\n}\n\n/**\n * The \"About\" card the bot posts into a DMZ channel (one unverified members can\n * see) so newcomers know what they're joining before they verify. Rewrite for\n * your community.\n */\nexport const about: AboutInfo = {\n tagline: \"A cozy corner of the internet for cat people. 🐾\",\n description:\n \"**catalloc** is a laid-back community built around good vibes, good company, and an unreasonable number of cat pictures. Whether you're here to hang out, share your projects, or just lurk with a coffee, you're welcome.\\n\\nVerification keeps the bots and raiders out — pass a quick CAPTCHA and the rest of the server opens up.\",\n highlights: [\n { name: \"💬 Active chat\", value: \"Always someone around to talk to.\" },\n { name: \"🐱 Cat tax\", value: \"Pictures of your cat are strongly encouraged.\" },\n { name: \"🛡️ Bot-free\", value: \"CAPTCHA-gated so it stays human.\" },\n ],\n};\n\n// ========================================\n// THEME RESOLUTION (per-server white-label)\n// ========================================\n\n/**\n * A fully-resolved theme: every visual value the portal, OG card, and embeds\n * need, with no undefined fields. Built by resolveTheme() from a server's\n * overrides layered over the brand defaults above.\n */\nexport interface ResolvedTheme {\n name: string;\n ogHeadline: string;\n ogTagline: string;\n logoUrl: string;\n accentColor: string;\n accentColorBright: string;\n embedColor: number;\n ogFallbackImage: string;\n rules: Rule[];\n about: AboutInfo;\n}\n\n/** Per-server branding overrides. Any field left undefined falls back to the\n * brand defaults in this file. Sourced from a guild's stored config row. */\nexport interface ThemeOverrides {\n serverName?: string;\n brandName?: string;\n logoUrl?: string;\n accentColor?: string;\n accentColorBright?: string;\n embedColor?: number;\n ogHeadline?: string;\n ogTagline?: string;\n ogFallbackImage?: string;\n rules?: Rule[];\n about?: AboutInfo;\n}\n\n/** Merge per-server overrides over the brand defaults into a ResolvedTheme. */\nexport function resolveTheme(o: ThemeOverrides = {}): ResolvedTheme {\n return {\n name: o.serverName ?? o.brandName ?? brand.name,\n ogHeadline: o.ogHeadline ?? brand.ogHeadline,\n ogTagline: o.ogTagline ?? brand.ogTagline,\n logoUrl: o.logoUrl ?? brand.logoUrl,\n accentColor: o.accentColor ?? brand.accentColor,\n accentColorBright: o.accentColorBright ?? brand.accentColorBright,\n embedColor: o.embedColor ?? brand.embedColor,\n ogFallbackImage: o.ogFallbackImage ?? brand.ogFallbackImage,\n rules: o.rules ?? rules,\n about: o.about ?? about,\n };\n}\n\n/** \"#F4A340\" -> \"244,163,64\" for use in rgba(var(--accent-rgb), a). Falls back\n * to the brand tabby orange if the hex can't be parsed. */\nfunction hexToRgb(hex: string): string {\n const h = hex.replace(\"#\", \"\").trim();\n const full = h.length === 3 ? h.split(\"\").map((c) => c + c).join(\"\") : h;\n const n = parseInt(full, 16);\n if (full.length !== 6 || Number.isNaN(n)) return \"244,163,64\";\n return `${(n >> 16) & 255},${(n >> 8) & 255},${n & 255}`;\n}\n\n// ========================================\n// STYLES (replaces core/styles.tsx getAllStyles)\n// ========================================\n\n/**\n * All CSS the portal needs, self-contained. Maps the resolved theme's accent\n * onto CSS variables (including an --accent-rgb triple so translucent accents\n * re-skin per server) and ships the small `.btn` + portal layout the page\n * references. Soft, rounded — no external stylesheet required.\n */\nexport function portalCss(theme: ResolvedTheme): string {\n return `\n :root {\n --accent: ${theme.accentColor};\n --accent-bright: ${theme.accentColorBright};\n --accent-rgb: ${hexToRgb(theme.accentColor)};\n --bg: #0E0D0B;\n --surface: #1C1A17;\n --surface-2: #2A2722;\n --text: #F5F1EA;\n --muted: rgba(245,241,234,0.65);\n }\n\n * { margin: 0; padding: 0; box-sizing: border-box; }\n html { scroll-behavior: smooth; }\n body {\n font-family: 'Quicksand', system-ui, sans-serif;\n background-color: var(--bg);\n color: var(--text);\n -webkit-font-smoothing: antialiased;\n }\n\n .btn {\n font-family: 'Quicksand', sans-serif;\n font-size: 1rem;\n font-weight: 600;\n letter-spacing: 1px;\n text-decoration: none;\n padding: 0.9rem 2rem;\n border: none;\n border-radius: 14px;\n cursor: pointer;\n transition: all 0.25s ease;\n }\n .btn-primary {\n background: linear-gradient(135deg, var(--accent), var(--accent-bright));\n color: #1a1206;\n }\n .btn-primary:hover {\n transform: translateY(-2px);\n box-shadow: 0 10px 28px rgba(var(--accent-rgb),0.35);\n }\n .btn-secondary {\n background: transparent;\n color: var(--text);\n border: 2px solid var(--accent);\n }\n .btn-secondary:hover {\n background: rgba(var(--accent-rgb),0.12);\n transform: translateY(-2px);\n }\n\n .verify-wrap {\n min-height: 100vh;\n display: flex;\n align-items: center;\n justify-content: center;\n padding: 24px;\n background:\n radial-gradient(ellipse at 50% 0%, rgba(var(--accent-rgb),0.16) 0%, transparent 60%),\n linear-gradient(160deg, #0E0D0B 0%, #15120E 60%, #0E0D0B 100%);\n }\n .verify-card {\n width: 100%;\n max-width: 440px;\n background: linear-gradient(150deg, var(--surface-2), var(--surface));\n border: 1px solid rgba(var(--accent-rgb),0.22);\n padding: 2.5rem 2rem;\n position: relative;\n overflow: hidden;\n text-align: center;\n border-radius: 24px;\n box-shadow: 0 24px 60px rgba(0,0,0,0.55);\n }\n .verify-card::before {\n content: '';\n position: absolute;\n top: 0; left: 0; right: 0;\n height: 4px;\n background: linear-gradient(90deg, var(--accent), var(--accent-bright), var(--accent));\n }\n .verify-logo {\n width: 92px;\n height: 92px;\n object-fit: cover;\n border-radius: 50%;\n margin: 0 auto 1.25rem;\n border: 3px solid rgba(var(--accent-rgb),0.5);\n box-shadow: 0 0 26px rgba(var(--accent-rgb),0.4);\n }\n .verify-card h1 {\n font-family: 'Fredoka', sans-serif;\n font-weight: 600;\n font-size: 2.1rem;\n letter-spacing: 1px;\n line-height: 1.05;\n margin-bottom: 0.4rem;\n }\n .verify-sub {\n font-weight: 600;\n font-size: 0.8rem;\n letter-spacing: 1.5px;\n text-transform: uppercase;\n color: var(--accent);\n margin-bottom: 1.75rem;\n }\n .verify-steps {\n list-style: none;\n text-align: left;\n max-width: 300px;\n margin: 0 auto 1.75rem;\n display: grid;\n gap: 0.65rem;\n }\n .verify-steps li {\n display: flex;\n align-items: center;\n gap: 0.8rem;\n font-size: 0.92rem;\n color: var(--muted);\n }\n .verify-steps .n {\n flex: none;\n width: 28px;\n height: 28px;\n background: var(--accent);\n color: #1a1206;\n font-family: 'Fredoka', sans-serif;\n font-weight: 600;\n font-size: 0.95rem;\n display: grid;\n place-items: center;\n border-radius: 50%;\n }\n .cf-holder {\n display: flex;\n justify-content: center;\n min-height: 70px;\n margin-bottom: 1.5rem;\n }\n .btn-block { width: 100%; display: inline-flex; align-items: center; justify-content: center; gap: 0.6rem; }\n .btn-block svg { width: 20px; height: 20px; }\n .btn:disabled { opacity: 0.4; cursor: not-allowed; transform: none !important; box-shadow: none !important; }\n .verify-err {\n display: none;\n margin-top: 1.1rem;\n color: var(--text);\n background: rgba(var(--accent-rgb),0.12);\n border: 1px solid rgba(var(--accent-rgb),0.4);\n border-radius: 12px;\n padding: 0.7rem 0.9rem;\n font-size: 0.85rem;\n line-height: 1.5;\n }\n .verify-foot {\n margin-top: 1.75rem;\n color: rgba(245,241,234,0.35);\n font-size: 0.7rem;\n letter-spacing: 1px;\n text-transform: uppercase;\n }\n .result-badge {\n width: 84px;\n height: 84px;\n margin: 0 auto 1.5rem;\n display: grid;\n place-items: center;\n border-radius: 50%;\n font-size: 2.6rem;\n line-height: 1;\n }\n .result-badge.ok { background: rgba(74,176,108,0.15); color: #4ab06c; border: 2px solid #4ab06c; }\n .result-badge.bad { background: rgba(var(--accent-rgb),0.15); color: var(--accent-bright); border: 2px solid var(--accent); }\n .result-msg { color: var(--muted); line-height: 1.7; font-size: 1.05rem; }\n .result-link { margin-top: 1.5rem; }\n`;\n}\n","label",[149],"0cbececb-1d54-4a25-a688-542581aca01c","store.ts","f2c267e2-668d-11f1-847c-1607ee4eb77e",77,["D",1781305585269],"/**\n * Per-key blob storage for the IDs the shield owns: the DMZ category, the four\n * DMZ channels, and the messages it posts into them.\n *\n * Persisting these gives two things:\n * 1. Idempotent setup — channel creation can skip channels it already made.\n * 2. In-place message updates — re-running a post tool EDITS the message it\n * posted last time instead of dropping a duplicate.\n *\n * Each ID lives under its OWN blob key (one channel, one message, one category\n * per key) rather than in a single aggregate object. That makes writes\n * independent: setup.ts can post all four DMZ messages concurrently without the\n * read-modify-write races a shared object would have.\n *\n * Multi-tenant: every key is namespaced by guild id, so each shielded server\n * owns an isolated set of channel/message/category IDs in the shared store.\n *\n * Channel-ID resolution order (see mod.ts `resolveChannel`) is:\n * explicit parameter -> this store -> the per-guild config field\n * so a server that ran setup.ts uses the bot-made channels, while a server that\n * wired channel IDs by hand still works via its config.\n */\n\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst PREFIX = \"captcha_shield_v1\";\n\nexport type ChannelKind = \"about\" | \"rules\" | \"verify\" | \"honeypot\";\n\nconst channelKey = (guildId: string, kind: ChannelKind) =>\n `${PREFIX}_${guildId}_channel_${kind}`;\nconst messageKey = (guildId: string, kind: ChannelKind) =>\n `${PREFIX}_${guildId}_message_${kind}`;\nconst categoryKey = (guildId: string) => `${PREFIX}_${guildId}_category`;\n\n/** Read a single stored ID. Undefined if it was never written. */\nasync function readId(key: string): Promise {\n try {\n const res = await blob.get(key);\n const text = (await res.text()).trim();\n return text || undefined;\n } catch {\n return undefined; // not written yet\n }\n}\n\n/** Write a single stored ID. One key per ID, so concurrent writes don't race. */\nasync function writeId(key: string, id: string): Promise {\n await blob.set(key, id);\n}\n\nexport const getChannel = (\n guildId: string,\n kind: ChannelKind,\n): Promise => readId(channelKey(guildId, kind));\nexport const getMessage = (\n guildId: string,\n kind: ChannelKind,\n): Promise => readId(messageKey(guildId, kind));\nexport const getCategory = (guildId: string): Promise =>\n readId(categoryKey(guildId));\n\nexport const rememberChannel = (\n guildId: string,\n kind: ChannelKind,\n id: string,\n): Promise => writeId(channelKey(guildId, kind), id);\nexport const rememberMessage = (\n guildId: string,\n kind: ChannelKind,\n id: string,\n): Promise => writeId(messageKey(guildId, kind), id);\nexport const rememberCategory = (\n guildId: string,\n id: string,\n): Promise => writeId(categoryKey(guildId), id);\n\nconst KINDS: ChannelKind[] = [\"about\", \"rules\", \"verify\", \"honeypot\"];\n\n/**\n * Migrate IDs written by the single-guild build (un-namespaced keys like\n * `captcha_shield_v1_channel_verify`) to this guild's namespaced keys. Copies\n * the category, four channel IDs, and four message IDs — but never clobbers a\n * value already present under the new key. Best-effort and idempotent; called\n * once from the legacy-env migration so post tools keep editing in place.\n */\nexport async function migrateLegacyKeys(guildId: string): Promise {\n const copy = async (oldKey: string, newKey: string) => {\n if (await readId(newKey)) return; // already migrated / set\n const val = await readId(oldKey);\n if (val) await writeId(newKey, val);\n };\n const jobs = [copy(`${PREFIX}_category`, categoryKey(guildId))];\n for (const k of KINDS) {\n jobs.push(copy(`${PREFIX}_channel_${k}`, channelKey(guildId, k)));\n jobs.push(copy(`${PREFIX}_message_${k}`, messageKey(guildId, k)));\n }\n await Promise.all(jobs);\n}\n",[161],"b92f8dd0-2e2d-4c67-817b-77db1d2654bc","setup.ts","f3b6028a-668d-11f1-befe-1607ee4eb77e",85,["D",1781305585792],"// ============================================================================\n// One-shot DMZ bootstrap (manual trigger)\n// ============================================================================\n//\n// Run this file to stand up the whole DMZ for ONE server:\n// 1. Creates a \"Welcome\" category + #about, #rules, #verify, #do-not-post\n// channels with read-only @everyone overwrites (the honeypot stays open).\n// 2. Posts the about / rules / verify / honeypot messages into them.\n// Every channel + message ID is saved to blob storage (namespaced per guild),\n// so re-running any post-*.ts afterwards EDITS its message in place instead of\n// duplicating, and re-running setup.ts skips channels that already exist.\n//\n// Which server: pass the guild id as the first CLI argument, or set\n// TOOL_GUILD_ID / DISCORD_GUILD_ID. The server must already be registered (via\n// the admin API or the legacy env seed); its role + branding come from there.\n//\n// Requires the shared DISCORD_BOT_TOKEN + DISCORD_CLIENT_ID, and the bot must\n// have **Manage Channels** (plus the usual Send Messages + Embed Links). Set\n// the server's portalUrl (admin API) to add the Verify buttons.\n// ============================================================================\n\nimport { createDmzChannels } from \"./channels.ts\";\nimport {\n postAboutMessage,\n postHoneypotMessage,\n postRulesMessage,\n postVerifyMessage,\n type VerifyConfig,\n} from \"./mod.ts\";\nimport { loadGuildToolConfig, toolGuildId } from \"./config.ts\";\n\nexport async function main(guildId: string = toolGuildId()) {\n const config = await loadGuildToolConfig(guildId);\n if (!config) {\n console.error(\n `Server ${guildId} isn't registered. Add it via the admin API first ` +\n `(POST /admin/guilds), then re-run setup.`,\n );\n return;\n }\n console.log(`Setting up DMZ for server ${guildId}…`);\n\n console.log(\"Creating DMZ channels…\");\n for (const r of await createDmzChannels(config)) {\n const mark = r.status === \"created\" ? \"+\" : r.status === \"exists\" ? \"=\" : \"✗\";\n console.log(` ${mark} ${r.name}: ${r.status}${r.id ? ` (${r.id})` : \"\"}${r.detail ? ` — ${r.detail}` : \"\"}`);\n }\n\n // Post concurrently — each message's ID lives under its own blob key, so the\n // four writes don't race. (The channels exist by now, created above.)\n console.log(\"Posting DMZ messages…\");\n const steps: [string, (c: VerifyConfig) => Promise<{ ok: boolean; detail: string }>][] = [\n [\"about\", postAboutMessage],\n [\"rules\", postRulesMessage],\n [\"verify\", postVerifyMessage],\n [\"honeypot\", postHoneypotMessage],\n ];\n const posted = await Promise.all(\n steps.map(([name, post]) =>\n post(config).then((res) => [name, res] as const)\n ),\n );\n for (const [name, res] of posted) {\n console.log(` ${res.ok ? \"✓\" : \"✗\"} ${name}: ${res.detail}`);\n }\n\n console.log(\n \"\\nDone. Channel + message IDs are saved to blob — re-run any post-*.ts to edit a message in place.\",\n );\n}\n\nawait main();\n",[168],"3185a278-3b07-49c5-b016-1c8115756cf0","schema.ts","55e2e976-66b3-11f1-aadb-1607ee4eb77e",74,["D",1781305585108],"/**\n * Centralized SQLite schema + migrations for the Discord CAPTCHA Shield.\n *\n * Owns every table the shield touches so the DDL lives in ONE place:\n * - captcha_guilds per-server config + white-label branding\n * - captcha_verify_states_v2 one-time OAuth state nonces (guild-scoped)\n * - captcha_verify_log_v2 verification audit log (guild-scoped)\n * - captcha_verify_alerts raid-alert debounce state (scoped via the kind)\n *\n * Migration style (per AGENTS.md): we do NOT ALTER existing tables. Adding the\n * multi-tenant `guild_id` column means a NEW table name (`*_v2`) created fresh\n * with the column already present. Upgrading from the single-guild build:\n * - state nonces are ephemeral (10-min TTL) — the new table just starts empty\n * - the audit log is copied across (guild_id set to the legacy server) by\n * migrateLegacyLog(), called once from the legacy-env migration\n * - the alerts table is UNCHANGED (its schema is the same; the guild is\n * namespaced into the `kind` value, e.g. `raid:`)\n *\n * `ensureSchema()` is idempotent (CREATE TABLE IF NOT EXISTS) and memoized per\n * isolate, so call it freely before any query.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nexport const GUILDS_TABLE = \"captcha_guilds\";\nexport const STATES_TABLE = \"captcha_verify_states_v2\";\nexport const LOG_TABLE = \"captcha_verify_log_v2\";\nexport const ALERTS_TABLE = \"captcha_verify_alerts\";\n\n// Single-guild predecessor of LOG_TABLE (no guild_id). Read once during the\n// legacy migration to copy history forward, never written to again.\nconst LEGACY_LOG_TABLE = \"captcha_verify_log\";\n\nlet schemaReady = false;\n\n/**\n * Create every table. Idempotent and memoized per isolate. Fresh databases and\n * upgrades alike get the full multi-tenant schema — no ALTER needed because the\n * guild-scoped tables carry new names.\n */\nexport async function ensureSchema(): Promise {\n if (schemaReady) return;\n\n // --- Per-server config + branding ---------------------------------------\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${GUILDS_TABLE} (\n guild_id TEXT PRIMARY KEY,\n role_id TEXT NOT NULL,\n server_name TEXT,\n disabled INTEGER NOT NULL DEFAULT 0,\n brand_name TEXT,\n logo_url TEXT,\n accent_color TEXT,\n accent_color_bright TEXT,\n embed_color INTEGER,\n og_headline TEXT,\n og_tagline TEXT,\n og_fallback_image TEXT,\n rules_json TEXT,\n about_json TEXT,\n turnstile_site_key TEXT,\n turnstile_secret_key TEXT,\n alert_webhook_url TEXT,\n raid_threshold INTEGER,\n raid_window_ms INTEGER,\n alert_cooldown_ms INTEGER,\n verify_channel_id TEXT,\n rules_channel_id TEXT,\n about_channel_id TEXT,\n honeypot_channel_id TEXT,\n portal_url TEXT,\n redirect_uri_override TEXT,\n created_at INTEGER NOT NULL,\n updated_at INTEGER NOT NULL\n )\n `);\n\n // --- One-time OAuth state nonces (guild-scoped) -------------------------\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${STATES_TABLE} (\n state TEXT PRIMARY KEY,\n guild_id TEXT,\n created_at INTEGER NOT NULL,\n used INTEGER NOT NULL DEFAULT 0\n )\n `);\n\n // --- Verification audit log (guild-scoped) ------------------------------\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${LOG_TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n guild_id TEXT,\n discord_user_id TEXT NOT NULL,\n discord_username TEXT,\n created_at INTEGER NOT NULL,\n success INTEGER NOT NULL,\n detail TEXT\n )\n `);\n\n // Raid-detection COUNT is `WHERE guild_id = ? AND success = 1 AND created_at\n // > ?`; lead with guild_id so the scan is an index seek per tenant.\n await sqlite.execute(`\n CREATE INDEX IF NOT EXISTS idx_${LOG_TABLE}_guild_success_created\n ON ${LOG_TABLE} (guild_id, success, created_at)\n `);\n\n // --- Raid-alert debounce (one row per guild+kind via the kind value) ----\n await sqlite.execute(`\n CREATE TABLE IF NOT EXISTS ${ALERTS_TABLE} (\n kind TEXT PRIMARY KEY,\n last_alert_at INTEGER NOT NULL\n )\n `);\n\n schemaReady = true;\n}\n\n/**\n * One-time copy of the single-guild audit log into the guild-scoped table,\n * stamping every legacy row with `guildId` (the one server the old deployment\n * served). Best-effort: no-ops if the old table is absent (fresh install) or\n * the new table already holds rows (already migrated / live traffic). Called\n * once from the legacy-env migration, after the guild row is seeded.\n */\nexport async function migrateLegacyLog(guildId: string): Promise {\n await ensureSchema();\n try {\n // Don't copy if the new log already has data — avoids duplicating history\n // on a re-run or a cold-boot race.\n const have = await sqlite.execute(`SELECT COUNT(*) FROM ${LOG_TABLE}`);\n if (Number(have.rows?.[0]?.[0] ?? 0) > 0) return;\n\n await sqlite.execute({\n sql: `INSERT INTO ${LOG_TABLE}\n (guild_id, discord_user_id, discord_username, created_at, success, detail)\n SELECT ?, discord_user_id, discord_username, created_at, success, detail\n FROM ${LEGACY_LOG_TABLE}`,\n args: [guildId],\n });\n } catch {\n // Old table missing or unreadable — nothing to migrate.\n }\n}\n",[175],"6b0c3999-d185-4b56-ad46-714ae861f100","post-verify.ts","f3d7313a-668d-11f1-b477-1607ee4eb77e",89,["D",1781305586131],"// ============================================================================\n// Post the verification message into Discord (manual trigger)\n// ============================================================================\n//\n// Run this file and the bot posts a branded embed + a link \"Verify\" button into\n// the server's verify channel. Post it once; it lives in that channel.\n//\n// Which server: pass the guild id as the first CLI argument, or set\n// TOOL_GUILD_ID / DISCORD_GUILD_ID. The verify channel, branding, and portal\n// URL come from the registered server's config; the bot token + client id are\n// shared env. The bot must have Send Messages + Embed Links in that channel.\n// ============================================================================\n\nimport { postVerifyMessage } from \"./mod.ts\";\nimport { loadGuildToolConfig, toolGuildId } from \"./config.ts\";\n\nexport async function main(guildId: string = toolGuildId()) {\n const config = await loadGuildToolConfig(guildId);\n if (!config) {\n console.error(`Server ${guildId} isn't registered (POST /admin/guilds first).`);\n return;\n }\n const result = await postVerifyMessage(config);\n console.log(\n result.ok\n ? `Verification message posted (${result.detail}).`\n : `Failed to post verification message: ${result.detail}`,\n );\n return result;\n}\n\nawait main();\n",[182],"51b2b474-3da8-49c0-94da-3e069fe1dc74","post-rules.ts","f3db993c-668d-11f1-bf75-1607ee4eb77e",91,["D",1781305586226],"// ============================================================================\n// Post the server rules into Discord (manual trigger)\n// ============================================================================\n//\n// Run this file and the bot posts the server's rules as a branded embed into\n// its rules channel. Post it once.\n//\n// Which server: pass the guild id as the first CLI argument, or set\n// TOOL_GUILD_ID / DISCORD_GUILD_ID. The rules channel + branding (including the\n// rules list) come from the registered server's config; the bot token is shared\n// env. The bot needs Send Messages + Embed Links in that channel.\n// ============================================================================\n\nimport { postRulesMessage } from \"./mod.ts\";\nimport { loadGuildToolConfig, toolGuildId } from \"./config.ts\";\n\nexport async function main(guildId: string = toolGuildId()) {\n const config = await loadGuildToolConfig(guildId);\n if (!config) {\n console.error(`Server ${guildId} isn't registered (POST /admin/guilds first).`);\n return;\n }\n const result = await postRulesMessage(config);\n console.log(\n result.ok\n ? `Rules message posted (${result.detail}).`\n : `Failed to post rules message: ${result.detail}`,\n );\n return result;\n}\n\nawait main();\n",[189],"98eba7da-a668-4826-9452-08fd59f3f059","post-honeypot.ts","f2dc5f1c-668d-11f1-b0f1-1607ee4eb77e",82,["D",1781305585576],"// ============================================================================\n// Post the honeypot warning into Discord (manual trigger)\n// ============================================================================\n//\n// Run this file and the bot posts a small \"do not post here\" embed into the\n// server's honeypot channel, pointing legit users to the verify channel (and\n// rules). The honeypot is a trap: bots that auto-spam every channel post here\n// and out themselves — pair it with an AutoMod rule or manual review to ban\n// anyone who posts.\n//\n// Which server: pass the guild id as the first CLI argument, or set\n// TOOL_GUILD_ID / DISCORD_GUILD_ID. The honeypot/verify/rules channels and\n// branding come from the registered server's config; the bot token is shared\n// env. The bot needs Send Messages + Embed Links in that channel.\n// ============================================================================\n\nimport { postHoneypotMessage } from \"./mod.ts\";\nimport { loadGuildToolConfig, toolGuildId } from \"./config.ts\";\n\nexport async function main(guildId: string = toolGuildId()) {\n const config = await loadGuildToolConfig(guildId);\n if (!config) {\n console.error(`Server ${guildId} isn't registered (POST /admin/guilds first).`);\n return;\n }\n const result = await postHoneypotMessage(config);\n console.log(\n result.ok\n ? `Honeypot message posted (${result.detail}).`\n : `Failed to post honeypot message: ${result.detail}`,\n );\n return result;\n}\n\nawait main();\n",[196],"0189edd7-e53e-4a99-b41c-efc56c75836d","post-about.ts","f3bcf7ac-668d-11f1-bf75-1607ee4eb77e",83,["D",1781305585714],"// ============================================================================\n// Post the \"About the community\" message into Discord (manual trigger)\n// ============================================================================\n//\n// Run this file and the bot posts a branded \"About\" embed into the server's\n// about channel. Put that channel in the DMZ — somewhere unverified members can\n// see — so newcomers know what they're joining before they verify. Post once.\n//\n// Which server: pass the guild id as the first CLI argument, or set\n// TOOL_GUILD_ID / DISCORD_GUILD_ID. The about/verify/rules channels, branding,\n// and portal URL come from the registered server's config; the bot token is\n// shared env. The bot needs Send Messages + Embed Links in that channel.\n// ============================================================================\n\nimport { postAboutMessage } from \"./mod.ts\";\nimport { loadGuildToolConfig, toolGuildId } from \"./config.ts\";\n\nexport async function main(guildId: string = toolGuildId()) {\n const config = await loadGuildToolConfig(guildId);\n if (!config) {\n console.error(`Server ${guildId} isn't registered (POST /admin/guilds first).`);\n return;\n }\n const result = await postAboutMessage(config);\n console.log(\n result.ok\n ? `About message posted (${result.detail}).`\n : `Failed to post about message: ${result.detail}`,\n );\n return result;\n}\n\nawait main();\n",[203],"9944d46b-c4aa-4378-b1dd-333623c95161","og.ts","f3c22ae2-668d-11f1-b477-1607ee4eb77e",64,["D",1781289529104],"/**\n * Dynamic Open Graph card for the verification portal.\n *\n * satori renders the layout to an SVG with text as vector paths (so the\n * rasterizer needs no fonts), then resvg-wasm turns that into a PNG. The\n * result is expensive to generate cold (module + wasm + font loads), so it is\n * persisted to blob storage and also memoized in-isolate. The /og.png route\n * calls readVerifyOgImage(); the cron pre-warms it (refreshVerifyOgImage) so a\n * crawler never waits on a cold generation.\n *\n * All branding (logo, name, colors, copy) comes from ./theme.ts.\n */\n\nimport satori from \"https://esm.sh/satori@0.10.13\";\nimport { html } from \"https://esm.sh/satori-html@0.3.2\";\nimport { initWasm, Resvg } from \"https://esm.sh/@resvg/resvg-wasm@2.6.2\";\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { brand } from \"./theme.ts\";\n\nconst BLOB_KEY = \"verify_og_png_v1\";\n\nconst FONT_SOURCES = [\n {\n name: \"Fredoka\",\n weight: 600 as const,\n url:\n \"https://cdn.jsdelivr.net/npm/@fontsource/fredoka/files/fredoka-latin-600-normal.woff\",\n },\n {\n name: \"Quicksand\",\n weight: 500 as const,\n url:\n \"https://cdn.jsdelivr.net/npm/@fontsource/quicksand/files/quicksand-latin-500-normal.woff\",\n },\n];\n\nlet pngCache: Uint8Array | null = null;\nlet fontsCache:\n | Array<\n { name: string; weight: 500 | 600; style: \"normal\"; data: ArrayBuffer }\n >\n | null = null;\nlet logoCache: string | null = null;\nlet wasmReady = false;\n\nasync function loadFonts() {\n if (fontsCache) return fontsCache;\n fontsCache = await Promise.all(FONT_SOURCES.map(async (f) => ({\n name: f.name,\n weight: f.weight,\n style: \"normal\" as const,\n data: await (await fetch(f.url)).arrayBuffer(),\n })));\n return fontsCache;\n}\n\nfunction toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n const chunk = 0x8000;\n for (let i = 0; i < bytes.length; i += chunk) {\n bin += String.fromCharCode(...bytes.subarray(i, i + chunk));\n }\n return btoa(bin);\n}\n\nasync function loadLogo(): Promise {\n if (logoCache) return logoCache;\n const res = await fetch(brand.logoUrl);\n // Keep the original mime so satori/resvg decode it correctly (the brand logo\n // may be a jpeg, png, webp, …).\n const mime = res.headers.get(\"content-type\")?.split(\";\")[0] || \"image/png\";\n const buf = new Uint8Array(await res.arrayBuffer());\n logoCache = `data:${mime};base64,${toBase64(buf)}`;\n return logoCache;\n}\n\nasync function generate(): Promise {\n const [fonts, logo] = await Promise.all([loadFonts(), loadLogo()]);\n\n const markup = html(`\n

