[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_163":164,"_165":166},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_61":133,"_16":-7,"_134":-5,"_17":135,"_136":137,"_28":138,"_21":139,"_23":140,"_141":-5,"_142":-5,"_143":-5,"_144":36,"_145":146,"_147":34,"_148":-5,"_149":-5,"_150":151},"routes/_app.x.$handle.$name._index",{"_11":12,"_13":14,"_15":-7,"_16":-7,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-7,"_26":-5,"_27":-5,"_28":29,"_30":-5,"_31":-5,"_32":-5,"_33":34,"_35":36,"_37":34},"handle","curtcox","name","cors-audit","branchName","version","project",{"_39":78,"_13":14,"_50":79,"_80":-5,"_81":36,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":-5,"_91":36,"_92":-5,"_93":-5,"_94":69,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":102,"_103":102,"_104":105,"_106":105,"_107":105,"_108":102,"_109":102,"_110":111,"_112":113,"_114":115,"_116":36},"tags",[],"counts",{"_66":67,"_68":69,"_70":67,"_71":72,"_73":74},"contents",[63],"readme","upstream","pull","files",[38],"preview","ahead","behind","showHomeCustomizationHint",true,"showHTTPPreviewSettingsHint",false,"hasHTTPFiles",{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":14,"_59":60,"_61":62},"id","23f53d88-fbbf-11f0-8e5b-42dde27851f2","main.ts","fileId","4320f7f4-fbbc-11f0-953a-42dde27851f2","parentId","branchId","431ef5ee-fbbc-11f0-953a-42dde27851f2","branchVersion",4,"latest","createdAt",["D",1769545880880],3,"fileType","http","content","/**\n * Val Town: CORS Policy Checker UI\n *\n * What it does:\n * - GET: shows a checkbox list of hardcoded APIs (from our conversation) + \"select all\" + custom URL field.\n * - POST: probes each selected API for CORS-related response headers:\n * - OPTIONS (preflight simulation) with Origin + Access-Control-Request-* headers\n * - HEAD (fallback to GET) with Origin header\n *\n * Notes:\n * - This checks *headers* (ACAO/ACAM/ACAH/etc). Browsers enforce CORS; servers do not.\n * - Many APIs block OPTIONS or require auth; you'll still see useful headers on 401/403/404 responses.\n */\n\ntype ApiItem = {\n id: string;\n name: string;\n testUrl?: string; // If missing, user should supply via the custom URL field.\n notes?: string;\n};\n\ntype Probe = {\n ok: boolean;\n status?: number;\n statusText?: string;\n error?: string;\n headers: Record;\n};\n\ntype ResultRow = {\n name: string;\n url: string;\n classification: string;\n browserSimpleGet: string;\n preflight: string;\n headOrGet: Probe;\n options: Probe;\n notes?: string;\n};\n\nconst APIS: ApiItem[] = [\n // ======== Code-frequency lists (Top 100-ish) ========\n { id: \"github\", name: \"GitHub REST API\", testUrl: \"https://api.github.com/\" },\n {\n id: \"github_graphql\",\n name: \"GitHub GraphQL API\",\n testUrl: \"https://api.github.com/graphql\",\n },\n { id: \"openai\", name: \"OpenAI API\", testUrl: \"https://api.openai.com/v1/\" },\n { id: \"stripe\", name: \"Stripe API\", testUrl: \"https://api.stripe.com/v1/\" },\n { id: \"aws_s3\", name: \"AWS S3\", testUrl: \"https://s3.amazonaws.com/\" },\n {\n id: \"discord\",\n name: \"Discord API\",\n testUrl: \"https://discord.com/api/v10/\",\n },\n {\n id: \"slack\",\n name: \"Slack Web API\",\n testUrl: \"https://slack.com/api/api.test\",\n },\n {\n id: \"firebase\",\n name: \"Firebase (various)\",\n testUrl: \"https://firebase.googleapis.com/\",\n },\n {\n id: \"google_maps\",\n name: \"Google Maps / Places APIs\",\n testUrl: \"https://maps.googleapis.com/maps/api/\",\n },\n {\n id: \"twilio\",\n name: \"Twilio API\",\n testUrl: \"https://api.twilio.com/2010-04-01/\",\n },\n {\n id: \"youtube\",\n name: \"YouTube Data API\",\n testUrl: \"https://www.googleapis.com/youtube/v3/\",\n },\n {\n id: \"gdrive\",\n name: \"Google Drive API\",\n testUrl: \"https://www.googleapis.com/drive/v3/\",\n },\n {\n id: \"gsheets\",\n name: \"Google Sheets API\",\n testUrl: \"https://sheets.googleapis.com/v4/spreadsheets\",\n },\n {\n id: \"telegram_bot\",\n name: \"Telegram Bot API\",\n testUrl: \"https://api.telegram.org/\",\n },\n {\n id: \"elasticsearch\",\n name: \"Elasticsearch / OpenSearch (self-hosted)\",\n notes: \"Needs your cluster URL, e.g. https://your-es/_cluster/health\",\n },\n {\n id: \"sendgrid\",\n name: \"SendGrid API\",\n testUrl: \"https://api.sendgrid.com/v3/\",\n },\n {\n id: \"mailgun\",\n name: \"Mailgun API\",\n testUrl: \"https://api.mailgun.net/v3/\",\n },\n {\n id: \"amazon_ses\",\n name: \"Amazon SES (mostly via AWS SDK)\",\n testUrl: \"https://email.us-east-1.amazonaws.com/\",\n },\n {\n id: \"ms_graph\",\n name: \"Microsoft Graph\",\n testUrl: \"https://graph.microsoft.com/v1.0/\",\n },\n {\n id: \"shopify\",\n name: \"Shopify Admin API\",\n notes:\n \"Needs shop domain, e.g. https://{shop}.myshopify.com/admin/api/2024-01/\",\n },\n { id: \"notion\", name: \"Notion API\", testUrl: \"https://api.notion.com/v1/\" },\n {\n id: \"airtable\",\n name: \"Airtable API\",\n testUrl: \"https://api.airtable.com/v0/\",\n },\n { id: \"algolia\", name: \"Algolia API\", testUrl: \"https://algolia.com/\" },\n {\n id: \"spotify\",\n name: \"Spotify Web API\",\n testUrl: \"https://api.spotify.com/v1/\",\n },\n {\n id: \"reddit\",\n name: \"Reddit (public JSON listing)\",\n testUrl: \"https://www.reddit.com/r/all.json\",\n },\n { id: \"mapbox\", name: \"Mapbox API\", testUrl: \"https://api.mapbox.com/\" },\n {\n id: \"openweathermap\",\n name: \"OpenWeatherMap API\",\n testUrl: \"https://api.openweathermap.org/\",\n },\n {\n id: \"kubernetes\",\n name: \"Kubernetes API (cluster-specific)\",\n notes:\n \"Needs your cluster API server URL, e.g. https://kubernetes.default.svc\",\n },\n {\n id: \"docker_hub\",\n name: \"Docker Hub / Registry API\",\n testUrl: \"https://registry-1.docker.io/v2/\",\n },\n { id: \"gitlab\", name: \"GitLab API\", testUrl: \"https://gitlab.com/api/v4/\" },\n {\n id: \"cloudflare\",\n name: \"Cloudflare API\",\n testUrl: \"https://api.cloudflare.com/client/v4/\",\n },\n { id: \"plaid\", name: \"Plaid API\", testUrl: \"https://production.plaid.com/\" },\n {\n id: \"paypal\",\n name: \"PayPal REST API\",\n testUrl: \"https://api-m.paypal.com/\",\n },\n {\n id: \"square\",\n name: \"Square API\",\n testUrl: \"https://connect.squareup.com/v2/\",\n },\n {\n id: \"salesforce\",\n name: \"Salesforce REST API\",\n testUrl: \"https://login.salesforce.com/services/data/\",\n },\n { id: \"hubspot\", name: \"HubSpot API\", testUrl: \"https://api.hubapi.com/\" },\n {\n id: \"dropbox\",\n name: \"Dropbox API\",\n testUrl: \"https://api.dropboxapi.com/2/\",\n },\n { id: \"sentry\", name: \"Sentry API\", testUrl: \"https://sentry.io/api/0/\" },\n {\n id: \"gcal\",\n name: \"Google Calendar API\",\n testUrl: \"https://www.googleapis.com/calendar/v3/\",\n },\n {\n id: \"gmail\",\n name: \"Gmail API\",\n testUrl: \"https://gmail.googleapis.com/gmail/v1/\",\n },\n {\n id: \"ga4_mp\",\n name: \"Google Analytics 4 Measurement Protocol\",\n testUrl: \"https://www.google-analytics.com/mp/collect\",\n },\n { id: \"tmdb\", name: \"TMDB API\", testUrl: \"https://api.themoviedb.org/3/\" },\n { id: \"twitch\", name: \"Twitch API\", testUrl: \"https://api.twitch.tv/helix/\" },\n {\n id: \"datadog\",\n name: \"Datadog API\",\n testUrl: \"https://api.datadoghq.com/api/v1/\",\n },\n {\n id: \"cloudinary\",\n name: \"Cloudinary API\",\n testUrl: \"https://api.cloudinary.com/v1_1/\",\n },\n {\n id: \"supabase\",\n name: \"Supabase (project-specific)\",\n notes:\n \"Needs your project URL, e.g. https://{project}.supabase.co/rest/v1/\",\n },\n {\n id: \"hf_inference\",\n name: \"Hugging Face Inference API\",\n testUrl: \"https://api-inference.huggingface.co/\",\n },\n {\n id: \"anthropic\",\n name: \"Anthropic API\",\n testUrl: \"https://api.anthropic.com/v1/\",\n },\n { id: \"deepl\", name: \"DeepL API\", testUrl: \"https://api-free.deepl.com/v2/\" },\n {\n id: \"pagerduty\",\n name: \"PagerDuty API\",\n testUrl: \"https://api.pagerduty.com/\",\n },\n {\n id: \"jira\",\n name: \"Jira Cloud REST API\",\n testUrl: \"https://api.atlassian.com/\",\n },\n\n // ======== Next 50-ish list ========\n { id: \"zoom\", name: \"Zoom API\", testUrl: \"https://api.zoom.us/v2/\" },\n {\n id: \"wordpress_rest\",\n name: \"WordPress REST API (example)\",\n testUrl: \"https://wordpress.org/wp-json/wp/v2/\",\n },\n {\n id: \"mailchimp\",\n name: \"Mailchimp Marketing API (needs DC)\",\n notes: \"Needs datacenter host, e.g. https://{dc}.api.mailchimp.com/3.0/\",\n },\n {\n id: \"auth0\",\n name: \"Auth0 Management API (needs tenant)\",\n notes: \"Needs tenant, e.g. https://{tenant}.us.auth0.com/api/v2/\",\n },\n {\n id: \"okta\",\n name: \"Okta API (needs org)\",\n notes: \"Needs org URL, e.g. https://{yourOktaDomain}/api/v1/\",\n },\n {\n id: \"facebook_graph\",\n name: \"Facebook (Meta) Graph API\",\n testUrl: \"https://graph.facebook.com/\",\n },\n {\n id: \"instagram_graph\",\n name: \"Instagram Graph API\",\n testUrl: \"https://graph.facebook.com/\",\n },\n { id: \"x_api\", name: \"Twitter/X API v2\", testUrl: \"https://api.x.com/2/\" },\n {\n id: \"jenkins\",\n name: \"Jenkins (self-hosted)\",\n notes: \"Needs your Jenkins URL, e.g. https://jenkins.example.com/api/json\",\n },\n {\n id: \"circleci\",\n name: \"CircleCI API\",\n testUrl: \"https://circleci.com/api/v2/\",\n },\n {\n id: \"sonarqube\",\n name: \"SonarQube (often self-hosted)\",\n notes:\n \"Needs your SonarQube URL, e.g. https://sonar.example.com/api/system/status\",\n },\n {\n id: \"jfrog\",\n name: \"JFrog Artifactory\",\n notes:\n \"Needs your Artifactory URL, e.g. https://artifactory.example.com/artifactory/api/system/ping\",\n },\n {\n id: \"prometheus\",\n name: \"Prometheus HTTP API (self-hosted)\",\n notes:\n \"Needs your Prometheus URL, e.g. https://prom.example.com/api/v1/status/buildinfo\",\n },\n {\n id: \"grafana\",\n name: \"Grafana API (self-hosted/cloud)\",\n notes:\n \"Needs your Grafana URL, e.g. https://grafana.example.com/api/health\",\n },\n {\n id: \"newrelic\",\n name: \"New Relic API\",\n testUrl: \"https://api.newrelic.com/v2/\",\n },\n {\n id: \"teams\",\n name: \"Microsoft Teams (via Graph)\",\n testUrl: \"https://graph.microsoft.com/v1.0/teams\",\n },\n {\n id: \"zendesk\",\n name: \"Zendesk API (needs subdomain)\",\n notes: \"Needs subdomain URL, e.g. https://{sub}.zendesk.com/api/v2/\",\n },\n { id: \"intercom\", name: \"Intercom API\", testUrl: \"https://api.intercom.io/\" },\n {\n id: \"freshdesk\",\n name: \"Freshdesk