${brand.ogHeadline}

${brand.name}

${brand.ogTagline}

\n `);\n\n // satori-html returns a VNode; satori types its first arg as ReactNode. The\n // shapes are compatible at runtime — cast to satori's own parameter type.\n const svg = await satori(\n markup as unknown as Parameters[0],\n { width: 1200, height: 630, fonts },\n );\n\n if (!wasmReady) {\n await initWasm(\n fetch(\"https://esm.sh/@resvg/resvg-wasm@2.6.2/index_bg.wasm\"),\n );\n wasmReady = true;\n }\n const resvg = new Resvg(svg, { fitTo: { mode: \"width\", value: 1200 } });\n return resvg.render().asPng();\n}\n\n/** Serve the cached card (memory, then blob). Null if not generated yet. */\nexport async function readVerifyOgImage(): Promise {\n if (pngCache) return pngCache;\n try {\n const res = await blob.get(BLOB_KEY);\n const buf = new Uint8Array(await res.arrayBuffer());\n if (buf.length > 0) {\n pngCache = buf;\n return buf;\n }\n } catch {\n // not generated yet\n }\n return null;\n}\n\n/**\n * Generate the card and persist it. Heavy (cold module + wasm + font loads),\n * so this runs from the cron — which executes to completion without an HTTP\n * request's wall-clock limit — never inline on the /og.png hot path.\n */\nexport async function refreshVerifyOgImage(): Promise {\n const png = await generate();\n pngCache = png;\n // A Uint8Array is a valid body at runtime; the cast satisfies blob.set's\n // BodyInit typing (the DOM lib narrows BufferSource).\n await blob.set(BLOB_KEY, png as BodyInit);\n return png.length;\n}\n",[210],"17132867-73bb-4988-83a5-294b4451c209","mod.ts","f2ebeaa4-668d-11f1-9138-1607ee4eb77e",87,["D",1781305585743],"/**\n * Discord CAPTCHA Shield — CAPTCHA + Discord OAuth verification module.\n *\n * A self-contained verification gate for a Discord server:\n * 1. Visitor solves a Cloudflare Turnstile CAPTCHA.\n * 2. Server verifies the Turnstile token and mints a one-time, short-lived\n * state nonce (SQLite) bound to that passed challenge.\n * 3. Visitor authorizes via Discord OAuth2 (identify scope only).\n * 4. On callback the nonce is validated + burned, identity is read, and the\n * configured bot grants the verified role to the (already-joined) member.\n *\n * Config-driven: everything visual lives in ./theme.ts, everything secret comes\n * from env (see ./config.ts). To shield a second Discord, clone the whole val\n * and set that copy's env — its project-scoped SQLite keeps storage isolated.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { portalCss, type ResolvedTheme, resolveTheme } from \"./theme.ts\";\nimport {\n type ChannelKind,\n getChannel,\n getMessage,\n rememberChannel,\n rememberMessage,\n} from \"./store.ts\";\nimport {\n ALERTS_TABLE,\n ensureSchema,\n LOG_TABLE,\n STATES_TABLE,\n} from \"./schema.ts\";\nimport { resolveGuildTheme } from \"./guilds.ts\";\nimport {\n loadGuildConfig,\n loadSharedEnv,\n optEnv,\n seedLegacyGuildFromEnv,\n type SharedEnv,\n} from \"./config.ts\";\nimport { handleAdminRequest } from \"./admin.ts\";\n\n/** Brand defaults, used when no specific server is in scope (generic error\n * pages, 404s). Per-server pages resolve their own theme. */\nconst defaultTheme: ResolvedTheme = resolveTheme();\n\n// ========================================\n// CONSTANTS\n// ========================================\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\nconst TURNSTILE_VERIFY_URL =\n \"https://challenges.cloudflare.com/turnstile/v0/siteverify\";\nconst STATE_TTL_MS = 10 * 60 * 1000; // verification link valid for 10 minutes\n\n// Table names + schema/migrations live in ./schema.ts (STATES_TABLE,\n// LOG_TABLE, ALERTS_TABLE are imported above).\n\n// Raid detection: alert when an abnormal number of *successful* verifications\n// land within a short window (the pattern Turnstile can't catch — farmed\n// accounts solving real CAPTCHAs). Debounced so we send at most one alert per\n// cooldown. These are defaults; override per-deployment via VerifyConfig.\nconst DEFAULT_RAID_WINDOW_MS = 5 * 60 * 1000; // look back 5 minutes\nconst DEFAULT_RAID_THRESHOLD = 15; // successes within window that trips alert\nconst DEFAULT_ALERT_COOLDOWN_MS = 15 * 60 * 1000; // min gap between alerts\n\n// ========================================\n// TYPES\n// ========================================\n\nexport interface VerifyConfig {\n clientId: string;\n clientSecret: string;\n botToken: string;\n guildId: string;\n roleId: string;\n turnstileSiteKey: string;\n turnstileSecretKey: string;\n /** Display name shown on the portal (defaults to the brand name). */\n serverName?: string;\n /** Override the derived `${origin}/callback` (use for custom domains). */\n redirectUriOverride?: string;\n /** Optional Discord webhook URL for raid alerts. No alerts if unset. */\n alertWebhookUrl?: string;\n /** Successful verifications within the window that trip a raid alert. */\n raidThreshold?: number;\n /** Raid-detection look-back window, in milliseconds. */\n raidWindowMs?: number;\n /** Minimum gap between raid alerts, in milliseconds. */\n alertCooldownMs?: number;\n /** Channel the bot posts the verification message into (for postVerifyMessage). */\n verifyChannelId?: string;\n /** Public base URL of the portal (for the Verify button + card image). */\n portalUrl?: string;\n /** Channel the bot posts the rules embed into (for postRulesMessage). */\n rulesChannelId?: string;\n /** Honeypot/trap channel the bot posts the \"do not post\" warning into. */\n honeypotChannelId?: string;\n /** DMZ channel the bot posts the \"about the community\" embed into. */\n aboutChannelId?: string;\n}\n\ninterface DiscordUser {\n id: string;\n username?: string;\n}\n\n// ========================================\n// DATABASE\n// ========================================\n\n/** Ensure all tables/migrations exist. Delegates to the centralized,\n * memoized schema module so every query can call it cheaply. */\nasync function ensureTables(): Promise {\n await ensureSchema();\n}\n\n/** Delete used or expired nonces. Cheap because the table only ever holds\n * in-flight verifications (we prune on every mint). Best-effort. */\nasync function pruneStates(): Promise {\n try {\n await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n } catch {\n // pruning is best-effort; never block a verification on it\n }\n}\n\n/** Mint a one-time state nonce bound to a guild. Only called after Turnstile\n * has passed. The guild is recovered from the nonce on callback. */\nasync function mintState(guildId: string): Promise {\n await ensureTables();\n await pruneStates();\n const state = crypto.randomUUID();\n await sqlite.execute({\n sql:\n `INSERT INTO ${STATES_TABLE} (state, guild_id, created_at, used) VALUES (?, ?, ?, 0)`,\n args: [state, guildId, Date.now()],\n });\n return state;\n}\n\n/** Validate and atomically burn a state nonce, returning the guild it was\n * bound to. Returns a reason on failure. */\nasync function consumeState(\n state: string,\n): Promise<\n { ok: true; guildId: string | null } | { ok: false; reason: string }\n> {\n await ensureTables();\n const now = Date.now();\n\n // Atomic single-use: only the request that flips `used` from 0->1 on a\n // still-valid row wins. Concurrent callbacks for the same state can't both\n // succeed (no check-then-act race).\n const burn = await sqlite.execute({\n sql:\n `UPDATE ${STATES_TABLE} SET used = 1 WHERE state = ? AND used = 0 AND created_at > ?`,\n args: [state, now - STATE_TTL_MS],\n });\n if ((burn.rowsAffected || 0) === 1) {\n // The row we just burned still exists (used = 1); read its guild binding.\n const res = await sqlite.execute({\n sql: `SELECT guild_id FROM ${STATES_TABLE} WHERE state = ?`,\n args: [state],\n });\n const raw = res.rows?.[0]?.[0];\n return { ok: true, guildId: raw == null ? null : String(raw) };\n }\n\n // The burn didn't take — figure out why for a helpful message (rare path).\n const res = await sqlite.execute({\n sql: `SELECT used, created_at FROM ${STATES_TABLE} WHERE state = ?`,\n args: [state],\n });\n if (!res.rows || res.rows.length === 0) {\n return { ok: false, reason: \"Invalid session. Please start over.\" };\n }\n if (Number(res.rows[0][0])) {\n return { ok: false, reason: \"This verification link was already used.\" };\n }\n return { ok: false, reason: \"Your session expired. Please start over.\" };\n}\n\nasync function logVerification(\n guildId: string,\n user: DiscordUser,\n success: boolean,\n detail: string,\n): Promise {\n try {\n await ensureTables();\n await sqlite.execute({\n sql:\n `INSERT INTO ${LOG_TABLE} (guild_id, discord_user_id, discord_username, created_at, success, detail) VALUES (?, ?, ?, ?, ?, ?)`,\n args: [\n guildId,\n user.id,\n user.username ?? null,\n Date.now(),\n success ? 1 : 0,\n detail,\n ],\n });\n } catch {\n // logging is best-effort\n }\n}\n\n/**\n * Prune ephemeral nonces and age out the audit log. Called by the cron.\n * Returns how many rows were deleted from each table.\n */\nexport async function cleanupVerifyData(\n logRetentionDays: number,\n): Promise<{ states: number; logs: number }> {\n await ensureTables();\n const states = await sqlite.execute({\n sql: `DELETE FROM ${STATES_TABLE} WHERE used = 1 OR created_at < ?`,\n args: [Date.now() - STATE_TTL_MS],\n });\n const logs = await sqlite.execute({\n sql: `DELETE FROM ${LOG_TABLE} WHERE created_at < ?`,\n args: [Date.now() - logRetentionDays * 24 * 60 * 60 * 1000],\n });\n return { states: states.rowsAffected || 0, logs: logs.rowsAffected || 0 };\n}\n\n// ========================================\n// DISCORD + TURNSTILE\n// ========================================\n\nasync function verifyTurnstile(\n secret: string,\n token: string,\n ip: string | null,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"secret\", secret);\n form.set(\"response\", token);\n if (ip) form.set(\"remoteip\", ip);\n\n const res = await fetch(TURNSTILE_VERIFY_URL, { method: \"POST\", body: form });\n const data = await res.json().catch(() => ({ success: false }));\n return data.success === true;\n}\n\nasync function exchangeCode(\n config: VerifyConfig,\n code: string,\n redirectUri: string,\n): Promise {\n const form = new URLSearchParams();\n form.set(\"client_id\", config.clientId);\n form.set(\"client_secret\", config.clientSecret);\n form.set(\"grant_type\", \"authorization_code\");\n form.set(\"code\", code);\n form.set(\"redirect_uri\", redirectUri);\n\n const res = await fetch(`${DISCORD_API}/oauth2/token`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/x-www-form-urlencoded\" },\n body: form,\n });\n if (!res.ok) return null;\n const data = await res.json();\n return (data.access_token as string) ?? null;\n}\n\nasync function fetchDiscordUser(\n accessToken: string,\n): Promise {\n const res = await fetch(`${DISCORD_API}/users/@me`, {\n headers: { authorization: `Bearer ${accessToken}` },\n });\n if (!res.ok) return null;\n return await res.json() as DiscordUser;\n}\n\n/**\n * Grant the verified role to an existing guild member.\n * Returns the HTTP status and, on failure, the Discord error code so callers\n * can distinguish \"user not in guild\" from configuration problems.\n */\nasync function grantRole(\n config: VerifyConfig,\n userId: string,\n): Promise<{ status: number; body: string; code?: number }> {\n const res = await fetch(\n `${DISCORD_API}/guilds/${config.guildId}/members/${userId}/roles/${config.roleId}`,\n {\n method: \"PUT\",\n headers: {\n authorization: `Bot ${config.botToken}`,\n \"x-audit-log-reason\": \"Passed CAPTCHA verification portal\",\n },\n },\n );\n if (res.status === 204) return { status: 204, body: \"\" };\n const body = await res.text();\n let code: number | undefined;\n try {\n code = JSON.parse(body)?.code;\n } catch {\n // non-JSON error body\n }\n return { status: res.status, body, code };\n}\n\n/**\n * Fire a Discord webhook alert if the rate of successful verifications spikes\n * past RAID_THRESHOLD within RAID_WINDOW_MS. Debounced via an atomic update so\n * only one request per ALERT_COOLDOWN_MS sends. Best-effort and never blocks\n * the verifying user's response. No-op when no webhook is configured.\n */\nasync function maybeAlertRaid(\n config: VerifyConfig,\n theme: ResolvedTheme,\n): Promise {\n if (!config.alertWebhookUrl) return;\n const threshold = config.raidThreshold ?? DEFAULT_RAID_THRESHOLD;\n const windowMs = config.raidWindowMs ?? DEFAULT_RAID_WINDOW_MS;\n const cooldownMs = config.alertCooldownMs ?? DEFAULT_ALERT_COOLDOWN_MS;\n // One debounce row per server; the guild is namespaced into the alert kind so\n // each tenant alerts (and cools down) independently.\n const kind = `raid:${config.guildId}`;\n try {\n const now = Date.now();\n const countRes = await sqlite.execute({\n sql:\n `SELECT COUNT(*) FROM ${LOG_TABLE} WHERE guild_id = ? AND success = 1 AND created_at > ?`,\n args: [config.guildId, now - windowMs],\n });\n const count = Number(countRes.rows?.[0]?.[0] ?? 0);\n if (count < threshold) return;\n\n // Atomic debounce: ensure a row exists, then only the request that moves\n // last_alert_at past the cooldown actually sends.\n await sqlite.execute({\n sql:\n `INSERT OR IGNORE INTO ${ALERTS_TABLE} (kind, last_alert_at) VALUES (?, 0)`,\n args: [kind],\n });\n const claimed = await sqlite.execute({\n sql:\n `UPDATE ${ALERTS_TABLE} SET last_alert_at = ? WHERE kind = ? AND last_alert_at < ?`,\n args: [now, kind, now - cooldownMs],\n });\n if ((claimed.rowsAffected || 0) !== 1) return;\n\n await sendDiscordAlert(\n config.alertWebhookUrl,\n theme,\n count,\n windowMs,\n threshold,\n );\n } catch {\n // alerting is best-effort\n }\n}\n\nasync function sendDiscordAlert(\n webhookUrl: string,\n theme: ResolvedTheme,\n count: number,\n windowMs: number,\n threshold: number,\n): Promise {\n const windowMin = Math.round(windowMs / 60000);\n await fetch(webhookUrl, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify({\n username: \"Verification Shield\",\n allowed_mentions: { parse: [] },\n embeds: [{\n title: \"⚠️ Possible verification raid\",\n description:\n `**${count}** accounts verified in the last **${windowMin} min** on **${theme.name}** — above the alert threshold of ${threshold}. This may be a coordinated raid using farmed accounts (Turnstile can't catch those). Consider pausing verification or tightening server join settings.`,\n color: theme.embedColor,\n timestamp: new Date().toISOString(),\n }],\n }),\n });\n}\n\n/**\n * Have the bot post the verification message (branded embed + a link \"Verify\"\n * button) into the configured channel. Triggered manually (post-verify.ts),\n * not on a schedule. The bot needs Send Messages + Embed Links in that channel.\n */\nexport async function postVerifyMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"verify\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No verify channel. Run setup.ts to create the DMZ channels, or set DISCORD_VERIFY_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n if (!config.portalUrl) {\n return {\n ok: false,\n detail: \"Set VERIFY_PORTAL_URL (or VERIFY_REDIRECT_URI) to the portal URL.\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n\n const payload = {\n embeds: [{\n title: \"Server Verification\",\n description:\n `Welcome to **${serverName}**! To keep the community safe from bots and raids, new members verify before getting access.\\n\\nClick **Verify** below, complete a quick CAPTCHA, and your role is granted automatically.`,\n color: theme.embedColor,\n image: { url: `${base}/og.png` },\n }],\n components: [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"verify\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the server rules as a branded embed into the configured\n * channel. Triggered manually (post-rules.ts). The bot needs Send Messages\n * + Embed Links in that channel.\n */\nexport async function postRulesMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"rules\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No rules channel. Run setup.ts to create the DMZ channels, or set DISCORD_RULES_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n\n const payload = {\n embeds: [{\n title: \"Discord Rules\",\n description:\n \"Our hope is that we rarely need to enforce these, but it's to everyone's benefit to be clear about who we are and what we expect. The mod team will enforce these rules as necessary.\",\n color: theme.embedColor,\n thumbnail: { url: theme.logoUrl },\n fields: theme.rules,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"rules\", channelId, config, payload, opts);\n}\n\n/**\n * Have the bot post the \"About the community\" embed into a DMZ channel — one an\n * unverified member can see — so newcomers know what they're joining before\n * they verify. Triggered manually (post-about.ts). Pulls links to the verify +\n * rules channels (as #mentions) when those IDs are set, and adds a Verify\n * button when VERIFY_PORTAL_URL is configured. The bot needs Send Messages +\n * Embed Links in that channel.\n */\nexport async function postAboutMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"about\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No about channel. Run setup.ts to create the DMZ channels, or set DISCORD_ABOUT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const serverName = theme.name;\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n\n // Point newcomers at the next step. Prefer channel mentions; fall back to a\n // plain instruction when those IDs aren't configured.\n const pointers: string[] = [];\n if (verifyId) pointers.push(`Ready? Verify in <#${verifyId}> to unlock the server.`);\n if (rulesId) pointers.push(`Read the rules in <#${rulesId}> first.`);\n\n const fields = [...theme.about.highlights];\n if (pointers.length) {\n fields.push({ name: \"👉 Getting in\", value: pointers.join(\"\\n\") });\n }\n\n const embed: Record = {\n title: `About ${serverName}`,\n description: `*${theme.about.tagline}*\\n\\n${theme.about.description}`,\n color: theme.embedColor,\n thumbnail: { url: theme.logoUrl },\n fields,\n footer: { text: serverName },\n };\n\n const payload: Record = {\n embeds: [embed],\n allowed_mentions: { parse: [] },\n };\n // When we know the portal URL, give the About card its own Verify button so\n // the DMZ has a one-click path in.\n if (config.portalUrl) {\n const base = config.portalUrl.replace(/\\/+$/, \"\");\n payload.components = [{\n type: 1,\n components: [{ type: 2, style: 5, label: \"Verify\", url: base }],\n }];\n }\n\n return await upsertMessage(\"about\", channelId, config, payload, opts);\n}\n\n// ========================================\n// CHANNEL + MESSAGE RESOLUTION\n// ========================================\n\nexport interface PostOpts {\n /** Override the resolved channel (raw ID, link, or #mention). */\n channelId?: string;\n /** Edit this specific message instead of the stored one. */\n messageId?: string;\n /** Always post a new message, ignoring any stored message ID. */\n forceNew?: boolean;\n}\n\n/** Extract a numeric channel ID from a raw ID, a #mention, or a channel link. */\nexport function parseChannelId(raw: string | undefined): string {\n if (!raw) return \"\";\n const t = raw.trim();\n const m = t.match(/channels\\/\\d+\\/(\\d+)/);\n return m ? m[1] : t.replace(/\\D/g, \"\");\n}\n\n/** The env-derived channel field on config for a given DMZ message kind. */\nfunction channelEnvField(\n config: VerifyConfig,\n kind: ChannelKind,\n): string | undefined {\n switch (kind) {\n case \"about\":\n return config.aboutChannelId;\n case \"rules\":\n return config.rulesChannelId;\n case \"verify\":\n return config.verifyChannelId;\n case \"honeypot\":\n return config.honeypotChannelId;\n }\n}\n\n/**\n * Resolve a DMZ channel ID in priority order:\n * 1. an explicit override (e.g. opts.channelId)\n * 2. a channel the bot created (blob store)\n * 3. the env var (config field)\n * Returns \"\" when none is known.\n */\nexport async function resolveChannel(\n kind: ChannelKind,\n config: VerifyConfig,\n explicit?: string,\n): Promise {\n const direct = parseChannelId(explicit);\n if (direct) return direct;\n const stored = await getChannel(config.guildId, kind);\n if (stored) return stored;\n return parseChannelId(channelEnvField(config, kind));\n}\n\n/**\n * Post `payload` into `channelId`, or EDIT the message we last posted for this\n * kind — so re-running a post tool updates in place instead of duplicating.\n * Which message to edit: opts.messageId, else the stored id (unless\n * opts.forceNew). A stored-but-deleted message (404) falls back to a fresh\n * post. Remembers the resulting channel + message IDs in the blob store.\n */\nasync function upsertMessage(\n kind: ChannelKind,\n channelId: string,\n config: VerifyConfig,\n payload: Record,\n opts: PostOpts,\n): Promise<{ ok: boolean; detail: string }> {\n const headers = {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n const targetId = opts.messageId ??\n (opts.forceNew ? undefined : await getMessage(config.guildId, kind));\n\n if (targetId) {\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages/${targetId}`,\n { method: \"PATCH\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n await rememberMessage(config.guildId, kind, targetId);\n await rememberChannel(config.guildId, kind, channelId);\n return {\n ok: true,\n detail: `updated message ${targetId} in channel ${channelId}`,\n };\n }\n // A 404 means the stored message was deleted — fall through to a fresh post.\n if (res.status !== 404) {\n return {\n ok: false,\n detail:\n `Discord ${res.status} editing message ${targetId} in channel ${channelId}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n }\n\n const res = await fetch(\n `${DISCORD_API}/channels/${channelId}/messages`,\n { method: \"POST\", headers, body: JSON.stringify(payload) },\n );\n if (res.ok) {\n const msg = await res.json().catch(() => ({} as { id?: string }));\n if (msg?.id) await rememberMessage(config.guildId, kind, String(msg.id));\n await rememberChannel(config.guildId, kind, channelId);\n return {\n ok: true,\n detail: `posted to channel ${channelId}${msg?.id ? ` (message ${msg.id})` : \"\"}`,\n };\n }\n return {\n ok: false,\n detail:\n `Discord ${res.status} posting to channel ${channelId}: ${(await res.text()).slice(0, 200)} — check the ID is correct and the bot can view + post in that channel.`,\n };\n}\n\n/**\n * Have the bot post a \"do not post here\" warning into a honeypot/trap channel,\n * pointing legit users to verification (and the rules). Bots that auto-spam\n * every channel reveal themselves here. Triggered manually (post-honeypot.ts).\n * The verify/rules links use channel mentions resolved from the existing\n * DISCORD_VERIFY_CHANNEL_ID / DISCORD_RULES_CHANNEL_ID.\n */\nexport async function postHoneypotMessage(\n config: VerifyConfig,\n opts: PostOpts = {},\n): Promise<{ ok: boolean; detail: string }> {\n const channelId = await resolveChannel(\"honeypot\", config, opts.channelId);\n if (!channelId) {\n return {\n ok: false,\n detail:\n \"No honeypot channel. Run setup.ts to create the DMZ channels, or set DISCORD_HONEYPOT_CHANNEL_ID (numeric ID, link, or #mention).\",\n };\n }\n const theme = await resolveGuildTheme(config.guildId);\n const verifyId = await resolveChannel(\"verify\", config);\n const rulesId = await resolveChannel(\"rules\", config);\n const serverName = theme.name;\n\n const lines = [\"**Please do not post in this channel.**\", \"\"];\n lines.push(\n verifyId\n ? `To unlock ${serverName}, head to <#${verifyId}> and complete verification.`\n : `To unlock ${serverName}, complete verification in the verification channel.`,\n );\n if (rulesId) lines.push(`New here? Read the rules in <#${rulesId}>.`);\n lines.push(\"\", \"This channel is monitored — anything posted here may be treated as spam.\");\n\n const payload = {\n embeds: [{\n title: \"Do Not Post In This Channel\",\n description: lines.join(\"\\n\"),\n color: theme.embedColor,\n footer: { text: serverName },\n }],\n allowed_mentions: { parse: [] },\n };\n\n return await upsertMessage(\"honeypot\", channelId, config, payload, opts);\n}\n\n// ========================================\n// RENDERING\n// ========================================\n\nfunction escapeHtml(s: string): string {\n return s\n .replace(/&/g, \"&\")\n .replace(//g, \">\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n}\n\nconst DISCORD_GLYPH =\n ``;\n\nfunction shell(\n theme: ResolvedTheme,\n innerHtml: string,\n ogImage: string,\n): string {\n const name = theme.name;\n return `\n\n\n \n \n \n Verify · ${escapeHtml(name)}\n \n \n \n \n \n \n \n \n \n \n \n \n \n\n\n

\n ${innerHtml}\n

\n\n`;\n}\n\n// The portal page is identical for every visitor of a given server (depends\n// only on that server's static config + theme), so build it once per\n// (guild, theme, og) key and reuse the string.\nconst portalPageCache = new Map();\n\nexport function renderPortalPage(\n config: VerifyConfig,\n theme: ResolvedTheme,\n ogImage: string,\n): string {\n const serverName = theme.name;\n const startPath = `/g/${config.guildId}/start`;\n const cacheKey =\n `${config.guildId}|${config.turnstileSiteKey}|${serverName}|${theme.logoUrl}|${theme.accentColor}|${ogImage}`;\n const cached = portalPageCache.get(cacheKey);\n if (cached) return cached;\n const inner = `\n $\"${escapeHtml(serverName)}\"$ \n

Are you human?

${escapeHtml(serverName)} · Access Check

1 Pass the CAPTCHA below
2 Authorize with Discord
3 Receive your verified role

\n \n

Protected by Cloudflare Turnstile

\n \n `;\n const html = shell(theme, inner, ogImage);\n portalPageCache.set(cacheKey, html);\n return html;\n}\n\nexport function renderResultPage(\n theme: ResolvedTheme,\n success: boolean,\n message: string,\n restartHref = \"/\",\n): string {\n const inner = `\n

${success ? \"✓\" : \"✕\"}

${success ? \"Verified\" : \"Verification failed\"}

${escapeHtml(message)}

\n ${success ? \"\" : `

Start Over

`}`;\n return shell(theme, inner, theme.ogFallbackImage);\n}\n\n// ========================================\n// RESPONSE HELPERS\n// ========================================\n\nfunction jsonResponse(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nfunction htmlResponse(body: string, status = 200): Response {\n return new Response(body, {\n status,\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\nfunction redirectUriFor(config: VerifyConfig, url: URL): string {\n return config.redirectUriOverride ?? `${url.origin}/callback`;\n}\n\n// ========================================\n// ROUTE HANDLERS\n// ========================================\n\nasync function handleStart(\n req: Request,\n url: URL,\n config: VerifyConfig,\n): Promise {\n let token = \"\";\n try {\n const body = await req.json();\n token = String(body?.token ?? \"\");\n } catch {\n return jsonResponse({ error: \"Bad request.\" }, 400);\n }\n if (!token) {\n return jsonResponse({ error: \"Please complete the CAPTCHA first.\" }, 400);\n }\n\n const ok = await verifyTurnstile(\n config.turnstileSecretKey,\n token,\n req.headers.get(\"cf-connecting-ip\"),\n );\n if (!ok) {\n return jsonResponse({ error: \"CAPTCHA check failed. Please try again.\" }, 400);\n }\n\n const state = await mintState(config.guildId);\n const authUrl = new URL(\"https://discord.com/oauth2/authorize\");\n authUrl.searchParams.set(\"client_id\", config.clientId);\n authUrl.searchParams.set(\"redirect_uri\", redirectUriFor(config, url));\n authUrl.searchParams.set(\"response_type\", \"code\");\n authUrl.searchParams.set(\"scope\", \"identify\");\n authUrl.searchParams.set(\"state\", state);\n authUrl.searchParams.set(\"prompt\", \"consent\");\n\n return jsonResponse({ url: authUrl.toString() });\n}\n\n/**\n * OAuth callback — a single shared redirect URI for every server. The guild is\n * recovered from the state nonce (not the URL), so one registered redirect URI\n * serves unlimited servers. Loads that server's config + theme, then grants.\n */\nasync function handleCallback(\n url: URL,\n shared: SharedEnv,\n): Promise {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\");\n const oauthError = url.searchParams.get(\"error\");\n\n if (oauthError) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Discord authorization was cancelled.\"));\n }\n if (!code || !state) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Missing authorization data. Please start over.\"));\n }\n\n const consumed = await consumeState(state);\n if (!consumed.ok) {\n return htmlResponse(renderResultPage(defaultTheme, false, consumed.reason));\n }\n\n // Recover the server this nonce was minted for. Legacy nonces (pre-migration,\n // guild_id NULL) fall back to the single guild named in env.\n const guildId = consumed.guildId ?? optEnv(\"DISCORD_GUILD_ID\");\n if (!guildId) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"Invalid session. Please start over.\"));\n }\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return htmlResponse(renderResultPage(defaultTheme, false, \"This server is no longer active. Please contact a moderator.\"));\n }\n const theme = await resolveGuildTheme(guildId);\n const restart = `/g/${guildId}`;\n\n const accessToken = await exchangeCode(config, code, redirectUriFor(config, url));\n if (!accessToken) {\n return htmlResponse(renderResultPage(theme, false, \"Could not authenticate with Discord. Please start over.\", restart));\n }\n\n const user = await fetchDiscordUser(accessToken);\n if (!user) {\n return htmlResponse(renderResultPage(theme, false, \"Could not read your Discord profile. Please start over.\", restart));\n }\n\n const { status, body, code: errorCode } = await grantRole(config, user.id);\n\n if (status === 204) {\n await logVerification(guildId, user, true, \"role granted\");\n await maybeAlertRaid(config, theme);\n const name = user.username ? `, ${user.username}` : \"\";\n return htmlResponse(\n renderResultPage(\n theme,\n true,\n `You're all set${name}! Head back to Discord — your verified role has been granted. You can close this tab.`,\n ),\n );\n }\n\n // Record the precise failure for diagnostics (Discord error codes:\n // 10004 Unknown Guild, 10007 Unknown Member, 10011 Unknown Role,\n // 50013 Missing Permissions, 50001 Missing Access).\n await logVerification(\n guildId,\n user,\n false,\n `role grant failed: status=${status} code=${errorCode ?? \"?\"} body=${body.slice(0, 400)}`,\n );\n\n // Only a genuine \"Unknown Member\" means the user must join first.\n if (status === 404 && errorCode === 10007) {\n return htmlResponse(\n renderResultPage(theme, false, \"You're not in the server yet. Join the Discord first, then come back and verify.\", restart),\n );\n }\n // Everything else is a server-side configuration problem.\n let adminMessage = \"Couldn't assign your role. The verification bot is misconfigured — please contact a moderator.\";\n if (errorCode === 10004) {\n adminMessage = \"The verification bot isn't connected to this server yet. Please contact a moderator.\";\n } else if (errorCode === 10011) {\n adminMessage = \"The verified role no longer exists or is misconfigured. Please contact a moderator.\";\n } else if (status === 403 || errorCode === 50013 || errorCode === 50001) {\n adminMessage = \"The bot doesn't have permission to grant the role (check its permissions and role position). Please contact a moderator.\";\n }\n return htmlResponse(renderResultPage(theme, false, adminMessage, restart));\n}\n\n/** Serve a server's portal page (per-server branding + Turnstile). */\nasync function handlePortal(\n url: URL,\n guildId: string,\n shared: SharedEnv,\n): Promise {\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"This verification link isn't active.\", \"/\"),\n 404,\n );\n }\n const theme = await resolveGuildTheme(guildId);\n const ogImage = `${url.origin}/g/${guildId}/og.png`;\n return new Response(renderPortalPage(config, theme, ogImage), {\n status: 200,\n headers: {\n \"content-type\": \"text/html; charset=utf-8\",\n \"cache-control\": \"public, max-age=3600\",\n },\n });\n}\n\n/** Serve a server's cached OG card, or redirect to its fallback image. */\nasync function handleOgImage(guildId: string): Promise {\n try {\n const { readVerifyOgImage } = await import(\"./og.ts\");\n const png = await readVerifyOgImage(guildId);\n if (png) {\n // A Uint8Array is a valid BodyInit at runtime; the cast satisfies the\n // DOM lib's narrower BufferSource typing.\n return new Response(png as BodyInit, {\n status: 200,\n headers: {\n \"content-type\": \"image/png\",\n \"cache-control\": \"public, max-age=86400, immutable\",\n },\n });\n }\n } catch (e) {\n console.error(\"og read failed:\", e);\n }\n // Not generated yet (the cron builds it) — fall back to the theme image.\n const theme = await resolveGuildTheme(guildId);\n return new Response(null, {\n status: 302,\n headers: { location: theme.ogFallbackImage },\n });\n}\n\n// ========================================\n// PUBLIC ENTRY POINT\n// ========================================\n\nlet migrationRan = false;\n\n/** Run the legacy single-guild migration once per isolate (cheap no-op after\n * the row exists). Keeps an upgraded deployment serving its existing server. */\nasync function ensureMigration(): Promise {\n if (migrationRan) return;\n migrationRan = true;\n try {\n await seedLegacyGuildFromEnv();\n } catch (e) {\n console.error(\"legacy guild seed failed:\", e);\n }\n}\n\n/**\n * Multi-tenant router. Per-server pages live under /g/{guildId}; the OAuth\n * callback is a single shared route that recovers its server from the state\n * nonce. Config + branding are loaded per request from SQLite.\n *\n * GET / -> redirect to the legacy server, if env-named\n * GET /g/{guildId} -> portal page\n * GET /g/{guildId}/og.png -> social card\n * POST /g/{guildId}/start -> verify Turnstile, mint state, return OAuth URL\n * GET /callback -> validate state, grant the verified role\n */\nexport async function handleVerifyRequest(req: Request): Promise {\n const url = new URL(req.url);\n\n try {\n const shared = loadSharedEnv();\n await ensureMigration();\n\n if (req.method === \"GET\" && url.pathname === \"/\") {\n const legacy = optEnv(\"DISCORD_GUILD_ID\");\n if (legacy) {\n return new Response(null, {\n status: 302,\n headers: { location: `/g/${legacy}` },\n });\n }\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"No server specified.\"),\n 404,\n );\n }\n\n // Guarded admin API (/admin/*). Returns null when not an admin path.\n const adminRes = await handleAdminRequest(req, url, shared.adminSecret);\n if (adminRes) return adminRes;\n\n // Shared OAuth callback (guild recovered from the state nonce).\n if (req.method === \"GET\" && url.pathname === \"/callback\") {\n return await handleCallback(url, shared);\n }\n\n // Per-server routes: /g/{guildId}[/start|/og.png]\n const m = url.pathname.match(/^\\/g\\/(\\d+)(\\/[a-z.]+)?$/);\n if (m) {\n const guildId = m[1];\n const sub = m[2] ?? \"\";\n if (req.method === \"GET\" && sub === \"\") {\n return await handlePortal(url, guildId, shared);\n }\n if (req.method === \"GET\" && sub === \"/og.png\") {\n return await handleOgImage(guildId);\n }\n if (req.method === \"POST\" && sub === \"/start\") {\n const config = await loadGuildConfig(guildId, shared);\n if (!config) {\n return jsonResponse({ error: \"Unknown or disabled server.\" }, 404);\n }\n return await handleStart(req, url, config);\n }\n }\n\n return htmlResponse(renderResultPage(defaultTheme, false, \"Page not found.\"), 404);\n } catch (e) {\n console.error(\"verify error:\", e);\n return htmlResponse(\n renderResultPage(defaultTheme, false, \"Something went wrong on our end. Please try again later.\"),\n 500,\n );\n }\n}\n",[217],"cead6647-30d1-4834-a0a2-051c9a56295d","http.ts","f3c73b40-668d-11f1-befe-1607ee4eb77e",86,["D",1781305585901],"http","// ============================================================================\n// Discord CAPTCHA Shield — HTTP entry point (Val Town HTTP trigger)\n// ============================================================================\n//\n// Set this file as the val's HTTP trigger. One deployment shields many Discord\n// servers; each server's config + branding lives in SQLite (see guilds.ts).\n// Routes (served at the val's endpoint or a mapped custom domain):\n// GET /g/{guildId} -> CAPTCHA portal page (per-server branding)\n// POST /g/{guildId}/start -> verify Turnstile, mint state, return OAuth URL\n// GET /g/{guildId}/og.png -> cached social card (generated by the cron)\n// GET /callback -> validate state, grant the verified role\n// GET / -> redirect to the legacy server, if env-named\n//\n// Register/manage servers via the guarded admin API (see admin.ts). The single\n// OAuth app uses one fixed /callback redirect URI for every server.\n// ============================================================================\n\nimport { handleVerifyRequest } from \"./mod.ts\";\n\nexport default async function (req: Request): Promise {\n return await handleVerifyRequest(req);\n}\n",[224],"4a27f189-2947-4a46-96f2-a7dab836c2bc","guilds.ts","55e7cc48-66b3-11f1-854c-1607ee4eb77e",75,["D",1781305585119],"/**\n * Per-server config registry — the source of truth for which Discord servers\n * this deployment shields and how each is configured.\n *\n * One row per guild in the captcha_guilds table (see schema.ts). A row holds\n * the server's role + identity, optional white-label branding overrides (logo,\n * colors, copy, rules), optional per-guild Turnstile keys, alert tuning, and\n * DMZ channel IDs. Anything left null falls back to the shared env / theme.ts\n * defaults at load time (see config.ts `loadGuildConfig` and the theme step).\n *\n * Storing config in SQLite (rather than env) is what makes this multi-tenant:\n * servers can be added, edited, and removed at runtime via the guarded admin\n * API without redeploying the val.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport {\n type AboutInfo,\n type ResolvedTheme,\n resolveTheme,\n type Rule,\n} from \"./theme.ts\";\nimport { ensureSchema, GUILDS_TABLE } from \"./schema.ts\";\n\n/**\n * A server's stored configuration. Optional fields are overrides — when unset,\n * the resolver falls back to shared env (secrets, default Turnstile keys) or to\n * theme.ts (branding). `guildId` + `roleId` are the only hard requirements.\n */\nexport interface GuildConfig {\n guildId: string;\n roleId: string;\n serverName?: string;\n disabled: boolean;\n\n // White-label branding overrides (undefined => theme.ts default).\n brandName?: string;\n logoUrl?: string;\n accentColor?: string; // hex, e.g. \"#F4A340\"\n accentColorBright?: string; // hex\n embedColor?: number; // Discord int color, e.g. 0xf4a340\n ogHeadline?: string;\n ogTagline?: string;\n ogFallbackImage?: string;\n rules?: Rule[];\n about?: AboutInfo;\n\n // Per-guild Turnstile keys (undefined => shared TURNSTILE_* env default).\n turnstileSiteKey?: string;\n turnstileSecretKey?: string;\n\n // Raid-alert config.\n alertWebhookUrl?: string;\n raidThreshold?: number;\n raidWindowMs?: number;\n alertCooldownMs?: number;\n\n // DMZ channels (blob store stays primary; these are env-style fallbacks).\n verifyChannelId?: string;\n rulesChannelId?: string;\n aboutChannelId?: string;\n honeypotChannelId?: string;\n\n // Portal addressing.\n portalUrl?: string;\n redirectUriOverride?: string;\n\n createdAt: number;\n updatedAt: number;\n}\n\n/** Shape accepted when creating/updating a server. Timestamps are stamped by\n * upsertGuild; `disabled` defaults to false. */\nexport type GuildInput =\n & Omit\n & { disabled?: boolean };\n\n// Column order for the upsert. Keep in sync with the CREATE in schema.ts.\nconst COLS = [\n \"guild_id\",\n \"role_id\",\n \"server_name\",\n \"disabled\",\n \"brand_name\",\n \"logo_url\",\n \"accent_color\",\n \"accent_color_bright\",\n \"embed_color\",\n \"og_headline\",\n \"og_tagline\",\n \"og_fallback_image\",\n \"rules_json\",\n \"about_json\",\n \"turnstile_site_key\",\n \"turnstile_secret_key\",\n \"alert_webhook_url\",\n \"raid_threshold\",\n \"raid_window_ms\",\n \"alert_cooldown_ms\",\n \"verify_channel_id\",\n \"rules_channel_id\",\n \"about_channel_id\",\n \"honeypot_channel_id\",\n \"portal_url\",\n \"redirect_uri_override\",\n \"created_at\",\n \"updated_at\",\n] as const;\n\n/** Zip a result row's values onto its column names for order-independent reads. */\nfunction rowObject(\n columns: string[],\n row: unknown[],\n): Record {\n const o: Record = {};\n columns.forEach((c, i) => (o[c] = row[i]));\n return o;\n}\n\n/** Parse a JSON column; undefined on null/blank/garbage (never throws). */\nfunction parseJson(raw: unknown): T | undefined {\n if (typeof raw !== \"string\" || !raw.trim()) return undefined;\n try {\n return JSON.parse(raw) as T;\n } catch {\n return undefined;\n }\n}\n\nconst str = (v: unknown): string | undefined =>\n v == null ? undefined : String(v);\nconst num = (v: unknown): number | undefined =>\n v == null ? undefined : Number(v);\n\n/** Map a captcha_guilds row object to a GuildConfig. */\nfunction rowToGuild(o: Record): GuildConfig {\n return {\n guildId: String(o.guild_id),\n roleId: String(o.role_id),\n serverName: str(o.server_name),\n disabled: Number(o.disabled) === 1,\n brandName: str(o.brand_name),\n logoUrl: str(o.logo_url),\n accentColor: str(o.accent_color),\n accentColorBright: str(o.accent_color_bright),\n embedColor: num(o.embed_color),\n ogHeadline: str(o.og_headline),\n ogTagline: str(o.og_tagline),\n ogFallbackImage: str(o.og_fallback_image),\n rules: parseJson(o.rules_json),\n about: parseJson(o.about_json),\n turnstileSiteKey: str(o.turnstile_site_key),\n turnstileSecretKey: str(o.turnstile_secret_key),\n alertWebhookUrl: str(o.alert_webhook_url),\n raidThreshold: num(o.raid_threshold),\n raidWindowMs: num(o.raid_window_ms),\n alertCooldownMs: num(o.alert_cooldown_ms),\n verifyChannelId: str(o.verify_channel_id),\n rulesChannelId: str(o.rules_channel_id),\n aboutChannelId: str(o.about_channel_id),\n honeypotChannelId: str(o.honeypot_channel_id),\n portalUrl: str(o.portal_url),\n redirectUriOverride: str(o.redirect_uri_override),\n createdAt: Number(o.created_at),\n updatedAt: Number(o.updated_at),\n };\n}\n\n/** Fetch one server's config. Null if it was never registered. */\nexport async function getGuild(guildId: string): Promise {\n await ensureSchema();\n const res = await sqlite.execute({\n sql: `SELECT * FROM ${GUILDS_TABLE} WHERE guild_id = ?`,\n args: [guildId],\n });\n const row = res.rows?.[0];\n if (!row) return null;\n return rowToGuild(rowObject(res.columns ?? [], row as unknown[]));\n}\n\n/** All registered servers, newest first. */\nexport async function listGuilds(): Promise {\n await ensureSchema();\n const res = await sqlite.execute(\n `SELECT * FROM ${GUILDS_TABLE} ORDER BY created_at DESC`,\n );\n const columns = res.columns ?? [];\n return (res.rows ?? []).map((row) =>\n rowToGuild(rowObject(columns, row as unknown[]))\n );\n}\n\n/**\n * Create or update a server's config (keyed by guild_id). On update, every\n * field is replaced from the input except `created_at` (preserved); set or\n * clear an override by passing a value or leaving it undefined.\n */\nexport async function upsertGuild(input: GuildInput): Promise {\n await ensureSchema();\n const now = Date.now();\n const data: Record = {\n guild_id: input.guildId,\n role_id: input.roleId,\n server_name: input.serverName ?? null,\n disabled: input.disabled ? 1 : 0,\n brand_name: input.brandName ?? null,\n logo_url: input.logoUrl ?? null,\n accent_color: input.accentColor ?? null,\n accent_color_bright: input.accentColorBright ?? null,\n embed_color: input.embedColor ?? null,\n og_headline: input.ogHeadline ?? null,\n og_tagline: input.ogTagline ?? null,\n og_fallback_image: input.ogFallbackImage ?? null,\n rules_json: input.rules ? JSON.stringify(input.rules) : null,\n about_json: input.about ? JSON.stringify(input.about) : null,\n turnstile_site_key: input.turnstileSiteKey ?? null,\n turnstile_secret_key: input.turnstileSecretKey ?? null,\n alert_webhook_url: input.alertWebhookUrl ?? null,\n raid_threshold: input.raidThreshold ?? null,\n raid_window_ms: input.raidWindowMs ?? null,\n alert_cooldown_ms: input.alertCooldownMs ?? null,\n verify_channel_id: input.verifyChannelId ?? null,\n rules_channel_id: input.rulesChannelId ?? null,\n about_channel_id: input.aboutChannelId ?? null,\n honeypot_channel_id: input.honeypotChannelId ?? null,\n portal_url: input.portalUrl ?? null,\n redirect_uri_override: input.redirectUriOverride ?? null,\n created_at: now,\n updated_at: now,\n };\n\n // Update everything except the identity and the original creation time.\n const updatable = COLS.filter((c) => c !== \"guild_id\" && c !== \"created_at\");\n const setClause = updatable.map((c) => `${c} = excluded.${c}`).join(\", \");\n\n await sqlite.execute({\n sql: `INSERT INTO ${GUILDS_TABLE} (${COLS.join(\", \")})\n VALUES (${COLS.map(() => \"?\").join(\", \")})\n ON CONFLICT(guild_id) DO UPDATE SET ${setClause}`,\n args: COLS.map((c) => data[c] as never),\n });\n}\n\n/** Toggle a server on/off without deleting its config. Disabled servers stop\n * resolving (the portal + callback treat them as unknown). */\nexport async function setGuildDisabled(\n guildId: string,\n disabled: boolean,\n): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `UPDATE ${GUILDS_TABLE} SET disabled = ?, updated_at = ?\n WHERE guild_id = ?`,\n args: [disabled ? 1 : 0, Date.now(), guildId],\n });\n}\n\n/** Permanently remove a server's config. Verification stops immediately; its\n * state/log rows age out on their own via the cron. */\nexport async function deleteGuild(guildId: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `DELETE FROM ${GUILDS_TABLE} WHERE guild_id = ?`,\n args: [guildId],\n });\n}\n\n/**\n * Resolve a server's full theme: its stored branding overrides layered over the\n * theme.ts defaults. Returns the bare defaults when the guild is unknown (or\n * undefined), so callers always get a complete ResolvedTheme.\n */\nexport async function resolveGuildTheme(\n guildId: string | undefined,\n): Promise {\n const g = guildId ? await getGuild(guildId) : null;\n if (!g) return resolveTheme();\n return resolveTheme({\n serverName: g.serverName,\n brandName: g.brandName,\n logoUrl: g.logoUrl,\n accentColor: g.accentColor,\n accentColorBright: g.accentColorBright,\n embedColor: g.embedColor,\n ogHeadline: g.ogHeadline,\n ogTagline: g.ogTagline,\n ogFallbackImage: g.ogFallbackImage,\n rules: g.rules,\n about: g.about,\n });\n}\n",[232],"cc177afb-267a-48a6-a22b-a37ff025340b","deno.json","f329fa10-668d-11f1-befe-1607ee4eb77e",48,["D",1781289527448],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/98f62cee78e85bfc47c62ed703777c6bc8794f1c/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}\n",[239],"382b0624-1d22-49c3-82b0-489e53c5f4f9","cron.ts","f2d5c9ae-668d-11f1-9138-1607ee4eb77e",84,["D",1781305585670],"interval","// ============================================================================\n// Discord CAPTCHA Shield — data cleanup + OG card refresh (Val Town Cron)\n// ============================================================================\n//\n// Set this file as the val's Cron trigger (daily is plenty). It prunes\n// ephemeral state nonces, ages out the verification audit log, and regenerates\n// each shielded server's social card. Card generation is heavy (satori + resvg\n// cold loads) and exceeds an HTTP request's wall-clock, so it lives here where\n// the cron runs to completion; the og.png route only serves the cached blob.\n// ============================================================================\n\nimport { cleanupVerifyData } from \"./mod.ts\";\nimport { refreshVerifyOgImage } from \"./og.ts\";\nimport { listGuilds, resolveGuildTheme } from \"./guilds.ts\";\nimport { seedLegacyGuildFromEnv } from \"./config.ts\";\n\nconst LOG_RETENTION_DAYS = 7;\n\nexport default async function () {\n // Keep an upgraded single-guild deployment migrated even if no HTTP request\n // has triggered the seed yet.\n await seedLegacyGuildFromEnv();\n\n const result = await cleanupVerifyData(LOG_RETENTION_DAYS);\n console.log(\n `verify cleanup: deleted ${result.states} state nonce(s), ${result.logs} log row(s) older than ${LOG_RETENTION_DAYS}d`,\n );\n\n // Refresh every registered server's card.\n const guilds = await listGuilds();\n for (const g of guilds) {\n try {\n const theme = await resolveGuildTheme(g.guildId);\n const bytes = await refreshVerifyOgImage(g.guildId, theme);\n console.log(`verify og.png[${g.guildId}] refreshed: ${bytes} bytes`);\n } catch (e) {\n console.error(`verify og refresh failed for ${g.guildId}:`, e);\n }\n }\n}\n",[246],"501ac023-f106-4172-9712-c1ea12bb2673","config.ts","f3ce5c4a-668d-11f1-befe-1607ee4eb77e",88,["D",1781305586007],"/**\n * Configuration loading for the Discord CAPTCHA Shield.\n *\n * Multi-tenant split:\n * - SHARED, per-deployment values come from env (Val Town Settings →\n * Environment Variables): the one Discord app's credentials, the bot token,\n * a default Turnstile keypair, and the admin secret. See loadSharedEnv().\n * - PER-SERVER values come from the captcha_guilds SQLite table (see\n * guilds.ts): role, branding, channels, alert tuning, optional Turnstile\n * override. loadGuildConfig() merges a server's row with the shared env to\n * build the VerifyConfig the request handlers consume.\n *\n * Visual branding lives in ./theme.ts (defaults) and per-server overrides in\n * the guild row. See README.md for the full variable reference.\n */\n\nimport type { VerifyConfig } from \"./mod.ts\";\nimport { type GuildConfig, getGuild, upsertGuild } from \"./guilds.ts\";\nimport { migrateLegacyLog } from \"./schema.ts\";\nimport { migrateLegacyKeys } from \"./store.ts\";\n\n/** Required env var — throws a clear error if unset. */\nexport function env(key: string): string {\n const value = Deno.env.get(key);\n if (!value) throw new Error(`Missing required environment variable: ${key}`);\n return value;\n}\n\n/** Optional env var. Guarded with has() so we never get() an unset key\n * (avoids Val Town's \"environment variable not set\" log warnings). */\nexport function optEnv(key: string): string | undefined {\n return Deno.env.has(key) ? (Deno.env.get(key) || undefined) : undefined;\n}\n\n/** Optional numeric env var; undefined if unset or not a finite number. */\nexport function optNum(key: string): number | undefined {\n const raw = optEnv(key);\n if (raw === undefined) return undefined;\n const n = Number(raw);\n return Number.isFinite(n) ? n : undefined;\n}\n\n/** Optional \"minutes\" env var, returned as milliseconds. */\nexport function optMinutesToMs(key: string): number | undefined {\n const min = optNum(key);\n return min === undefined ? undefined : min * 60 * 1000;\n}\n\n/**\n * Shared, per-deployment configuration: the single Discord app + bot all\n * shielded servers run through, a default Turnstile keypair, and the admin\n * secret. Per-server values come from the guild row, not from here.\n */\nexport interface SharedEnv {\n clientId: string;\n clientSecret: string;\n botToken: string;\n /** Default Turnstile site key. Optional — a guild may set its own. */\n turnstileSiteKey?: string;\n /** Default Turnstile secret key. Optional — a guild may set its own. */\n turnstileSecretKey?: string;\n /** Bearer secret guarding the /admin API. No admin API if unset. */\n adminSecret?: string;\n}\n\n/** Load the shared, per-deployment env. The Discord app credentials are\n * required; Turnstile keys are optional here because a guild may override. */\nexport function loadSharedEnv(): SharedEnv {\n return {\n clientId: env(\"DISCORD_CLIENT_ID\"),\n clientSecret: env(\"DISCORD_CLIENT_SECRET\"),\n botToken: env(\"DISCORD_BOT_TOKEN\"),\n turnstileSiteKey: optEnv(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: optEnv(\"TURNSTILE_SECRET_KEY\"),\n adminSecret: optEnv(\"ADMIN_SECRET\"),\n };\n}\n\n/** Merge a guild row with the shared env into a VerifyConfig. Turnstile keys\n * fall back to \"\" when neither per-guild nor shared — callers that need them\n * (the verification flow) must check; tooling that doesn't can ignore. */\nfunction mergeGuildConfig(\n guild: GuildConfig,\n shared: SharedEnv,\n): VerifyConfig {\n return {\n clientId: shared.clientId,\n clientSecret: shared.clientSecret,\n botToken: shared.botToken,\n guildId: guild.guildId,\n roleId: guild.roleId,\n turnstileSiteKey: guild.turnstileSiteKey ?? shared.turnstileSiteKey ?? \"\",\n turnstileSecretKey: guild.turnstileSecretKey ??\n shared.turnstileSecretKey ?? \"\",\n serverName: guild.serverName,\n redirectUriOverride: guild.redirectUriOverride,\n alertWebhookUrl: guild.alertWebhookUrl,\n raidThreshold: guild.raidThreshold,\n raidWindowMs: guild.raidWindowMs,\n alertCooldownMs: guild.alertCooldownMs,\n verifyChannelId: guild.verifyChannelId,\n rulesChannelId: guild.rulesChannelId,\n honeypotChannelId: guild.honeypotChannelId,\n aboutChannelId: guild.aboutChannelId,\n portalUrl: guild.portalUrl,\n };\n}\n\n/**\n * Build a VerifyConfig for one server for the verification flow. Returns null\n * when the server isn't registered or is disabled. Throws only when no\n * Turnstile keys are available at all (neither per-guild nor a shared default)\n * — a genuine misconfiguration the visitor can't get past.\n */\nexport async function loadGuildConfig(\n guildId: string,\n shared: SharedEnv = loadSharedEnv(),\n): Promise {\n const guild = await getGuild(guildId);\n if (!guild || guild.disabled) return null;\n\n const config = mergeGuildConfig(guild, shared);\n if (!config.turnstileSiteKey || !config.turnstileSecretKey) {\n throw new Error(\n `No Turnstile keys for guild ${guildId}: set them on the guild or via ` +\n `the TURNSTILE_SITE_KEY / TURNSTILE_SECRET_KEY env defaults.`,\n );\n }\n return config;\n}\n\n/**\n * Build a VerifyConfig for the admin/DMZ tools (setup.ts, post-*.ts). Unlike\n * loadGuildConfig this does NOT require Turnstile keys (the tools only post\n * messages + create channels) and works on disabled servers. Returns null when\n * the server isn't registered.\n */\nexport async function loadGuildToolConfig(\n guildId: string,\n shared: SharedEnv = loadSharedEnv(),\n): Promise {\n const guild = await getGuild(guildId);\n return guild ? mergeGuildConfig(guild, shared) : null;\n}\n\n/**\n * Resolve which server a manual tool run targets. Order: explicit argument, the\n * first CLI arg, then the TOOL_GUILD_ID / DISCORD_GUILD_ID env vars. Throws a\n * clear error if none is set.\n */\nexport function toolGuildId(explicit?: string): string {\n const id = explicit ?? Deno.args?.[0] ?? optEnv(\"TOOL_GUILD_ID\") ??\n optEnv(\"DISCORD_GUILD_ID\");\n if (!id) {\n throw new Error(\n \"No server specified. Pass a guild id as the first argument, or set \" +\n \"TOOL_GUILD_ID (or DISCORD_GUILD_ID) in the environment.\",\n );\n }\n return id;\n}\n\n/**\n * One-time migration for deployments upgrading from the single-guild build.\n *\n * If DISCORD_GUILD_ID is still set in env and no matching guild row exists yet,\n * seed a captcha_guilds row from the legacy env vars and backfill `guild_id` on\n * existing state/log rows so the audit history isn't orphaned. Returns the\n * seeded guild id (or the already-present one), else null. Safe to call on\n * every boot — it no-ops once the row exists.\n */\nexport async function seedLegacyGuildFromEnv(): Promise {\n const guildId = optEnv(\"DISCORD_GUILD_ID\");\n if (!guildId) return null;\n if (await getGuild(guildId)) return guildId;\n\n const redirect = optEnv(\"VERIFY_REDIRECT_URI\");\n await upsertGuild({\n guildId,\n roleId: env(\"DISCORD_ROLE_ID\"),\n serverName: optEnv(\"VERIFY_SERVER_NAME\"),\n turnstileSiteKey: optEnv(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: optEnv(\"TURNSTILE_SECRET_KEY\"),\n alertWebhookUrl: optEnv(\"VERIFY_ALERT_WEBHOOK\"),\n raidThreshold: optNum(\"VERIFY_RAID_THRESHOLD\"),\n raidWindowMs: optMinutesToMs(\"VERIFY_RAID_WINDOW_MIN\"),\n alertCooldownMs: optMinutesToMs(\"VERIFY_ALERT_COOLDOWN_MIN\"),\n verifyChannelId: optEnv(\"DISCORD_VERIFY_CHANNEL_ID\"),\n rulesChannelId: optEnv(\"DISCORD_RULES_CHANNEL_ID\"),\n honeypotChannelId: optEnv(\"DISCORD_HONEYPOT_CHANNEL_ID\"),\n aboutChannelId: optEnv(\"DISCORD_ABOUT_CHANNEL_ID\"),\n portalUrl: optEnv(\"VERIFY_PORTAL_URL\") ??\n (redirect ? redirect.replace(/\\/callback$/, \"\") : undefined),\n redirectUriOverride: redirect,\n });\n // Copy the single-guild audit log forward into the guild-scoped table.\n await migrateLegacyLog(guildId);\n // Re-home channel/message IDs from the old un-namespaced blob keys so post\n // tools keep editing in place instead of duplicating.\n await migrateLegacyKeys(guildId);\n return guildId;\n}\n\n/**\n * LEGACY single-guild loader — builds a VerifyConfig straight from env.\n *\n * @deprecated Retained so the current HTTP/cron/setup entry points keep working\n * until they are rewired to the per-guild router. New code should resolve a\n * server with loadGuildConfig(guildId). Removed once routing lands.\n */\nexport function loadConfig(): VerifyConfig {\n const redirect = optEnv(\"VERIFY_REDIRECT_URI\");\n return {\n clientId: env(\"DISCORD_CLIENT_ID\"),\n clientSecret: env(\"DISCORD_CLIENT_SECRET\"),\n botToken: env(\"DISCORD_BOT_TOKEN\"),\n guildId: env(\"DISCORD_GUILD_ID\"),\n roleId: env(\"DISCORD_ROLE_ID\"),\n turnstileSiteKey: env(\"TURNSTILE_SITE_KEY\"),\n turnstileSecretKey: env(\"TURNSTILE_SECRET_KEY\"),\n serverName: optEnv(\"VERIFY_SERVER_NAME\"),\n redirectUriOverride: redirect,\n alertWebhookUrl: optEnv(\"VERIFY_ALERT_WEBHOOK\"),\n raidThreshold: optNum(\"VERIFY_RAID_THRESHOLD\"),\n raidWindowMs: optMinutesToMs(\"VERIFY_RAID_WINDOW_MIN\"),\n alertCooldownMs: optMinutesToMs(\"VERIFY_ALERT_COOLDOWN_MIN\"),\n verifyChannelId: optEnv(\"DISCORD_VERIFY_CHANNEL_ID\"),\n rulesChannelId: optEnv(\"DISCORD_RULES_CHANNEL_ID\"),\n honeypotChannelId: optEnv(\"DISCORD_HONEYPOT_CHANNEL_ID\"),\n aboutChannelId: optEnv(\"DISCORD_ABOUT_CHANNEL_ID\"),\n portalUrl: optEnv(\"VERIFY_PORTAL_URL\") ??\n (redirect ? redirect.replace(/\\/callback$/, \"\") : undefined),\n };\n}\n",[254],"02420742-505b-4824-a27f-62b9cdb935a3","channels.ts","f2f643a0-668d-11f1-bf75-1607ee4eb77e",81,["D",1781305585471],"/**\n * One-shot creation of the DMZ channels the shield posts into.\n *\n * Run via setup.ts. Creates a category + four text channels (about, rules,\n * verify, honeypot) with sensible @everyone permission overwrites, and stores\n * every ID in the blob store so the post tools find them automatically and the\n * run is idempotent (re-running skips channels that still exist).\n *\n * Requires the bot to have **Manage Channels** (in addition to the permissions\n * the rest of the shield needs). The shield never creates channels on its own —\n * only this explicit setup path does.\n */\n\nimport type { VerifyConfig } from \"./mod.ts\";\nimport {\n type ChannelKind,\n getCategory,\n getChannel,\n rememberCategory,\n rememberChannel,\n} from \"./store.ts\";\n\nconst DISCORD_API = \"https://discord.com/api/v10\";\n\n// Discord permission bits (as strings, since they're 53-bit-safe here).\nconst VIEW_CHANNEL = 1 << 10; // 1024\nconst SEND_MESSAGES = 1 << 11; // 2048\nconst EMBED_LINKS = 1 << 14; // 16384\n\nconst CHANNEL_TYPE_TEXT = 0;\nconst CHANNEL_TYPE_CATEGORY = 4;\nconst OVERWRITE_ROLE = 0;\nconst OVERWRITE_MEMBER = 1;\n\ninterface ChannelSpec {\n kind: ChannelKind;\n name: string;\n topic: string;\n /** Honeypot lets @everyone post (that's the trap); the rest are read-only. */\n everyoneCanSend: boolean;\n}\n\nconst DMZ_CHANNELS: ChannelSpec[] = [\n {\n kind: \"about\",\n name: \"about\",\n topic: \"What this community is about. Read before you verify.\",\n everyoneCanSend: false,\n },\n {\n kind: \"rules\",\n name: \"rules\",\n topic: \"The server rules. By being here you agree to them.\",\n everyoneCanSend: false,\n },\n {\n kind: \"verify\",\n name: \"verify\",\n topic: \"Click Verify, pass a quick CAPTCHA, and the server unlocks.\",\n everyoneCanSend: false,\n },\n {\n kind: \"honeypot\",\n name: \"do-not-post\",\n topic: \"Do not post here. This channel is a spam trap.\",\n everyoneCanSend: true,\n },\n];\n\nconst CATEGORY_NAME = \"Welcome\";\n\nexport interface CreateResult {\n kind: ChannelKind | \"category\";\n name: string;\n status: \"created\" | \"exists\" | \"failed\";\n id?: string;\n detail?: string;\n}\n\nfunction authHeaders(config: VerifyConfig): HeadersInit {\n return {\n authorization: `Bot ${config.botToken}`,\n \"content-type\": \"application/json\",\n };\n}\n\n/** True if a channel with this ID still exists and the bot can see it. */\nasync function channelExists(config: VerifyConfig, id: string): Promise {\n const res = await fetch(`${DISCORD_API}/channels/${id}`, {\n headers: authHeaders(config),\n });\n return res.ok;\n}\n\n/** Overwrites that make a channel visible to everyone but writable only by the\n * bot (read-only), or writable by everyone (the honeypot trap). The bot always\n * keeps an explicit allow so a read-only @everyone deny can't mute it. */\nfunction overwritesFor(config: VerifyConfig, everyoneCanSend: boolean) {\n const everyoneAllow = VIEW_CHANNEL | (everyoneCanSend ? SEND_MESSAGES : 0);\n const everyoneDeny = everyoneCanSend ? 0 : SEND_MESSAGES;\n return [\n {\n id: config.guildId, // @everyone role id == guild id\n type: OVERWRITE_ROLE,\n allow: String(everyoneAllow),\n deny: String(everyoneDeny),\n },\n {\n id: config.clientId, // a bot's user id == its application/client id\n type: OVERWRITE_MEMBER,\n allow: String(VIEW_CHANNEL | SEND_MESSAGES | EMBED_LINKS),\n deny: \"0\",\n },\n ];\n}\n\n/** Ensure the DMZ category exists; return its ID (or \"\" if creation failed). */\nasync function ensureCategory(\n config: VerifyConfig,\n results: CreateResult[],\n): Promise {\n const existing = await getCategory(config.guildId);\n if (existing && await channelExists(config, existing)) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"exists\",\n id: existing,\n });\n return existing;\n }\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify({ name: CATEGORY_NAME, type: CHANNEL_TYPE_CATEGORY }),\n });\n if (!res.ok) {\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n });\n return \"\";\n }\n const created = await res.json();\n await rememberCategory(config.guildId, created.id);\n results.push({\n kind: \"category\",\n name: CATEGORY_NAME,\n status: \"created\",\n id: created.id,\n });\n return created.id;\n}\n\n/** Create (or confirm) one DMZ channel, storing its ID in blob. */\nasync function ensureChannel(\n config: VerifyConfig,\n spec: ChannelSpec,\n parentId: string,\n): Promise {\n const existingId = await getChannel(config.guildId, spec.kind);\n if (existingId && await channelExists(config, existingId)) {\n return { kind: spec.kind, name: spec.name, status: \"exists\", id: existingId };\n }\n\n const body: Record = {\n name: spec.name,\n type: CHANNEL_TYPE_TEXT,\n topic: spec.topic,\n permission_overwrites: overwritesFor(config, spec.everyoneCanSend),\n };\n if (parentId) body.parent_id = parentId;\n\n const res = await fetch(`${DISCORD_API}/guilds/${config.guildId}/channels`, {\n method: \"POST\",\n headers: authHeaders(config),\n body: JSON.stringify(body),\n });\n if (!res.ok) {\n return {\n kind: spec.kind,\n name: spec.name,\n status: \"failed\",\n detail: `Discord ${res.status}: ${(await res.text()).slice(0, 200)}`,\n };\n }\n const created = await res.json();\n await rememberChannel(config.guildId, spec.kind, created.id);\n return { kind: spec.kind, name: spec.name, status: \"created\", id: created.id };\n}\n\n/**\n * Create (or confirm) the DMZ category + channels, storing every ID in blob.\n * Idempotent: a channel already recorded and still present is left untouched.\n * The category is created first (channels nest under it); the channels then go\n * up concurrently — safe because each writes its own per-kind blob key.\n */\nexport async function createDmzChannels(\n config: VerifyConfig,\n): Promise {\n const results: CreateResult[] = [];\n const parentId = await ensureCategory(config, results);\n\n const channelResults = await Promise.all(\n DMZ_CHANNELS.map((spec) => ensureChannel(config, spec, parentId)),\n );\n results.push(...channelResults);\n return results;\n}\n",[261],"8c9e0eae-e03f-4db3-b075-582e4d2f8af3","admin.ts","56077a0c-66b3-11f1-854c-1607ee4eb77e",79,["D",1781305585262],"/**\n * Guarded admin API — register and manage shielded servers at runtime, so\n * onboarding a new Discord never needs a redeploy.\n *\n * All routes live under /admin/guilds and require a bearer token matching the\n * ADMIN_SECRET env var (constant-time compared). If ADMIN_SECRET is unset the\n * API is disabled entirely (404). Secrets are never echoed back in responses.\n *\n * GET /admin/guilds list all servers\n * POST /admin/guilds create a server (body: full config; 409 if it exists)\n * GET /admin/guilds/{id} fetch one server\n * PUT /admin/guilds/{id} create or replace a server\n * PATCH /admin/guilds/{id} partially update an existing server\n * DELETE /admin/guilds/{id} remove a server\n *\n * Request/response bodies use the camelCase GuildInput/GuildConfig shape (see\n * guilds.ts). Branding (logo, colors, rules, about) and per-guild Turnstile\n * keys are all settable here.\n */\n\nimport {\n deleteGuild,\n getGuild,\n type GuildConfig,\n type GuildInput,\n listGuilds,\n upsertGuild,\n} from \"./guilds.ts\";\n\n// ========================================\n// AUTH\n// ========================================\n\n/** Constant-time secret comparison via fixed-length SHA-256 digests (so neither\n * length nor content leaks through timing). */\nasync function tokenMatches(provided: string, secret: string): Promise {\n const enc = new TextEncoder();\n const [a, b] = await Promise.all([\n crypto.subtle.digest(\"SHA-256\", enc.encode(provided)),\n crypto.subtle.digest(\"SHA-256\", enc.encode(secret)),\n ]);\n const av = new Uint8Array(a);\n const bv = new Uint8Array(b);\n let diff = 0;\n for (let i = 0; i < av.length; i++) diff |= av[i] ^ bv[i];\n return diff === 0;\n}\n\n/** Extract the bearer token from the Authorization header. */\nfunction bearer(req: Request): string | null {\n const h = req.headers.get(\"authorization\") ?? \"\";\n const m = h.match(/^Bearer\\s+(.+)$/i);\n return m ? m[1].trim() : null;\n}\n\n// ========================================\n// RESPONSES + VALIDATION\n// ========================================\n\n/** A validation/authorization failure carrying the HTTP status to return. */\nclass AdminError extends Error {\n constructor(readonly status: number, message: string) {\n super(message);\n }\n}\n\nconst bad = (msg: string) => new AdminError(400, msg);\n\nfunction json(data: unknown, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"content-type\": \"application/json\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\n/** Hide the Turnstile secret from responses; report only whether one is set. */\nfunction redact(g: GuildConfig): Record {\n const { turnstileSecretKey, ...rest } = g;\n return { ...rest, hasTurnstileSecretKey: Boolean(turnstileSecretKey) };\n}\n\nconst isSnowflake = (v: unknown): v is string =>\n typeof v === \"string\" && /^\\d+$/.test(v);\n\nfunction asString(v: unknown, key: string): string {\n if (typeof v !== \"string\") throw bad(`${key} must be a string`);\n return v;\n}\n\nfunction asBool(v: unknown, key: string): boolean {\n if (typeof v !== \"boolean\") throw bad(`${key} must be a boolean`);\n return v;\n}\n\nfunction asNumber(v: unknown, key: string): number {\n const n = typeof v === \"string\" ? Number(v) : v;\n if (typeof n !== \"number\" || !Number.isFinite(n)) {\n throw bad(`${key} must be a number`);\n }\n return n;\n}\n\nfunction asSnowflake(v: unknown, key: string): string {\n if (!isSnowflake(v)) throw bad(`${key} must be a numeric Discord ID`);\n return v;\n}\n\nfunction asColor(v: unknown, key: string): string {\n const s = asString(v, key);\n if (!/^#?[0-9a-fA-F]{3}([0-9a-fA-F]{3})?$/.test(s)) {\n throw bad(`${key} must be a hex color like #F4A340`);\n }\n return s.startsWith(\"#\") ? s : `#${s}`;\n}\n\n/** Accept a Discord int color, a numeric string, or a #RRGGBB hex string. */\nfunction asEmbedColor(v: unknown, key: string): number {\n if (typeof v === \"string\" && v.startsWith(\"#\")) {\n const n = parseInt(v.slice(1), 16);\n if (Number.isNaN(n)) throw bad(`${key} must be a hex color`);\n return n;\n }\n return asNumber(v, key);\n}\n\nfunction asRules(v: unknown, key: string): { name: string; value: string }[] {\n if (!Array.isArray(v)) throw bad(`${key} must be an array`);\n return v.map((r, i) => {\n if (!r || typeof r !== \"object\") throw bad(`${key}[${i}] must be an object`);\n const o = r as Record;\n return {\n name: asString(o.name, `${key}[${i}].name`),\n value: asString(o.value, `${key}[${i}].value`),\n };\n });\n}\n\nfunction asAbout(v: unknown, key: string) {\n if (!v || typeof v !== \"object\") throw bad(`${key} must be an object`);\n const o = v as Record;\n return {\n tagline: asString(o.tagline, `${key}.tagline`),\n description: asString(o.description, `${key}.description`),\n highlights: asRules(o.highlights ?? [], `${key}.highlights`),\n };\n}\n\n// Per-field validators. A field present in the body (even as null) is processed;\n// null clears the override. Absent fields are left untouched (PATCH-friendly).\nconst FIELDS: Record unknown> = {\n guildId: asSnowflake,\n roleId: asSnowflake,\n serverName: asString,\n disabled: asBool,\n brandName: asString,\n logoUrl: asString,\n accentColor: asColor,\n accentColorBright: asColor,\n embedColor: asEmbedColor,\n ogHeadline: asString,\n ogTagline: asString,\n ogFallbackImage: asString,\n rules: asRules,\n about: asAbout,\n turnstileSiteKey: asString,\n turnstileSecretKey: asString,\n alertWebhookUrl: asString,\n raidThreshold: asNumber,\n raidWindowMs: asNumber,\n alertCooldownMs: asNumber,\n verifyChannelId: asString,\n rulesChannelId: asString,\n aboutChannelId: asString,\n honeypotChannelId: asString,\n portalUrl: asString,\n redirectUriOverride: asString,\n};\n\n/** Read + validate only the GuildInput fields present in the body. A field set\n * to null becomes undefined (clear the override). Unknown keys are ignored. */\nfunction readGuildFields(body: Record): Partial {\n const out: Record = {};\n for (const key of Object.keys(FIELDS) as (keyof GuildInput)[]) {\n if (!(key in body)) continue;\n const raw = body[key];\n out[key] = raw === null ? undefined : FIELDS[key](raw, key);\n }\n return out as Partial;\n}\n\nasync function parseBody(req: Request): Promise> {\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n throw bad(\"Body must be valid JSON.\");\n }\n if (!body || typeof body !== \"object\" || Array.isArray(body)) {\n throw bad(\"Body must be a JSON object.\");\n }\n return body as Record;\n}\n\n/** Drop server-managed timestamps so a fetched config can seed an update. */\nfunction toInput(g: GuildConfig): GuildInput {\n const { createdAt: _c, updatedAt: _u, ...input } = g;\n return input;\n}\n\n// ========================================\n// ROUTER\n// ========================================\n\n/**\n * Handle an /admin request. `secret` is the configured ADMIN_SECRET (undefined\n * disables the API). Returns null only if the path isn't an admin path, so the\n * caller can fall through to other routes.\n */\nexport async function handleAdminRequest(\n req: Request,\n url: URL,\n secret: string | undefined,\n): Promise {\n const parts = url.pathname.split(\"/\").filter(Boolean); // e.g. [\"admin\",\"guilds\",\"123\"]\n if (parts[0] !== \"admin\") return null;\n\n // API disabled when no secret is configured — don't reveal it exists.\n if (!secret) return json({ error: \"Not found.\" }, 404);\n\n const token = bearer(req);\n if (!token || !(await tokenMatches(token, secret))) {\n return new Response(JSON.stringify({ error: \"Unauthorized.\" }), {\n status: 401,\n headers: {\n \"content-type\": \"application/json\",\n \"cache-control\": \"no-store\",\n \"www-authenticate\": \"Bearer\",\n },\n });\n }\n\n if (parts[1] !== \"guilds\") return json({ error: \"Not found.\" }, 404);\n const id = parts[2];\n\n try {\n // Collection: /admin/guilds\n if (parts.length === 2) {\n if (req.method === \"GET\") {\n return json({ guilds: (await listGuilds()).map(redact) });\n }\n if (req.method === \"POST\") {\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n if (!isSnowflake(fields.guildId)) throw bad(\"guildId is required.\");\n if (!isSnowflake(fields.roleId)) throw bad(\"roleId is required.\");\n if (await getGuild(fields.guildId)) {\n throw new AdminError(\n 409,\n `Server ${fields.guildId} already exists — use PUT or PATCH.`,\n );\n }\n await upsertGuild(fields as GuildInput);\n const saved = await getGuild(fields.guildId);\n return json(saved ? redact(saved) : {}, 201);\n }\n return json({ error: \"Method not allowed.\" }, 405);\n }\n\n // Item: /admin/guilds/{id}\n if (parts.length === 3 && id) {\n if (req.method === \"GET\") {\n const g = await getGuild(id);\n return g ? json(redact(g)) : json({ error: \"Not found.\" }, 404);\n }\n if (req.method === \"PUT\") {\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n // Path id is authoritative.\n const merged = { ...fields, guildId: id } as GuildInput;\n if (!isSnowflake(merged.roleId)) throw bad(\"roleId is required.\");\n await upsertGuild(merged);\n const saved = await getGuild(id);\n return json(saved ? redact(saved) : {});\n }\n if (req.method === \"PATCH\") {\n const existing = await getGuild(id);\n if (!existing) return json({ error: \"Not found.\" }, 404);\n const body = await parseBody(req);\n const fields = readGuildFields(body);\n // Overlay the patch on the existing config; path id stays authoritative.\n const merged = { ...toInput(existing), ...fields, guildId: id };\n await upsertGuild(merged);\n const saved = await getGuild(id);\n return json(saved ? redact(saved) : {});\n }\n if (req.method === \"DELETE\") {\n if (!(await getGuild(id))) return json({ error: \"Not found.\" }, 404);\n await deleteGuild(id);\n return json({ deleted: id });\n }\n return json({ error: \"Method not allowed.\" }, 405);\n }\n\n return json({ error: \"Not found.\" }, 404);\n } catch (e) {\n if (e instanceof AdminError) return json({ error: e.message }, e.status);\n console.error(\"admin error:\", e);\n return json({ error: \"Internal error.\" }, 500);\n }\n}\n",[268],"1ca0a5ca-6934-4e1c-a4a8-654bac78f0e4","README.md","f3e36766-668d-11f1-befe-1607ee4eb77e",90,["D",1781305586222],"# 🐱 Discord CAPTCHA Shield\n\nA drop-in, self-hostable **CAPTCHA + Discord OAuth verification gate** for your\nDiscord servers — built to run on [Val Town](https://val.town). New members solve\na Cloudflare Turnstile CAPTCHA, authorize with Discord, and a bot automatically\ngrants them your **Verified** role. Bots and raid scripts don't get in.\n\n**One deployment shields many servers.** Each server gets its own configuration\nand branding, stored in SQLite and managed at runtime through a guarded admin\nAPI — no redeploy to onboard a new server.\n\n> Made by **catalloc**. Remix it, re-skin it, ship it. The whole thing is one\n> small Val Town project with no build step and no servers to run.\n\n

$\"Discord$

\n\n---\n\n## What you get\n\n- **A branded portal per server** (`/g/{guildId}`) — CAPTCHA → \"Continue with\n Discord\" → done. Each server's logo, colors, name, and copy are its own.\n- **Multi-tenant from one val** — per-server config (role, branding, channels,\n alert tuning, optional Turnstile keys) lives in SQLite, keyed by guild id.\n- **A guarded admin API** (`/admin/guilds`) — add, edit, and remove servers at\n runtime with a bearer token. No redeploy.\n- **One shared Discord app + bot** — a single OAuth app with **one** registered\n `/callback` redirect URI serves unlimited servers (the guild is carried in the\n one-time state nonce, not the URL).\n- **One-time, single-use state nonces** (SQLite) bound to a passed CAPTCHA *and*\n a specific server, so a callback can't be replayed, forged, or cross-wired.\n- **Automatic role grant** via the bot using only the `identify` OAuth scope (the\n shield never sees a password and never reads message content).\n- **Per-server raid alerts** — a Discord webhook ping when an abnormal number of\n *successful* verifications land in a short window, counted and debounced per\n server (the farmed-account pattern Turnstile can't catch).\n- **A dynamic social card per server** (`/g/{guildId}/og.png`) rendered with\n satori + resvg and cached.\n- **Per-server DMZ bootstrap** (`setup.ts`) — the bot creates the `#about`,\n `#rules`, `#verify`, and `#do-not-post` channels (read-only, honeypot open)\n and posts every message into them.\n- **Editable messages** — re-running a post tool updates the existing message in\n place instead of duplicating it (channel + message IDs are kept in blob,\n namespaced per guild).\n- **An audit log** of every attempt (per server), auto-pruned after 7 days.\n\n## How it works\n\n```\nVisitor Portal (this val) Discord\n │ GET /g/{id} ───────────▶ load server config + theme (SQLite)\n │ render CAPTCHA page\n │ solve Turnstile\n │ POST /g/{id}/start ────▶ verify token w/ Cloudflare\n │ mint one-time state nonce bound to {id}\n │ ◀──────────── OAuth URL\n │ authorize (identify) ─────────────────────────────▶ consent screen\n │ GET /callback?code&state ◀──────────────────────── redirect back\n │ burn nonce → recover {id},\n │ exchange code, read user id,\n │ PUT role in {id} ─────────▶ role granted ✅\n │ ◀──────────── \"Verified\" result page\n```\n\nThe `/callback` redirect URI is the **same for every server** — the server is\nrecovered from the `state` nonce, so you register just one redirect URI in the\nDiscord app no matter how many servers you shield.\n\nRoles gate **channel access**. Lock `@everyone` down to a single `#verify`\nchannel and grant the rest to the Verified role — see\n[`HARDENING.md`](./HARDENING.md) for the full lockdown + the limits of this model\n(DMs / member-list visibility).\n\n---\n\n## Files\n\n```\nhttp.ts # HTTP trigger — the multi-tenant router (set as HTTP val)\ncron.ts # Cron trigger — daily cleanup + per-server OG card refresh\nmod.ts # Verification logic + routing (Turnstile, OAuth, role grant, UI)\nadmin.ts # Guarded /admin API to register & manage servers at runtime\nguilds.ts # Per-server config registry (CRUD over the captcha_guilds table)\nschema.ts # Centralized SQLite schema + migrations\nconfig.ts # Env split: shared secrets + per-server config loaders\ntheme.ts # 🎨 Default branding (per-server overrides live in each server's config)\nog.ts # Per-server /og.png social card generator\nstore.ts # Blob-backed store of created channel + posted message IDs (per guild)\nchannels.ts # Creates the DMZ channels (used by setup.ts)\nsetup.ts # Bot creates the DMZ channels AND posts every message, for one server\npost-verify.ts # Bot posts (or updates) the Verify button for one server\npost-rules.ts # ... the rules embed\npost-about.ts # ... the \"About the community\" card\npost-honeypot.ts # ... the honeypot \"do not post\" trap\ndeno.json # Val Town / Deno config\n```\n\n---\n\n## Installation\n\nYou'll need ~15 minutes, one or more Discord servers you administer, and free\nCloudflare + Val Town accounts. **One Discord app + bot is shared across every\nserver you shield.**\n\n### 1. Create ONE Discord application & bot\n\n1. Go to the [Discord Developer Portal](https://discord.com/developers/applications)\n → **New Application**.\n2. **OAuth2** tab → copy the **Client ID** and **Client Secret**.\n3. **Bot** tab → **Add Bot** → **Reset Token** and copy the **Bot Token**.\n - The default (non-privileged) intents are fine — this shield never reads\n message content or the member list.\n4. **Invite the bot to each server** you want to shield, with the `bot` scope and\n these permissions:\n\n | Permission | Why |\n | --- | --- |\n | **Manage Roles** | Grant the Verified role on a successful verification |\n | **View Channel** | See the DMZ channels it posts into |\n | **Send Messages** | Post the verify / rules / about / honeypot messages |\n | **Embed Links** | Those messages are rich embeds |\n\n Quick invite URL (replace `CLIENT_ID`) — the `permissions` integer already\n bundles all four:\n ```\n https://discord.com/oauth2/authorize?client_id=CLIENT_ID&scope=bot&permissions=268454912\n ```\n\n **Want the bot to auto-create the DMZ channels** via `setup.ts`? Also grant\n **Manage Channels** — use `permissions=268454928` instead. If you'll make the\n channels yourself, the shield never needs it.\n\n### 2. Per server: Verified role & IDs\n\nFor **each** server you'll shield:\n\n1. Create a **Verified** role. Copy its ID (enable *Developer Mode* in Discord\n → User Settings → Advanced, then right-click the role → **Copy ID**).\n2. **Important — role hierarchy:** drag the **bot's own role above the Verified\n role** in Server Settings → Roles. A bot can only assign roles *below* its\n highest role.\n3. Right-click the server → **Copy Server ID** (that's the **Guild ID**).\n4. (Recommended) Lock the server down: deny `@everyone` **View Channel**\n everywhere except a single `#verify` channel; grant the real channels to the\n Verified role. See [`HARDENING.md`](./HARDENING.md).\n\nYou'll register these IDs with the admin API in step 6.\n\n### 3. Get a Cloudflare Turnstile keypair (free)\n\n1. Cloudflare Dashboard → **Turnstile** → **Add site**.\n2. Add the domain you'll serve the portal from (your val's domain — e.g.\n `your-val.val.run`, or a custom domain). You can add `localhost` for testing.\n3. Copy the **Site Key** and **Secret Key**.\n\nBecause the Turnstile site key is **domain-bound** and every server shares the\nportal domain, **one keypair covers all your servers**. (A server on its own\ncustom domain can set its own keypair — see the admin API fields.)\n\n### 4. Create the val on Val Town\n\n1. **Remix this template** into your own Val Town project (or create a new\n project and copy these files in).\n2. Set the triggers:\n - **`http.ts`** → make it an **HTTP** val. Note its URL — that's your portal\n base (servers live at `/g/{guildId}`).\n - **`cron.ts`** → make it a **Cron** val on a daily schedule (e.g. `0 6 * * *`).\n3. Add the **shared** environment variables below (Val Town → your project →\n **Environment Variables**). Per-server values are NOT env vars — they go\n through the admin API.\n\n### 5. Configure the OAuth redirect (once)\n\nBack in the Discord Developer Portal → **OAuth2** → **Redirects**, add the single\nshared callback:\n\n```\nhttps:///callback\n```\n\nThis must match exactly, and it's the **only** redirect URI you ever need, for\nany number of servers. (A server on a custom domain that sets its own\n`redirectUriOverride` needs that URI registered too.)\n\n### 6. Register each server (admin API)\n\nWith `ADMIN_SECRET` set (step env table below), register a server by POSTing its\nconfig. Minimum is the guild id + role id; add branding and channels as you like:\n\n```bash\ncurl -X POST https:///admin/guilds \\\n -H \"authorization: Bearer $ADMIN_SECRET\" \\\n -H \"content-type: application/json\" \\\n -d '{\n \"guildId\": \"111111111111111111\",\n \"roleId\": \"222222222222222222\",\n \"serverName\": \"My Community\",\n \"accentColor\": \"#5865F2\",\n \"logoUrl\": \"https://example.com/logo.png\",\n \"portalUrl\": \"https://your-portal-domain/g/111111111111111111\",\n \"alertWebhookUrl\": \"https://discord.com/api/webhooks/...\"\n }'\n```\n\nMembers then verify at `https:///g/111111111111111111`.\nRepeat for each server. See [Managing servers](#managing-servers) for the full\nfield list and the other verbs.\n\n> Set **`portalUrl`** to the server's full portal URL (`.../g/{guildId}`) — the\n> Verify buttons and the OG card image are built from it.\n\n### 7. Set up each server's DMZ & post the messages\n\nThe **DMZ** is the handful of channels an unverified member can see. The tools\nact on **one server at a time** — pass the guild id as the first argument, or set\n`TOOL_GUILD_ID` in the environment before running. You have two ways to set it\nup — pick one.\n\n**Option A — let the bot build it.** Grant the bot **Manage Channels** (step 1),\nthen run **`setup.ts`** with the guild id. It creates a `Welcome` category with\n`#about`, `#rules`, `#verify`, and `#do-not-post` (read-only to `@everyone`,\nhoneypot left open), then posts every message into them. Channel + message IDs\nare saved to blob storage (namespaced per server), so you never copy an ID by\nhand.\n\n**Option B — use your own channels.** Create the channels yourself, set the\nchannel IDs on the server's config (admin API: `verifyChannelId`,\n`rulesChannelId`, `aboutChannelId`, `honeypotChannelId`), and run the post\nscripts individually:\n\n| Script | Posts | Config field |\n| --- | --- | --- |\n| `post-about.ts` | \"About the community\" card (+ Verify button) | `aboutChannelId` |\n| `post-rules.ts` | The rules embed | `rulesChannelId` |\n| `post-verify.ts` | The Verify button | `verifyChannelId` |\n| `post-honeypot.ts` | A \"do not post\" trap that outs spam bots | `honeypotChannelId` |\n\nEither way: **re-running a post script edits its message in place** — it doesn't\npost a duplicate. See [Updating messages](#updating-messages) below. Done — new\nmembers can now read what you're about, see the rules, and verify. 🎉\n\n---\n\n## Environment variables\n\nThese are **shared across all servers** — per-server values live in each\nserver's config row (admin API), not in env.\n\n### Required\n\n| Variable | What it is |\n| --- | --- |\n| `DISCORD_CLIENT_ID` | OAuth2 Client ID of the **one** shared app |\n| `DISCORD_CLIENT_SECRET` | OAuth2 Client Secret |\n| `DISCORD_BOT_TOKEN` | Bot token (the bot is invited to each server) |\n| `ADMIN_SECRET` | Bearer token guarding the `/admin` API. Unset = admin API disabled |\n\n### Optional (shared)\n\n| Variable | Default | What it is |\n| --- | --- | --- |\n| `TURNSTILE_SITE_KEY` | _(none)_ | Default Turnstile site key (a server may override) |\n| `TURNSTILE_SECRET_KEY` | _(none)_ | Default Turnstile secret key (a server may override) |\n| `TOOL_GUILD_ID` | _(none)_ | Which server `setup.ts` / `post-*.ts` act on (or pass as the first CLI arg) |\n\nA server needs Turnstile keys from **either** the shared defaults above **or**\nits own config. With one portal domain, set the shared defaults once and you're\ndone.\n\n### Legacy (upgrading from the single-guild build only)\n\nIf you're upgrading an old single-server deployment, leave its existing env vars\nin place: on first boot the shield **auto-seeds a server config row** from them\n(and migrates the audit log + stored channel/message IDs), so the server keeps\nworking and `/` redirects to its `/g/{guildId}`. These are read once for that\nmigration: `DISCORD_GUILD_ID`, `DISCORD_ROLE_ID`, `VERIFY_SERVER_NAME`,\n`VERIFY_REDIRECT_URI`, `VERIFY_PORTAL_URL`, `VERIFY_ALERT_WEBHOOK`,\n`VERIFY_RAID_THRESHOLD`, `VERIFY_RAID_WINDOW_MIN`, `VERIFY_ALERT_COOLDOWN_MIN`,\nand `DISCORD_*_CHANNEL_ID`. After migrating you can manage everything through the\nadmin API. New installs should ignore these entirely.\n\n---\n\n## Managing servers\n\nAll routes live under `/admin/guilds` and require `Authorization: Bearer\n$ADMIN_SECRET`. If `ADMIN_SECRET` is unset the whole API returns `404`. The\nTurnstile **secret** is never echoed back (responses report only\n`hasTurnstileSecretKey`).\n\n| Method | Route | Does |\n| --- | --- | --- |\n| `GET` | `/admin/guilds` | List all servers |\n| `POST` | `/admin/guilds` | Create a server (`409` if it already exists) |\n| `GET` | `/admin/guilds/{id}` | Fetch one server |\n| `PUT` | `/admin/guilds/{id}` | Create or replace a server |\n| `PATCH` | `/admin/guilds/{id}` | Partial update (only the fields you send) |\n| `DELETE` | `/admin/guilds/{id}` | Remove a server |\n\nIn `PATCH`, a field sent as `null` **clears** that override (falls back to the\ndefault); fields you omit are left unchanged.\n\n### Config fields\n\n`guildId` and `roleId` are required to create a server. Everything else is\noptional; branding fields left unset fall back to `theme.ts`.\n\n| Field | Type | Notes |\n| --- | --- | --- |\n| `guildId` | string | The Discord server ID (numeric) |\n| `roleId` | string | The Verified role ID to grant (numeric) |\n| `serverName` | string | Display name on the portal + embeds |\n| `disabled` | boolean | When true, the portal/callback treat the server as unknown |\n| `brandName` | string | Branding name (defaults to `serverName`, then `theme.ts`) |\n| `logoUrl` | string | Square logo (portal card, OG card, rules thumbnail) |\n| `accentColor` / `accentColorBright` | hex string | Portal + button accents (e.g. `#5865F2`) |\n| `embedColor` | int or `#RRGGBB` | Discord embed stripe color |\n| `ogHeadline` / `ogTagline` | string | Social card copy |\n| `ogFallbackImage` | string | Shown before the cron first renders the card |\n| `rules` | `{name,value}[]` | Rules embed contents (`post-rules.ts`) |\n| `about` | `{tagline,description,highlights}` | About card contents (`post-about.ts`) |\n| `turnstileSiteKey` / `turnstileSecretKey` | string | Override the shared Turnstile keypair |\n| `alertWebhookUrl` | string | Discord webhook for this server's raid alerts |\n| `raidThreshold` | number | Successful verifies in the window that trip an alert (default 15) |\n| `raidWindowMs` | number | Raid look-back window in ms (default 5 min) |\n| `alertCooldownMs` | number | Min gap between alerts in ms (default 15 min) |\n| `verifyChannelId` / `rulesChannelId` / `aboutChannelId` / `honeypotChannelId` | string | DMZ channels for the post tools |\n| `portalUrl` | string | This server's portal base, `.../g/{guildId}` (Verify button + card image) |\n| `redirectUriOverride` | string | Override `/callback` (only for a custom per-server domain) |\n\n```bash\n# Re-skin a server later\ncurl -X PATCH https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\" \\\n -d '{\"accentColor\":\"#43B581\",\"logoUrl\":\"https://example.com/new.png\"}'\n\n# Temporarily pause verification for a server\ncurl -X PATCH https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\" -d '{\"disabled\":true}'\n\n# Remove a server\ncurl -X DELETE https:///admin/guilds/111111111111111111 \\\n -H \"authorization: Bearer $ADMIN_SECRET\"\n```\n\n---\n\n## Make it yours\n\n`theme.ts` holds the **default** branding for every server — edit it and the\nportal page, social card, and Discord embeds re-skin together for any server that\nhasn't set its own overrides:\n\n- **`brand.name`** — fallback community name.\n- **`brand.logoUrl`** — a square logo (swap the placeholder cat for yours).\n- **`brand.accentColor` / `accentColorBright` / `embedColor`** — the accent.\n- **`brand.ogHeadline` / `ogTagline`** — the social card copy.\n- **`rules`** — the default rules `post-rules.ts` posts.\n- **`about`** — the default tagline, description, and highlights.\n\nTo brand an **individual** server differently, set the matching fields on its\nconfig via the admin API (`accentColor`, `logoUrl`, `rules`, `about`, …) — those\noverride the `theme.ts` defaults for that server only. Secrets never live in the\nsource.\n\nTo update what's already posted: change the config (or `theme.ts`) and **re-run\nthe matching post script** for that server — it edits the live message in place.\n\n---\n\n## Updating messages\n\nWhen a post tool posts a message, it saves that message's ID to blob storage\n(`store.ts`), namespaced by guild. Run the same script again (for the same\nserver) and it **edits the existing message** instead of posting a duplicate.\n\nHow a channel is resolved, in priority order:\n\n1. an explicit ID passed in code (`postRulesMessage(config, { channelId })`),\n2. a channel the bot created via `setup.ts` (blob store, per guild),\n3. the channel ID on the server's config (`rulesChannelId`, etc.).\n\nSo the bot-created channels win automatically, and hand-wired config IDs still\nwork as a fallback. The post functions also accept `{ messageId }` to target a\nspecific message, or `{ forceNew: true }` to post a fresh one. If a stored\nmessage was deleted in Discord, the next run notices the `404` and posts a new\none.\n\n> Blob keys used: `captcha_shield_v1_{guildId}_channel_`,\n> `captcha_shield_v1_{guildId}_message_`, and\n> `captcha_shield_v1_{guildId}_category` (one ID per key, so `setup.ts` can post\n> all four messages concurrently), plus `verify_og_png_v1_{guildId}` (the cached\n> social card).\n\n---\n\n## Adding more servers\n\nJust register another server with the admin API (`POST /admin/guilds`) — no\nredeploy, no second val. The one deployment serves them all: each server's\nconfig + branding is keyed by guild id in SQLite, the state nonces / audit log /\nraid alerts are scoped per guild, and the single shared bot + OAuth app handles\nevery server through the one `/callback` redirect URI.\n\n---\n\n## Troubleshooting\n\nThe portal turns Discord's API errors into plain-language messages. Common ones:\n\n| Symptom | Cause / fix |\n| --- | --- |\n| Portal says \"This verification link isn't active\" | The guild id in the URL isn't registered, or the server is `disabled`. Register it via the admin API. |\n| \"You're not in the server yet\" | The user must **join** the Discord before verifying (this is an already-members gate). |\n| \"The bot doesn't have permission to grant the role\" | Move the **bot's role above** the Verified role, and ensure it has **Manage Roles**. |\n| \"The verification bot isn't connected to this server\" | Wrong `guildId` on the config, or the bot was never invited to that server. |\n| \"The verified role no longer exists\" | Wrong/deleted `roleId` on the config. |\n| CAPTCHA never lets you continue | No Turnstile keys for that server (set shared `TURNSTILE_*` env or per-server keys), or the portal domain isn't added to the Turnstile site. |\n| Admin API returns `401` | Missing/incorrect `Authorization: Bearer $ADMIN_SECRET`. A `404` on `/admin/*` means `ADMIN_SECRET` isn't set. |\n| OAuth \"redirect URI mismatch\" | The single `/callback` URL in the Developer Portal must match your portal exactly. |\n| `/g/{id}/og.png` shows the fallback image | The cron hasn't generated that server's card yet — run `cron.ts` once manually. |\n\nEvery attempt (success or failure) is recorded in the `captcha_verify_log_v2`\nSQLite table with the `guild_id` and a `detail` column carrying the exact Discord\nstatus/error code, then pruned after 7 days.\n\n---\n\n## Security notes\n\n- OAuth uses the **`identify` scope only** — the shield reads a Discord user ID\n and nothing else.\n- State nonces are **single-use, atomically burned, and bound to one server**;\n concurrent callbacks for the same nonce can't both succeed, they expire after\n 10 minutes, and a nonce minted for one server can't grant a role in another.\n- The admin API compares the bearer token in **constant time** and never echoes\n the Turnstile secret back.\n- Turnstile tokens are verified **server-side** against Cloudflare.\n- This is an **\"already-members\" gate**: it stops unverified users from accessing\n gated channels, but Discord roles don't block DMs or member-list visibility on\n their own. [`HARDENING.md`](./HARDENING.md) covers closing those gaps with\n Membership Screening / lockdown.\n\n---\n\n## License\n\nMIT — do whatever you like. A 🐱 of credit to **catalloc** is appreciated but not\nrequired.\n",[275],"ff1b743d-25d4-4e7a-98d3-4039a2151f87","LICENSE","f2cfba00-668d-11f1-8d84-1607ee4eb77e",34,["D",1781289527444],"MIT License\n\nCopyright (c) 2026 catalloc\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n",[282],"8426ec3e-b7ac-4e03-8f94-5d1375ac09b3",["D",1781305586310],[28],"889e60c2-2fe0-453d-85e3-b7a422bacfe0",".vtignore","55fdb2ec-66b3-11f1-a5fa-1607ee4eb77e",78,["D",1781305585119],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[292],"78e7f1cd-c6b6-40ee-838f-d72c1cb64a99",".gitignore","f2e6812c-668d-11f1-8d84-1607ee4eb77e",37,["D",1781289527671],"# Secrets — never commit these; set them as Val Town environment variables\n.env\n.env.local\n*.key\n*.pem\nsecrets.json\n\n# Val Town local state\n.vt/\n\n# Editor / OS\n.vscode/\n.idea/\n.DS_Store\n*.Identifier\n\n# Deno / Node\nnode_modules/\nvendor/\ndeno.lock\n",[299],"be765c6f-8517-40f1-8375-a56c0b5f1644",".git","f0e58c10-668d-11f1-84f3-1607ee4eb77e",["D",1781289524292],"directory",[306],"3118c159-fcf7-4b6b-8025-4e502a888585",".claude","55d19a0e-66b3-11f1-a5fa-1607ee4eb77e",73,["D",1781305585000],[312],"pulls","branches","forks","envVars",{"_324":60,"_326":60},"connections",{"_324":60,"_325":60},"count","unfilledCount","emptyCount",{"_42":311,"_32":312,"_30":313,"_151":-5,"_40":41,"_39":314,"_153":119,"_37":869,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":870,"_27":871},{"_42":861,"_32":862,"_30":863,"_151":313,"_40":41,"_39":864,"_153":119,"_37":865,"_13":60,"_33":20,"_34":866,"_24":25,"_158":-5,"_406":867,"_27":868},{"_42":305,"_32":306,"_30":307,"_151":-5,"_40":41,"_39":155,"_153":119,"_37":858,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":859,"_27":860},{"_42":853,"_32":748,"_30":742,"_151":307,"_40":41,"_39":854,"_153":119,"_37":855,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":856,"_27":857},{"_42":845,"_32":846,"_30":847,"_151":742,"_40":41,"_39":848,"_153":119,"_37":849,"_13":60,"_33":20,"_34":850,"_24":25,"_158":-5,"_406":851,"_27":852},{"_42":837,"_32":838,"_30":839,"_151":742,"_40":41,"_39":840,"_153":119,"_37":841,"_13":60,"_33":20,"_34":842,"_24":25,"_158":-5,"_406":843,"_27":844},{"_42":829,"_32":830,"_30":831,"_151":742,"_40":41,"_39":832,"_153":119,"_37":833,"_13":60,"_33":20,"_34":834,"_24":25,"_158":-5,"_406":835,"_27":836},{"_42":821,"_32":822,"_30":823,"_151":742,"_40":41,"_39":824,"_153":119,"_37":825,"_13":60,"_33":20,"_34":826,"_24":25,"_158":-5,"_406":827,"_27":828},{"_42":813,"_32":814,"_30":815,"_151":742,"_40":41,"_39":816,"_153":119,"_37":817,"_13":60,"_33":20,"_34":818,"_24":25,"_158":-5,"_406":819,"_27":820},{"_42":805,"_32":806,"_30":807,"_151":742,"_40":41,"_39":808,"_153":119,"_37":809,"_13":60,"_33":20,"_34":810,"_24":25,"_158":-5,"_406":811,"_27":812},{"_42":797,"_32":798,"_30":799,"_151":742,"_40":41,"_39":800,"_153":119,"_37":801,"_13":60,"_33":20,"_34":802,"_24":25,"_158":-5,"_406":803,"_27":804},{"_42":789,"_32":790,"_30":791,"_151":742,"_40":41,"_39":792,"_153":119,"_37":793,"_13":60,"_33":20,"_34":794,"_24":25,"_158":-5,"_406":795,"_27":796},{"_42":781,"_32":782,"_30":783,"_151":742,"_40":41,"_39":784,"_153":119,"_37":785,"_13":60,"_33":20,"_34":786,"_24":25,"_158":-5,"_406":787,"_27":788},{"_42":773,"_32":774,"_30":775,"_151":742,"_40":41,"_39":776,"_153":119,"_37":777,"_13":60,"_33":20,"_34":778,"_24":25,"_158":-5,"_406":779,"_27":780},{"_42":765,"_32":766,"_30":767,"_151":742,"_40":41,"_39":768,"_153":119,"_37":769,"_13":60,"_33":20,"_34":770,"_24":25,"_158":-5,"_406":771,"_27":772},{"_42":757,"_32":758,"_30":759,"_151":742,"_40":41,"_39":760,"_153":119,"_37":761,"_13":60,"_33":20,"_34":762,"_24":25,"_158":-5,"_406":763,"_27":764},{"_42":749,"_32":750,"_30":751,"_151":742,"_40":41,"_39":752,"_153":119,"_37":753,"_13":60,"_33":20,"_34":754,"_24":25,"_158":-5,"_406":755,"_27":756},{"_42":739,"_32":740,"_30":741,"_151":742,"_40":41,"_39":743,"_153":119,"_37":744,"_13":60,"_33":20,"_34":745,"_24":25,"_158":-5,"_406":746,"_27":747},{"_42":734,"_32":541,"_30":728,"_151":307,"_40":41,"_39":735,"_153":119,"_37":736,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":737,"_27":738},{"_42":725,"_32":726,"_30":727,"_151":728,"_40":41,"_39":729,"_153":119,"_37":730,"_13":60,"_33":20,"_34":731,"_24":25,"_158":-5,"_406":732,"_27":733},{"_42":720,"_32":701,"_30":695,"_151":307,"_40":41,"_39":721,"_153":119,"_37":722,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":723,"_27":724},{"_42":715,"_32":511,"_30":710,"_151":695,"_40":41,"_39":716,"_153":119,"_37":717,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":718,"_27":719},{"_42":709,"_32":520,"_30":704,"_151":710,"_40":41,"_39":711,"_153":119,"_37":712,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":713,"_27":714},{"_42":702,"_32":84,"_30":703,"_151":704,"_40":41,"_39":705,"_153":119,"_37":706,"_13":60,"_33":20,"_34":698,"_24":25,"_158":-5,"_406":707,"_27":708},{"_42":693,"_32":488,"_30":694,"_151":695,"_40":41,"_39":696,"_153":119,"_37":697,"_13":60,"_33":20,"_34":698,"_24":25,"_158":-5,"_406":699,"_27":700},{"_42":688,"_32":539,"_30":534,"_151":307,"_40":41,"_39":689,"_153":119,"_37":690,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":691,"_27":692},{"_42":681,"_32":682,"_30":683,"_151":534,"_40":41,"_39":684,"_153":119,"_37":685,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":686,"_27":687},{"_42":674,"_32":675,"_30":676,"_151":534,"_40":41,"_39":677,"_153":119,"_37":678,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":679,"_27":680},{"_42":667,"_32":668,"_30":669,"_151":534,"_40":41,"_39":670,"_153":119,"_37":671,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":672,"_27":673},{"_42":660,"_32":661,"_30":662,"_151":534,"_40":41,"_39":663,"_153":119,"_37":664,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":665,"_27":666},{"_42":653,"_32":654,"_30":655,"_151":534,"_40":41,"_39":656,"_153":119,"_37":657,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":658,"_27":659},{"_42":646,"_32":647,"_30":648,"_151":534,"_40":41,"_39":649,"_153":119,"_37":650,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":651,"_27":652},{"_42":639,"_32":640,"_30":641,"_151":534,"_40":41,"_39":642,"_153":119,"_37":643,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":644,"_27":645},{"_42":634,"_32":633,"_30":627,"_151":534,"_40":41,"_39":635,"_153":119,"_37":636,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":637,"_27":638},{"_42":624,"_32":625,"_30":626,"_151":627,"_40":41,"_39":628,"_153":119,"_37":629,"_13":60,"_33":20,"_34":630,"_24":25,"_158":-5,"_406":631,"_27":632},{"_42":617,"_32":618,"_30":619,"_151":534,"_40":41,"_39":620,"_153":119,"_37":621,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":622,"_27":623},{"_42":610,"_32":611,"_30":612,"_151":534,"_40":41,"_39":613,"_153":119,"_37":614,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":615,"_27":616},{"_42":603,"_32":604,"_30":605,"_151":534,"_40":41,"_39":606,"_153":119,"_37":607,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":608,"_27":609},{"_42":596,"_32":597,"_30":598,"_151":534,"_40":41,"_39":599,"_153":119,"_37":600,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":601,"_27":602},{"_42":589,"_32":590,"_30":591,"_151":534,"_40":41,"_39":592,"_153":119,"_37":593,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":594,"_27":595},{"_42":582,"_32":583,"_30":584,"_151":534,"_40":41,"_39":585,"_153":119,"_37":586,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":587,"_27":588},{"_42":575,"_32":576,"_30":577,"_151":534,"_40":41,"_39":578,"_153":119,"_37":579,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":580,"_27":581},{"_42":568,"_32":569,"_30":570,"_151":534,"_40":41,"_39":571,"_153":119,"_37":572,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":573,"_27":574},{"_42":561,"_32":562,"_30":563,"_151":534,"_40":41,"_39":564,"_153":119,"_37":565,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":566,"_27":567},{"_42":554,"_32":555,"_30":556,"_151":534,"_40":41,"_39":557,"_153":119,"_37":558,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":559,"_27":560},{"_42":547,"_32":548,"_30":549,"_151":534,"_40":41,"_39":550,"_153":119,"_37":551,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":552,"_27":553},{"_42":540,"_32":541,"_30":542,"_151":534,"_40":41,"_39":543,"_153":119,"_37":544,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":545,"_27":546},{"_42":531,"_32":532,"_30":533,"_151":534,"_40":41,"_39":535,"_153":119,"_37":536,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":537,"_27":538},{"_42":526,"_32":511,"_30":506,"_151":307,"_40":41,"_39":527,"_153":119,"_37":528,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":529,"_27":530},{"_42":521,"_32":520,"_30":514,"_151":506,"_40":41,"_39":522,"_153":119,"_37":523,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":524,"_27":525},{"_42":512,"_32":84,"_30":513,"_151":514,"_40":41,"_39":515,"_153":119,"_37":516,"_13":60,"_33":20,"_34":517,"_24":25,"_158":-5,"_406":518,"_27":519},{"_42":503,"_32":504,"_30":505,"_151":506,"_40":41,"_39":507,"_153":119,"_37":508,"_13":60,"_33":309,"_34":-5,"_24":25,"_158":-5,"_406":509,"_27":510},{"_42":495,"_32":496,"_30":497,"_151":307,"_40":41,"_39":498,"_153":119,"_37":499,"_13":60,"_33":20,"_34":500,"_24":25,"_158":-5,"_406":501,"_27":502},{"_42":487,"_32":488,"_30":489,"_151":307,"_40":41,"_39":490,"_153":119,"_37":491,"_13":60,"_33":20,"_34":492,"_24":25,"_158":-5,"_406":493,"_27":494},{"_42":479,"_32":480,"_30":481,"_151":307,"_40":41,"_39":482,"_153":119,"_37":483,"_13":60,"_33":20,"_34":484,"_24":25,"_158":-5,"_406":485,"_27":486},{"_42":472,"_32":51,"_30":473,"_151":307,"_40":41,"_39":474,"_153":119,"_37":475,"_13":60,"_33":20,"_34":476,"_24":25,"_158":-5,"_406":477,"_27":478},{"_42":298,"_32":299,"_30":300,"_151":-5,"_40":41,"_39":301,"_153":119,"_37":469,"_13":60,"_33":20,"_34":303,"_24":25,"_158":-5,"_406":470,"_27":471},{"_42":291,"_32":292,"_30":293,"_151":-5,"_40":41,"_39":294,"_153":119,"_37":466,"_13":60,"_33":20,"_34":296,"_24":25,"_158":-5,"_406":467,"_27":468},{"_42":288,"_32":28,"_30":31,"_151":-5,"_40":41,"_39":14,"_153":25,"_37":463,"_13":155,"_33":20,"_34":36,"_24":25,"_158":-5,"_406":464,"_27":465},{"_42":281,"_32":282,"_30":283,"_151":-5,"_40":41,"_39":284,"_153":119,"_37":460,"_13":60,"_33":20,"_34":286,"_24":25,"_158":-5,"_406":461,"_27":462},{"_42":274,"_32":275,"_30":276,"_151":-5,"_40":41,"_39":277,"_153":25,"_37":457,"_13":155,"_33":20,"_34":279,"_24":25,"_158":-5,"_406":458,"_27":459},{"_42":267,"_32":268,"_30":269,"_151":-5,"_40":41,"_39":270,"_153":25,"_37":454,"_13":60,"_33":156,"_34":272,"_24":25,"_158":-5,"_406":455,"_27":456},{"_42":260,"_32":261,"_30":262,"_151":-5,"_40":41,"_39":263,"_153":119,"_37":451,"_13":155,"_33":156,"_34":265,"_24":25,"_158":-5,"_406":452,"_27":453},{"_42":253,"_32":254,"_30":255,"_151":-5,"_40":41,"_39":256,"_153":119,"_37":448,"_13":155,"_33":156,"_34":258,"_24":25,"_158":-5,"_406":449,"_27":450},{"_42":245,"_32":246,"_30":247,"_151":-5,"_40":41,"_39":248,"_153":119,"_37":445,"_13":155,"_33":250,"_34":251,"_24":25,"_158":-5,"_406":446,"_27":447},{"_42":238,"_32":239,"_30":240,"_151":-5,"_40":41,"_39":241,"_153":119,"_37":442,"_13":60,"_33":20,"_34":243,"_24":25,"_158":-5,"_406":443,"_27":444},{"_42":231,"_32":232,"_30":233,"_151":-5,"_40":41,"_39":234,"_153":25,"_37":439,"_13":60,"_33":156,"_34":236,"_24":25,"_158":-5,"_406":440,"_27":441},{"_42":223,"_32":224,"_30":225,"_151":-5,"_40":41,"_39":226,"_153":119,"_37":436,"_13":155,"_33":228,"_34":229,"_24":25,"_158":-5,"_406":437,"_27":438},{"_42":216,"_32":217,"_30":218,"_151":-5,"_40":41,"_39":219,"_153":119,"_37":433,"_13":155,"_33":156,"_34":221,"_24":25,"_158":-5,"_406":434,"_27":435},{"_42":209,"_32":210,"_30":211,"_151":-5,"_40":41,"_39":212,"_153":25,"_37":430,"_13":60,"_33":156,"_34":214,"_24":25,"_158":-5,"_406":431,"_27":432},{"_42":202,"_32":203,"_30":204,"_151":-5,"_40":41,"_39":205,"_153":119,"_37":427,"_13":155,"_33":156,"_34":207,"_24":25,"_158":-5,"_406":428,"_27":429},{"_42":195,"_32":196,"_30":197,"_151":-5,"_40":41,"_39":198,"_153":119,"_37":424,"_13":155,"_33":156,"_34":200,"_24":25,"_158":-5,"_406":425,"_27":426},{"_42":188,"_32":189,"_30":190,"_151":-5,"_40":41,"_39":191,"_153":119,"_37":421,"_13":155,"_33":156,"_34":193,"_24":25,"_158":-5,"_406":422,"_27":423},{"_42":181,"_32":182,"_30":183,"_151":-5,"_40":41,"_39":184,"_153":119,"_37":418,"_13":155,"_33":156,"_34":186,"_24":25,"_158":-5,"_406":419,"_27":420},{"_42":174,"_32":175,"_30":176,"_151":-5,"_40":41,"_39":177,"_153":25,"_37":415,"_13":60,"_33":156,"_34":179,"_24":25,"_158":-5,"_406":416,"_27":417},{"_42":167,"_32":168,"_30":169,"_151":-5,"_40":41,"_39":170,"_153":119,"_37":412,"_13":155,"_33":156,"_34":172,"_24":25,"_158":-5,"_406":413,"_27":414},{"_42":160,"_32":161,"_30":162,"_151":-5,"_40":41,"_39":163,"_153":119,"_37":409,"_13":155,"_33":156,"_34":165,"_24":25,"_158":-5,"_406":410,"_27":411},{"_42":148,"_32":149,"_30":150,"_151":-5,"_40":41,"_39":152,"_153":25,"_37":405,"_13":155,"_33":156,"_34":157,"_24":25,"_158":-5,"_406":407,"_27":408},["D",1781305585375],"children",[],[149],["D",1781305585269],[],[161],["D",1781305585792],[],[168],["D",1781305585108],[],[175],["D",1781305586131],[],[182],["D",1781305586226],[],[189],["D",1781305585576],[],[196],["D",1781305585714],[],[203],["D",1781289529104],[],[210],["D",1781305585743],[],[217],["D",1781305585901],[],[224],["D",1781305585119],[],[232],["D",1781289527448],[],[239],["D",1781305585670],[],[246],["D",1781305586007],[],[254],["D",1781305585471],[],[261],["D",1781305585262],[],[268],["D",1781305586222],[],[275],["D",1781289527444],[],[282],["D",1781305586310],[],[28],["D",1781305585119],[],[292],["D",1781289527671],[],[299],"9d723488-6cc7-48be-be34-459d70fb54a4","f3aacaa0-668d-11f1-b477-1607ee4eb77e",61,["D",1781289528790],"Unnamed repository; edit this file 'description' to name the repository.\n",[],[306,51],"68756796-d50a-4ca7-8b72-6101a929af95","config","f3061fa0-668d-11f1-bf75-1607ee4eb77e",43,["D",1781289527877],"[core]\n\trepositoryformatversion = 0\n\tfilemode = true\n\tbare = false\n\tlogallrefupdates = true\n[remote \"origin\"]\n\turl = git@github.com:catalloc/discord-captcha-shield.git\n\tfetch = +refs/heads/*:refs/remotes/origin/*\n",[],[306,480],"20447dd9-ed12-4b41-b42f-c071593bc56b","HEAD","f3197b40-668d-11f1-bf75-1607ee4eb77e",46,["D",1781289527991],"ref: refs/heads/main\n",[],[306,488],"c3e87590-de2b-4560-9877-0181c1608273","COMMIT_EDITMSG","f35ace6a-668d-11f1-9138-1607ee4eb77e",54,["D",1781289527790],"Initial commit: Discord CAPTCHA Shield template\n\nA self-hostable CAPTCHA + Discord OAuth verification gate for Val Town.\nNew members solve a Cloudflare Turnstile CAPTCHA, authorize via Discord\n(identify scope), and a bot grants the Verified role.\n\nIncludes:\n- Portal + OAuth routes (http.ts), daily cleanup + OG card cron (cron.ts)\n- One-click DMZ bootstrap (setup.ts): bot creates the about/rules/verify/\n honeypot channels and posts every message\n- Per-key blob storage (store.ts) so post tools edit messages in place and\n setup posts concurrently\n- Raid alerts, audit log, dynamic social card\n- Single-file branding via theme.ts; README with full install guide\n\nCo-Authored-By: Claude Opus 4.8 (1M context) \n",[],[306,496],"261dc8ea-208c-4fed-ba41-2f4ecd45fedf","tags","f14c94d2-668d-11f1-84f3-1607ee4eb77e","f0f60360-668d-11f1-b249-1607ee4eb77e",8,["D",1781289524988],[],[306,511,504],"refs","e0a7603c-9e1f-4cde-9434-f671ca1d1d04","f2f18d4c-668d-11f1-9ab7-1607ee4eb77e","f1404754-668d-11f1-84f3-1607ee4eb77e",39,["D",1781289527732],"2f5f9232437b9da397467e05c22798a95a66f830\n",[],[306,511,520,84],"heads","ab3fc845-ea05-4515-9b9a-d0f31f7d8cb4",7,["D",1781289524906],[377],[306,511,520],"6d32b545-cba3-460c-91e9-b0f019b115ef",2,["D",1781289524416],[376,378],[306,511],"453f6ffb-ff9f-423f-8821-ebc5f1164704","pack","f17a4698-668d-11f1-b249-1607ee4eb77e","f105437a-668d-11f1-b68b-1607ee4eb77e",11,["D",1781289525287],[],[306,539,532],"objects","8983f4aa-0184-4fd3-9fad-6c6ff4512348","info","f207f330-668d-11f1-bfda-1607ee4eb77e",20,["D",1781289526212],[],[306,539,541],"43275c82-b244-46c3-be78-60065082bb32","e5","f16dd0f2-668d-11f1-b68b-1607ee4eb77e",10,["D",1781289525204],[],[306,539,548],"1d3b9d3a-41e1-4c49-9369-071a1b811284","d8","f217cca6-668d-11f1-bfda-1607ee4eb77e",21,["D",1781289526319],[],[306,539,555],"49a59a5c-1dc0-4fc2-aa35-edcfc4372191","d4","f235eb96-668d-11f1-b249-1607ee4eb77e",23,["D",1781289526509],[],[306,539,562],"ff7bb85e-ce20-4a25-bf35-d737a027b36d","d1","f1d7748a-668d-11f1-b7b6-1607ee4eb77e",17,["D",1781289525896],[],[306,539,569],"04a1e9da-0fcc-4227-ac5d-bd269e7e96f1","bd","f27d7e48-668d-11f1-84f3-1607ee4eb77e",28,["D",1781289526986],[],[306,539,576],"17c8169b-0642-4df8-a28d-8fed84e55170","a5","f1a9e7ea-668d-11f1-b249-1607ee4eb77e",14,["D",1781289525586],[],[306,539,583],"8c8b06ee-889a-4a8d-b02c-8ad2b34da028","99","f1580db2-668d-11f1-b68b-1607ee4eb77e",9,["D",1781289525063],[],[306,539,590],"46196381-57bf-4c1e-88c8-0f72133e2951","94","f1c6b00a-668d-11f1-b7b6-1607ee4eb77e",16,["D",1781289525788],[],[306,539,597],"1c295602-7354-4267-9958-129b8f1d5979","7e","f27255e0-668d-11f1-84f3-1607ee4eb77e",27,["D",1781289526897],[],[306,539,604],"406788c5-95be-4480-bb54-bf2957f628e4","73","f25e8cc2-668d-11f1-84f3-1607ee4eb77e",26,["D",1781289526784],[],[306,539,611],"cdb1f050-5cbb-49e5-9eed-99ffcf8cb173","6f","f289ca0e-668d-11f1-84f3-1607ee4eb77e",29,["D",1781289527068],[],[306,539,618],"868a8827-1df3-4934-8464-2055623e56af","4f1dc9a93d9d0c02c0b957ed86cacd50063dc9","f2fb6ccc-668d-11f1-9084-1607ee4eb77e","f1b92ce6-668d-11f1-b7b6-1607ee4eb77e",41,["D",1781289527796],"x\u0001�T�n�@\u0014��_1r{�U�(�T\u0002EU\n��@\u00054RO��\u000f��z��I��۵IPr��oޛ73�Z�5ο��pv��\u0013�\"��\u000e�P�} \u000b�(�!�3\u0018ɺ0�DR\t�\b\u0005g�vK6��\u0013��~��LD��HEHny��\u001c�m�D7\u0015YY`<꡸\u0013Z��=\u0018��\u0015i'��P\n�(h�L3Lw�T�>n��r��rry�#�\u0018��\u0005�\r\u000b6�+��\u001asbqn��Ŗ=��<�{�㼣��p\u0007\u001e\u0001}R\u0013#Y�ux\u000e��|�:*=��\u001dᖵ�<\r��-��^!��*S�S��\u0015O��ٹ\\?\u001c�\u0015\u0001ؖF�/�\u0012��.�it\u0011d��I��\b�j�u��E8�Wja�I��#��q�c(�Wa\"*�w<��\u0013�ꐽak�|E\u001cڿ�E��h\u001eK2�^hs�\u001a嘶x\u0014�D\u001f�c=�v�t�\u0001��L�m\u0012��܇;�\u001bV\u0001��E��oA��+-�\t��i�� }��#��w\u001f��C\u001fo�+/[�c�5V��<��QԮ�:3��\u0003%�v\"",[],[306,539,633,625],"6d","b2ce834d-8174-4e01-b284-9970a417a70a",15,["D",1781289525691],[361],[306,539,633],"3da80ccb-2eb8-43be-93e8-05fbe77bb83b","5d","f251ea9e-668d-11f1-b7b6-1607ee4eb77e",25,["D",1781289526701],[],[306,539,640],"30addad7-63dc-4b0b-ab0d-43c95775d7b9","5a","f1f6008a-668d-11f1-b7b6-1607ee4eb77e",19,["D",1781289526097],[],[306,539,647],"55902c88-4ded-4836-8000-d142b6ebb3d7","50","f2455dec-668d-11f1-b249-1607ee4eb77e",24,["D",1781289526617],[],[306,539,654],"b9392db2-82b3-4226-8723-9481ed9b52c0","39","f1901dec-668d-11f1-9228-1607ee4eb77e",12,["D",1781289525415],[],[306,539,661],"9b410a66-394b-47d9-802a-3e71d0fee8c7","38","f1e4f9ca-668d-11f1-b7b6-1607ee4eb77e",18,["D",1781289525987],[],[306,539,668],"10f4166b-3911-4750-8857-33df75b0a4e7","2f","f2263796-668d-11f1-bfda-1607ee4eb77e",22,["D",1781289526408],[],[306,539,675],"a6028611-b62c-44ed-b2e4-420d0008ba78","1e","f19abfc2-668d-11f1-9228-1607ee4eb77e",13,["D",1781289525501],[],[306,539,682],"ff63dd59-7707-44b7-9589-a093017a0efa",3,["D",1781289524514],[353,354,355,356,357,358,359,360,362,363,364,365,366,367,368,369,370,371,372,373,374],[306,539],"8691a00c-5a32-4490-9fc8-721850764554","f315167c-668d-11f1-9ab7-1607ee4eb77e","f11f0f8a-668d-11f1-b68b-1607ee4eb77e",45,["D",1781289527943],"0000000000000000000000000000000000000000 2f5f9232437b9da397467e05c22798a95a66f830 catalloc <80437062+catalloc@users.noreply.github.com> 1781289324 -0400\tcommit (initial): Initial commit: Discord CAPTCHA Shield template\n",[],[306,701,488],"logs","9254b389-b3e2-4813-8e37-176c5b1c144c","f30f250a-668d-11f1-9084-1607ee4eb77e","f2af6c96-668d-11f1-84f3-1607ee4eb77e",44,["D",1781289527922],[],[306,701,511,520,84],"99e8e0d7-467d-4ac1-a391-4a07c953caae","f29c48fa-668d-11f1-84f3-1607ee4eb77e",31,["D",1781289527310],[350],[306,701,511,520],"07ce5f94-6b8a-4fe2-8a0c-d8c3025814d8",30,["D",1781289527188],[349],[306,701,511],"b811d182-cf8b-44ac-bd93-1a21c79a6883",5,["D",1781289524687],[348,351],[306,701],"a7881e2c-ee16-48a8-be0b-696bd8787f0f","exclude","f3005e94-668d-11f1-9ab7-1607ee4eb77e","f1111d4e-668d-11f1-b68b-1607ee4eb77e",42,["D",1781289527827],"# git ls-files --others --exclude-from=.git/info/exclude\n# Lines that start with '#' are comments.\n# For a project mostly in C, the following would be a good set of\n# exclude patterns (uncomment them if you want to use them):\n# *.[oa]\n# *~\n",[],[306,541,726],"ee16ca23-3c5c-4bf2-9f08-20764efed1e2",4,["D",1781289524598],[346],[306,541],"d96c57c0-a5b6-4a24-b3e7-85206eed6708","update.sample","f399e3c0-668d-11f1-b0f1-1607ee4eb77e","f12e6dfe-668d-11f1-84f3-1607ee4eb77e",60,["D",1781289528092],"#!/bin/sh\n#\n# An example hook script to block unannotated tags from entering.\n# Called by \"git receive-pack\" with arguments: refname sha1-old sha1-new\n#\n# To enable this hook, rename this file to \"update\".\n#\n# Config\n# ------\n# hooks.allowunannotated\n# This boolean sets whether unannotated tags will be allowed into the\n# repository. By default they won't be.\n# hooks.allowdeletetag\n# This boolean sets whether deleting tags will be allowed in the\n# repository. By default they won't be.\n# hooks.allowmodifytag\n# This boolean sets whether a tag may be modified after creation. By default\n# it won't be.\n# hooks.allowdeletebranch\n# This boolean sets whether deleting branches will be allowed in the\n# repository. By default they won't be.\n# hooks.denycreatebranch\n# This boolean sets whether remotely creating branches will be denied\n# in the repository. By default this is allowed.\n#\n\n# --- Command line\nrefname=\"$1\"\noldrev=\"$2\"\nnewrev=\"$3\"\n\n# --- Safety check\nif [ -z \"$GIT_DIR\" ]; then\n\techo \"Don't run this script from the command line.\" >&2\n\techo \" (if you want, you could supply GIT_DIR then run\" >&2\n\techo \" $0 )\" >&2\n\texit 1\nfi\n\nif [ -z \"$refname\" -o -z \"$oldrev\" -o -z \"$newrev\" ]; then\n\techo \"usage: $0 \" >&2\n\texit 1\nfi\n\n# --- Config\nallowunannotated=$(git config --type=bool hooks.allowunannotated)\nallowdeletebranch=$(git config --type=bool hooks.allowdeletebranch)\ndenycreatebranch=$(git config --type=bool hooks.denycreatebranch)\nallowdeletetag=$(git config --type=bool hooks.allowdeletetag)\nallowmodifytag=$(git config --type=bool hooks.allowmodifytag)\n\n# check for no description\nprojectdesc=$(sed -e '1q' \"$GIT_DIR/description\")\ncase \"$projectdesc\" in\n\"Unnamed repository\"* | \"\")\n\techo \"*** Project description file hasn't been set\" >&2\n\texit 1\n\t;;\nesac\n\n# --- Check types\n# if $newrev is 0000...0000, it's a commit to delete a ref.\nzero=$(git hash-object --stdin &2\n\t\t\techo \"*** Use 'git tag [ -a | -s ]' for tags you want to propagate.\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/tags/*,delete)\n\t\t# delete tag\n\t\tif [ \"$allowdeletetag\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a tag is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/tags/*,tag)\n\t\t# annotated tag\n\t\tif [ \"$allowmodifytag\" != \"true\" ] && git rev-parse $refname > /dev/null 2>&1\n\t\tthen\n\t\t\techo \"*** Tag '$refname' already exists.\" >&2\n\t\t\techo \"*** Modifying a tag is not allowed in this repository.\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/heads/*,commit)\n\t\t# branch\n\t\tif [ \"$oldrev\" = \"$zero\" -a \"$denycreatebranch\" = \"true\" ]; then\n\t\t\techo \"*** Creating a branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/heads/*,delete)\n\t\t# delete branch\n\t\tif [ \"$allowdeletebranch\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\trefs/remotes/*,commit)\n\t\t# tracking branch\n\t\t;;\n\trefs/remotes/*,delete)\n\t\t# delete tracking branch\n\t\tif [ \"$allowdeletebranch\" != \"true\" ]; then\n\t\t\techo \"*** Deleting a tracking branch is not allowed in this repository\" >&2\n\t\t\texit 1\n\t\tfi\n\t\t;;\n\t*)\n\t\t# Anything else (is there anything else?)\n\t\techo \"*** Update hook: unknown type of update to ref $refname of type $newrev_type\" >&2\n\t\texit 1\n\t\t;;\nesac\n\n# --- Finished\nexit 0\n",[],[306,748,740],"hooks","1f5d1f00-c259-43a9-b524-d97154f18bbe","sendemail-validate.sample","f37caf26-668d-11f1-b477-1607ee4eb77e",58,["D",1781289528493],"#!/bin/sh\n\n# An example hook script to validate a patch (and/or patch series) before\n# sending it via email.\n#\n# The hook should exit with non-zero status after issuing an appropriate\n# message if it wants to prevent the email(s) from being sent.\n#\n# To enable this hook, rename this file to \"sendemail-validate\".\n#\n# By default, it will only check that the patch(es) can be applied on top of\n# the default upstream branch without conflicts in a secondary worktree. After\n# validation (successful or not) of the last patch of a series, the worktree\n# will be deleted.\n#\n# The following config variables can be set to change the default remote and\n# remote ref that are used to apply the patches against:\n#\n# sendemail.validateRemote (default: origin)\n# sendemail.validateRemoteRef (default: HEAD)\n#\n# Replace the TODO placeholders with appropriate checks according to your\n# needs.\n\nvalidate_cover_letter () {\n\tfile=\"$1\"\n\t# TODO: Replace with appropriate checks (e.g. spell checking).\n\ttrue\n}\n\nvalidate_patch () {\n\tfile=\"$1\"\n\t# Ensure that the patch applies without conflicts.\n\tgit am -3 \"$file\" || return\n\t# TODO: Replace with appropriate checks for this patch\n\t# (e.g. checkpatch.pl).\n\ttrue\n}\n\nvalidate_series () {\n\t# TODO: Replace with appropriate checks for the whole series\n\t# (e.g. quick build, coding style checks, etc.).\n\ttrue\n}\n\n# main -------------------------------------------------------------------------\n\nif test \"$GIT_SENDEMAIL_FILE_COUNTER\" = 1\nthen\n\tremote=$(git config --default origin --get sendemail.validateRemote) &&\n\tref=$(git config --default HEAD --get sendemail.validateRemoteRef) &&\n\tworktree=$(mktemp --tmpdir -d sendemail-validate.XXXXXXX) &&\n\tgit worktree add -fd --checkout \"$worktree\" \"refs/remotes/$remote/$ref\" &&\n\tgit config --replace-all sendemail.validateWorktree \"$worktree\"\nelse\n\tworktree=$(git config --get sendemail.validateWorktree)\nfi || {\n\techo \"sendemail-validate: error: failed to prepare worktree\" >&2\n\texit 1\n}\n\nunset GIT_DIR GIT_WORK_TREE\ncd \"$worktree\" &&\n\nif grep -q \"^diff --git \" \"$1\"\nthen\n\tvalidate_patch \"$1\"\nelse\n\tvalidate_cover_letter \"$1\"\nfi &&\n\nif test \"$GIT_SENDEMAIL_FILE_COUNTER\" = \"$GIT_SENDEMAIL_FILE_TOTAL\"\nthen\n\tgit config --unset-all sendemail.validateWorktree &&\n\ttrap 'git worktree remove -ff \"$worktree\"' EXIT &&\n\tvalidate_series\nfi\n",[],[306,748,750],"e42e3f66-772a-40b7-bfc5-f098b4929ef5","push-to-checkout.sample","f34d6e64-668d-11f1-847c-1607ee4eb77e",52,["D",1781289528314],"#!/bin/sh\n\n# An example hook script to update a checked-out tree on a git push.\n#\n# This hook is invoked by git-receive-pack(1) when it reacts to git\n# push and updates reference(s) in its repository, and when the push\n# tries to update the branch that is currently checked out and the\n# receive.denyCurrentBranch configuration variable is set to\n# updateInstead.\n#\n# By default, such a push is refused if the working tree and the index\n# of the remote repository has any difference from the currently\n# checked out commit; when both the working tree and the index match\n# the current commit, they are updated to match the newly pushed tip\n# of the branch. This hook is to be used to override the default\n# behaviour; however the code below reimplements the default behaviour\n# as a starting point for convenient modification.\n#\n# The hook receives the commit with which the tip of the current\n# branch is going to be updated:\ncommit=$1\n\n# It can exit with a non-zero status to refuse the push (when it does\n# so, it must not modify the index or the working tree).\ndie () {\n\techo >&2 \"$*\"\n\texit 1\n}\n\n# Or it can make any necessary changes to the working tree and to the\n# index to bring them to the desired state when the tip of the current\n# branch is updated to the new commit, and exit with a zero status.\n#\n# For example, the hook can simply run git read-tree -u -m HEAD \"$1\"\n# in order to emulate git fetch that is run in the reverse direction\n# with git push, as the two-tree form of git read-tree -u -m is\n# essentially the same as git switch or git checkout that switches\n# branches while keeping the local changes in the working tree that do\n# not interfere with the difference between the branches.\n\n# The below is a more-or-less exact translation to shell of the C code\n# for the default behaviour for git's push-to-checkout hook defined in\n# the push_to_deploy() function in builtin/receive-pack.c.\n#\n# Note that the hook will be executed from the repository directory,\n# not from the working tree, so if you want to perform operations on\n# the working tree, you will have to adapt your code accordingly, e.g.\n# by adding \"cd ..\" or using relative paths.\n\nif ! git update-index -q --ignore-submodules --refresh\nthen\n\tdie \"Up-to-date check failed\"\nfi\n\nif ! git diff-files --quiet --ignore-submodules --\nthen\n\tdie \"Working directory has unstaged changes\"\nfi\n\n# This is a rough translation of:\n#\n# head_has_history() ? \"HEAD\" : EMPTY_TREE_SHA1_HEX\nif git cat-file -e HEAD 2>/dev/null\nthen\n\thead=HEAD\nelse\n\thead=$(git hash-object -t tree --stdin \\).*$/Signed-off-by: \\1/p')\n# git interpret-trailers --in-place --trailer \"$SOB\" \"$COMMIT_MSG_FILE\"\n# if test -z \"$COMMIT_SOURCE\"\n# then\n# /usr/bin/perl -i.bak -pe 'print \"\\n\" if !$first_line++' \"$COMMIT_MSG_FILE\"\n# fi\n",[],[306,748,766],"2d97cfac-0e1b-4a9f-9e1b-d0b3df5e2402","pre-receive.sample","f331c038-668d-11f1-9ab7-1607ee4eb77e",49,["D",1781289528116],"#!/bin/sh\n#\n# An example hook script to make use of push options.\n# The example simply echoes all push options that start with 'echoback='\n# and rejects all pushes when the \"reject\" push option is used.\n#\n# To enable this hook, rename this file to \"pre-receive\".\n\nif test -n \"$GIT_PUSH_OPTION_COUNT\"\nthen\n\ti=0\n\twhile test \"$i\" -lt \"$GIT_PUSH_OPTION_COUNT\"\n\tdo\n\t\teval \"value=\\$GIT_PUSH_OPTION_$i\"\n\t\tcase \"$value\" in\n\t\techoback=*)\n\t\t\techo \"echo from the pre-receive-hook: ${value#*=}\" >&2\n\t\t\t;;\n\t\treject)\n\t\t\texit 1\n\t\tesac\n\t\ti=$((i + 1))\n\tdone\nfi\n",[],[306,748,774],"6495c585-f0f3-4f01-ad9a-c13f24cc118a","pre-rebase.sample","f370f87a-668d-11f1-847c-1607ee4eb77e",56,["D",1781289528506],"#!/bin/sh\n#\n# Copyright (c) 2006, 2008 Junio C Hamano\n#\n# The \"pre-rebase\" hook is run just before \"git rebase\" starts doing\n# its job, and can prevent the command from running by exiting with\n# non-zero status.\n#\n# The hook is called with the following parameters:\n#\n# $1 -- the upstream the series was forked from.\n# $2 -- the branch being rebased (or empty when rebasing the current branch).\n#\n# This sample shows how to prevent topic branches that are already\n# merged to 'next' branch from getting rebased, because allowing it\n# would result in rebasing already published history.\n\npublish=next\nbasebranch=\"$1\"\nif test \"$#\" = 2\nthen\n\ttopic=\"refs/heads/$2\"\nelse\n\ttopic=`git symbolic-ref HEAD` ||\n\texit 0 ;# we do not interrupt rebasing detached HEAD\nfi\n\ncase \"$topic\" in\nrefs/heads/??/*)\n\t;;\n*)\n\texit 0 ;# we do not interrupt others.\n\t;;\nesac\n\n# Now we are dealing with a topic branch being rebased\n# on top of master. Is it OK to rebase it?\n\n# Does the topic really exist?\ngit show-ref -q \"$topic\" || {\n\techo >&2 \"No such branch $topic\"\n\texit 1\n}\n\n# Is topic fully merged to master?\nnot_in_master=`git rev-list --pretty=oneline ^master \"$topic\"`\nif test -z \"$not_in_master\"\nthen\n\techo >&2 \"$topic is fully merged to master; better remove it.\"\n\texit 1 ;# we could allow it, but there is no point.\nfi\n\n# Is topic ever merged to next? If so you should not be rebasing it.\nonly_next_1=`git rev-list ^master \"^$topic\" ${publish} | sort`\nonly_next_2=`git rev-list ^master ${publish} | sort`\nif test \"$only_next_1\" = \"$only_next_2\"\nthen\n\tnot_in_topic=`git rev-list \"^$topic\" master`\n\tif test -z \"$not_in_topic\"\n\tthen\n\t\techo >&2 \"$topic is already up to date with master\"\n\t\texit 1 ;# we could allow it, but there is no point.\n\telse\n\t\texit 0\n\tfi\nelse\n\tnot_in_next=`git rev-list --pretty=oneline ^${publish} \"$topic\"`\n\t/usr/bin/perl -e '\n\t\tmy $topic = $ARGV[0];\n\t\tmy $msg = \"* $topic has commits already merged to public branch:\\n\";\n\t\tmy (%not_in_next) = map {\n\t\t\t/^([0-9a-f]+) /;\n\t\t\t($1 => 1);\n\t\t} split(/\\n/, $ARGV[1]);\n\t\tfor my $elem (map {\n\t\t\t\t/^([0-9a-f]+) (.*)$/;\n\t\t\t\t[$1 => $2];\n\t\t\t} split(/\\n/, $ARGV[2])) {\n\t\t\tif (!exists $not_in_next{$elem->[0]}) {\n\t\t\t\tif ($msg) {\n\t\t\t\t\tprint STDERR $msg;\n\t\t\t\t\tundef $msg;\n\t\t\t\t}\n\t\t\t\tprint STDERR \" $elem->[1]\\n\";\n\t\t\t}\n\t\t}\n\t' \"$topic\" \"$not_in_next\" \"$not_in_master\"\n\texit 1\nfi\n\n<<\\DOC_END\n\nThis sample hook safeguards topic branches that have been\npublished from being rewound.\n\nThe workflow assumed here is:\n\n * Once a topic branch forks from \"master\", \"master\" is never\n merged into it again (either directly or indirectly).\n\n * Once a topic branch is fully cooked and merged into \"master\",\n it is deleted. If you need to build on top of it to correct\n earlier mistakes, a new topic branch is created by forking at\n the tip of the \"master\". This is not strictly necessary, but\n it makes it easier to keep your history simple.\n\n * Whenever you need to test or publish your changes to topic\n branches, merge them into \"next\" branch.\n\nThe script, being an example, hardcodes the publish branch name\nto be \"next\", but it is trivial to make it configurable via\n$GIT_DIR/config mechanism.\n\nWith this workflow, you would want to know:\n\n(1) ... if a topic branch has ever been merged to \"next\". Young\n topic branches can have stupid mistakes you would rather\n clean up before publishing, and things that have not been\n merged into other branches can be easily rebased without\n affecting other people. But once it is published, you would\n not want to rewind it.\n\n(2) ... if a topic branch has been fully merged to \"master\".\n Then you can delete it. More importantly, you should not\n build on top of it -- other people may already want to\n change things related to the topic as patches against your\n \"master\", so if you need further changes, it is better to\n fork the topic (perhaps with the same name) afresh from the\n tip of \"master\".\n\nLet's look at this example:\n\n\t\t o---o---o---o---o---o---o---o---o---o \"next\"\n\t\t / / / /\n\t\t / a---a---b A / /\n\t\t/ / / /\n\t / / c---c---c---c B /\n\t / / / \\ /\n\t / / / b---b C \\ /\n\t / / / / \\ /\n ---o---o---o---o---o---o---o---o---o---o---o \"master\"\n\n\nA, B and C are topic branches.\n\n * A has one fix since it was merged up to \"next\".\n\n * B has finished. It has been fully merged up to \"master\" and \"next\",\n and is ready to be deleted.\n\n * C has not merged to \"next\" at all.\n\nWe would want to allow C to be rebased, refuse A, and encourage\nB to be deleted.\n\nTo compute (1):\n\n\tgit rev-list ^master ^topic next\n\tgit rev-list ^master next\n\n\tif these match, topic has not merged in next at all.\n\nTo compute (2):\n\n\tgit rev-list master..topic\n\n\tif this is empty, it is fully merged to \"master\".\n\nDOC_END\n",[],[306,748,782],"33530d0d-d5c2-4cb8-ae11-d26f4df79d58","pre-push.sample","f377d88e-668d-11f1-9138-1607ee4eb77e",57,["D",1781289528611],"#!/bin/sh\n\n# An example hook script to verify what is about to be pushed. Called by \"git\n# push\" after it has checked the remote status, but before anything has been\n# pushed. If this script exits with a non-zero status nothing will be pushed.\n#\n# This hook is called with the following parameters:\n#\n# $1 -- Name of the remote to which the push is being done\n# $2 -- URL to which the push is being done\n#\n# If pushing without using a named remote those arguments will be equal.\n#\n# Information about the commits which are being pushed is supplied as lines to\n# the standard input in the form:\n#\n# \n#\n# This sample shows how to prevent push of commits where the log message starts\n# with \"WIP\" (work in progress).\n\nremote=\"$1\"\nurl=\"$2\"\n\nzero=$(git hash-object --stdin &2 \"Found WIP commit in $local_ref, not pushing\"\n\t\t\texit 1\n\t\tfi\n\tfi\ndone\n\nexit 0\n",[],[306,748,790],"50e3eebe-9912-4421-831b-75a13a9f21d6","pre-merge-commit.sample","f382276c-668d-11f1-befe-1607ee4eb77e",59,["D",1781289528646],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed.\n# Called by \"git merge\" with no arguments. The hook should\n# exit with non-zero status after issuing an appropriate message to\n# stderr if it wants to stop the merge commit.\n#\n# To enable this hook, rename this file to \"pre-merge-commit\".\n\n. git-sh-setup\ntest -x \"$GIT_DIR/hooks/pre-commit\" &&\n exec \"$GIT_DIR/hooks/pre-commit\"\n:\n",[],[306,748,798],"ac406464-d0b5-45b3-bf65-8dfac2837566","pre-commit.sample","f355039a-668d-11f1-b477-1607ee4eb77e",53,["D",1781289528300],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed.\n# Called by \"git commit\" with no arguments. The hook should\n# exit with non-zero status after issuing an appropriate message if\n# it wants to stop the commit.\n#\n# To enable this hook, rename this file to \"pre-commit\".\n\nif git rev-parse --verify HEAD >/dev/null 2>&1\nthen\n\tagainst=HEAD\nelse\n\t# Initial commit: diff against an empty tree object\n\tagainst=$(git hash-object -t tree /dev/null)\nfi\n\n# If you want to allow non-ASCII filenames set this variable to true.\nallownonascii=$(git config --type=bool hooks.allownonascii)\n\n# Redirect output to stderr.\nexec 1>&2\n\n# Cross platform projects tend to avoid non-ASCII filenames; prevent\n# them from being added to the repository. We exploit the fact that the\n# printable range starts at the space character and ends with tilde.\nif [ \"$allownonascii\" != \"true\" ] &&\n\t# Note that the use of brackets around a tr range is ok here, (it's\n\t# even required, for portability to Solaris 10's /usr/bin/tr), since\n\t# the square bracket bytes happen to fall in the designated range.\n\ttest $(git diff-index --cached --name-only --diff-filter=A -z $against |\n\t LC_ALL=C tr -d '[ -~]\\0' | wc -c) != 0\nthen\n\tcat <<\\EOF\nError: Attempt to add a non-ASCII file name.\n\nThis can cause problems if you want to work with people on other platforms.\n\nTo be portable it is advisable to rename the file.\n\nIf you know what you are doing you can disable this check using:\n\n git config hooks.allownonascii true\nEOF\n\texit 1\nfi\n\n# If there are whitespace errors, print the offending file names and fail.\nexec git diff-index --check --cached $against --\n",[],[306,748,806],"ae7b06d4-e829-462d-9f5a-17531f7f29d3","pre-applypatch.sample","f364ccbc-668d-11f1-9ab7-1607ee4eb77e",55,["D",1781289528399],"#!/bin/sh\n#\n# An example hook script to verify what is about to be committed\n# by applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit.\n#\n# To enable this hook, rename this file to \"pre-applypatch\".\n\n. git-sh-setup\nprecommit=\"$(git rev-parse --git-path hooks/pre-commit)\"\ntest -x \"$precommit\" && exec \"$precommit\" ${1+\"$@\"}\n:\n",[],[306,748,814],"24efb037-af1a-4c2d-9b7d-2a259a8f5fc7","post-update.sample","f336e0ea-668d-11f1-9084-1607ee4eb77e",50,["D",1781289528198],"#!/bin/sh\n#\n# An example hook script to prepare a packed repository for use over\n# dumb transports.\n#\n# To enable this hook, rename this file to \"post-update\".\n\nexec git update-server-info\n",[],[306,748,822],"1d50e554-f080-441a-a0ee-eccda5056cbc","fsmonitor-watchman.sample","f3f37034-668d-11f1-847c-1607ee4eb77e",71,["D",1781289528701],"#!/usr/bin/perl\n\nuse strict;\nuse warnings;\nuse IPC::Open2;\n\n# An example hook script to integrate Watchman\n# (https://facebook.github.io/watchman/) with git to speed up detecting\n# new and modified files.\n#\n# The hook is passed a version (currently 2) and last update token\n# formatted as a string and outputs to stdout a new update token and\n# all files that have been modified since the update token. Paths must\n# be relative to the root of the working tree and separated by a single NUL.\n#\n# To enable this hook, rename this file to \"query-watchman\" and set\n# 'git config core.fsmonitor .git/hooks/query-watchman'\n#\nmy ($version, $last_update_token) = @ARGV;\n\n# Uncomment for debugging\n# print STDERR \"$0 $version $last_update_token\\n\";\n\n# Check the hook interface version\nif ($version ne 2) {\n\tdie \"Unsupported query-fsmonitor hook version '$version'.\\n\" .\n\t \"Falling back to scanning...\\n\";\n}\n\nmy $git_work_tree = get_working_dir();\n\nmy $retry = 1;\n\nmy $json_pkg;\neval {\n\trequire JSON::XS;\n\t$json_pkg = \"JSON::XS\";\n\t1;\n} or do {\n\trequire JSON::PP;\n\t$json_pkg = \"JSON::PP\";\n};\n\nlaunch_watchman();\n\nsub launch_watchman {\n\tmy $o = watchman_query();\n\tif (is_work_tree_watched($o)) {\n\t\toutput_result($o->{clock}, @{$o->{files}});\n\t}\n}\n\nsub output_result {\n\tmy ($clockid, @files) = @_;\n\n\t# Uncomment for debugging watchman output\n\t# open (my $fh, \">\", \".git/watchman-output.out\");\n\t# binmode $fh, \":utf8\";\n\t# print $fh \"$clockid\\n@files\\n\";\n\t# close $fh;\n\n\tbinmode STDOUT, \":utf8\";\n\tprint $clockid;\n\tprint \"\\0\";\n\tlocal $, = \"\\0\";\n\tprint @files;\n}\n\nsub watchman_clock {\n\tmy $response = qx/watchman clock \"$git_work_tree\"/;\n\tdie \"Failed to get clock id on '$git_work_tree'.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $? != 0;\n\n\treturn $json_pkg->new->utf8->decode($response);\n}\n\nsub watchman_query {\n\tmy $pid = open2(\\*CHLD_OUT, \\*CHLD_IN, 'watchman -j --no-pretty')\n\tor die \"open2() failed: $!\\n\" .\n\t\"Falling back to scanning...\\n\";\n\n\t# In the query expression below we're asking for names of files that\n\t# changed since $last_update_token but not from the .git folder.\n\t#\n\t# To accomplish this, we're using the \"since\" generator to use the\n\t# recency index to select candidate nodes and \"fields\" to limit the\n\t# output to file names only. Then we're using the \"expression\" term to\n\t# further constrain the results.\n\tmy $last_update_line = \"\";\n\tif (substr($last_update_token, 0, 1) eq \"c\") {\n\t\t$last_update_token = \"\\\"$last_update_token\\\"\";\n\t\t$last_update_line = qq[\\n\"since\": $last_update_token,];\n\t}\n\tmy $query = <<\"\tEND\";\n\t\t[\"query\", \"$git_work_tree\", {$last_update_line\n\t\t\t\"fields\": [\"name\"],\n\t\t\t\"expression\": [\"not\", [\"dirname\", \".git\"]]\n\t\t}]\n\tEND\n\n\t# Uncomment for debugging the watchman query\n\t# open (my $fh, \">\", \".git/watchman-query.json\");\n\t# print $fh $query;\n\t# close $fh;\n\n\tprint CHLD_IN $query;\n\tclose CHLD_IN;\n\tmy $response = do {local $/; };\n\n\t# Uncomment for debugging the watch response\n\t# open ($fh, \">\", \".git/watchman-response.json\");\n\t# print $fh $response;\n\t# close $fh;\n\n\tdie \"Watchman: command returned no output.\\n\" .\n\t\"Falling back to scanning...\\n\" if $response eq \"\";\n\tdie \"Watchman: command returned invalid output: $response\\n\" .\n\t\"Falling back to scanning...\\n\" unless $response =~ /^\\{/;\n\n\treturn $json_pkg->new->utf8->decode($response);\n}\n\nsub is_work_tree_watched {\n\tmy ($output) = @_;\n\tmy $error = $output->{error};\n\tif ($retry > 0 and $error and $error =~ m/unable to resolve root .* directory (.*) is not watched/) {\n\t\t$retry--;\n\t\tmy $response = qx/watchman watch \"$git_work_tree\"/;\n\t\tdie \"Failed to make watchman watch '$git_work_tree'.\\n\" .\n\t\t \"Falling back to scanning...\\n\" if $? != 0;\n\t\t$output = $json_pkg->new->utf8->decode($response);\n\t\t$error = $output->{error};\n\t\tdie \"Watchman: $error.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $error;\n\n\t\t# Uncomment for debugging watchman output\n\t\t# open (my $fh, \">\", \".git/watchman-output.out\");\n\t\t# close $fh;\n\n\t\t# Watchman will always return all files on the first query so\n\t\t# return the fast \"everything is dirty\" flag to git and do the\n\t\t# Watchman query just to get it over with now so we won't pay\n\t\t# the cost in git to look up each individual file.\n\t\tmy $o = watchman_clock();\n\t\t$error = $output->{error};\n\n\t\tdie \"Watchman: $error.\\n\" .\n\t\t\"Falling back to scanning...\\n\" if $error;\n\n\t\toutput_result($o->{clock}, (\"/\"));\n\t\t$last_update_token = $o->{clock};\n\n\t\teval { launch_watchman() };\n\t\treturn 0;\n\t}\n\n\tdie \"Watchman: $error.\\n\" .\n\t\"Falling back to scanning...\\n\" if $error;\n\n\treturn 1;\n}\n\nsub get_working_dir {\n\tmy $working_dir;\n\tif ($^O =~ 'msys' || $^O =~ 'cygwin') {\n\t\t$working_dir = Win32::GetCwd();\n\t\t$working_dir =~ tr/\\\\/\\//;\n\t} else {\n\t\trequire Cwd;\n\t\t$working_dir = Cwd::cwd();\n\t}\n\n\treturn $working_dir;\n}\n",[],[306,748,830],"f2acb98a-4098-4ff5-8939-ed2f4246d70e","commit-msg.sample","f33d6578-668d-11f1-9ab7-1607ee4eb77e",51,["D",1781289528218],"#!/bin/sh\n#\n# An example hook script to check the commit log message.\n# Called by \"git commit\" with one argument, the name of the file\n# that has the commit message. The hook should exit with non-zero\n# status after issuing an appropriate message if it wants to stop the\n# commit. The hook is allowed to edit the commit message file.\n#\n# To enable this hook, rename this file to \"commit-msg\".\n\n# Uncomment the below to add a Signed-off-by line to the message.\n# Doing this in a hook is a bad idea in general, but the prepare-commit-msg\n# hook is more suited to it.\n#\n# SOB=$(git var GIT_AUTHOR_IDENT | sed -n 's/^\$.*>\$.*$/Signed-off-by: \\1/p')\n# grep -qs \"^$SOB\" \"$1\" || echo \"$SOB\" >> \"$1\"\n\n# This example catches duplicate Signed-off-by lines.\n\ntest \"\" = \"$(grep '^Signed-off-by: ' \"$1\" |\n\t sort | uniq -c | sed -e '/^[ \t]*1[ \t]/d')\" || {\n\techo >&2 Duplicate Signed-off-by lines.\n\texit 1\n}\n",[],[306,748,838],"0e2a4d05-5854-464f-8148-b174b1c06df5","applypatch-msg.sample","f321bd28-668d-11f1-9245-1607ee4eb77e",47,["D",1781289528031],"#!/bin/sh\n#\n# An example hook script to check the commit log message taken by\n# applypatch from an e-mail message.\n#\n# The hook should exit with non-zero status after issuing an\n# appropriate message if it wants to stop the commit. The hook is\n# allowed to edit the commit message file.\n#\n# To enable this hook, rename this file to \"applypatch-msg\".\n\n. git-sh-setup\ncommitmsg=\"$(git rev-parse --git-path hooks/commit-msg)\"\ntest -x \"$commitmsg\" && exec \"$commitmsg\" ${1+\"$@\"}\n:\n",[],[306,748,846],"d80b0eca-1ee6-4307-9d88-d85d0828f8d7",6,["D",1781289524788],[331,332,333,334,335,336,337,338,339,340,341,342,343,344],[306,748],["D",1781289524292],[330,345,347,352,375,379,380,381,382],[306],"18726005-4675-41be-86fe-e404657d2f2f","settings.local.json","55ef6624-66b3-11f1-9fc1-1607ee4eb77e",76,["D",1781305585156],"{\n \"permissions\": {\n \"allow\": [\n \"Bash(deno --version)\",\n \"Bash(deno check *)\",\n \"Bash(deno lint *)\"\n ]\n }\n}\n",[],[312,862],["D",1781305585000],[328],[312],["D",1781289523885],{"_94":93,"_101":97},{"_94":93,"_95":-5,"_96":97,"_18":54,"_98":99,"_100":25},{"_13":83,"_32":84,"_42":41,"_85":43,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":44,"_92":93},"ctx",{"_76":-5,"_121":909,"_910":911,"_912":913,"_914":25,"_915":25,"_916":25,"_917":119,"_918":-5,"_919":-7,"_920":-7,"_921":60,"_922":25,"_923":25,"_924":-5,"_925":25,"_926":25,"_927":25,"_928":-5},"ENV",{"_880":881,"_882":883,"_884":84,"_885":886,"_887":888,"_889":890,"_891":892,"_893":894,"_895":896,"_897":898,"_899":900,"_901":902,"_903":904,"_905":906,"_907":908},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v92