API (needs domain)\",\n notes: \"Needs domain URL, e.g. https://{domain}.freshdesk.com/api/v2/\",\n },\n { id: \"asana\", name: \"Asana API\", testUrl: \"https://app.asana.com/api/1.0/\" },\n {\n id: \"servicenow\",\n name: \"ServiceNow API (needs instance)\",\n notes:\n \"Needs instance URL, e.g. https://{instance}.service-now.com/api/now/\",\n },\n {\n id: \"linear\",\n name: \"Linear API (GraphQL)\",\n testUrl: \"https://api.linear.app/graphql\",\n },\n {\n id: \"clickup\",\n name: \"ClickUp API\",\n testUrl: \"https://api.clickup.com/api/v2/\",\n },\n { id: \"segment\", name: \"Segment API\", testUrl: \"https://api.segment.io/\" },\n {\n id: \"mixpanel\",\n name: \"Mixpanel API\",\n testUrl: \"https://api.mixpanel.com/\",\n },\n {\n id: \"amplitude\",\n name: \"Amplitude API\",\n testUrl: \"https://api2.amplitude.com/\",\n },\n { id: \"vercel\", name: \"Vercel API\", testUrl: \"https://api.vercel.com/\" },\n {\n id: \"netlify\",\n name: \"Netlify API\",\n testUrl: \"https://api.netlify.com/api/v1/\",\n },\n {\n id: \"contentful\",\n name: \"Contentful API\",\n testUrl: \"https://cdn.contentful.com/\",\n },\n { id: \"sanity\", name: \"Sanity API\", testUrl: \"https://api.sanity.io/\" },\n { id: \"prismic\", name: \"Prismic API\", testUrl: \"https://prismic.io/\" },\n {\n id: \"unsplash\",\n name: \"Unsplash API\",\n testUrl: \"https://api.unsplash.com/\",\n },\n { id: \"webex\", name: \"Webex API\", testUrl: \"https://webexapis.com/v1/\" },\n { id: \"giphy\", name: \"Giphy API\", testUrl: \"https://api.giphy.com/v1/\" },\n {\n id: \"whatsapp_cloud\",\n name: \"WhatsApp Business Cloud API\",\n testUrl: \"https://graph.facebook.com/\",\n },\n {\n id: \"fb_messenger\",\n name: \"Facebook Messenger Platform\",\n testUrl: \"https://graph.facebook.com/\",\n },\n {\n id: \"pusher\",\n name: \"Pusher Channels\",\n testUrl: \"https://api.pusherapp.com/\",\n },\n { id: \"ably\", name: \"Ably API\", testUrl: \"https://rest.ably.io/\" },\n { id: \"pubnub\", name: \"PubNub API\", testUrl: \"https://ps.pndsn.com/\" },\n {\n id: \"coinbase\",\n name: \"Coinbase API\",\n testUrl: \"https://api.coinbase.com/v2/\",\n },\n {\n id: \"binance\",\n name: \"Binance API\",\n testUrl: \"https://api.binance.com/api/v3/time\",\n },\n {\n id: \"kraken\",\n name: \"Kraken API\",\n testUrl: \"https://api.kraken.com/0/public/Time\",\n },\n {\n id: \"alphavantage\",\n name: \"Alpha Vantage API (demo)\",\n testUrl:\n \"https://www.alphavantage.co/query?function=TIME_SERIES_DAILY&symbol=IBM&apikey=demo\",\n },\n { id: \"snyk\", name: \"Snyk API\", testUrl: \"https://api.snyk.io/\" },\n {\n id: \"virustotal\",\n name: \"VirusTotal API\",\n testUrl: \"https://www.virustotal.com/api/v3/\",\n },\n { id: \"fastly\", name: \"Fastly API\", testUrl: \"https://api.fastly.com/\" },\n {\n id: \"akamai\",\n name: \"Akamai APIs (various)\",\n testUrl: \"https://open-api.akamai.com/\",\n },\n {\n id: \"meraki\",\n name: \"Cisco Meraki Dashboard API\",\n testUrl: \"https://api.meraki.com/api/v1/\",\n },\n {\n id: \"amazon_spapi\",\n name: \"Amazon Selling Partner API (SP-API)\",\n testUrl: \"https://sellingpartnerapi-na.amazon.com/\",\n },\n {\n id: \"cradlepoint\",\n name: \"Cradlepoint NetCloud API\",\n testUrl: \"https://www.cradlepointecm.com/api/\",\n },\n\n // ======== Automation-list-only items ========\n { id: \"trello\", name: \"Trello API\", testUrl: \"https://api.trello.com/1/\" },\n {\n id: \"monday\",\n name: \"Monday.com API\",\n testUrl: \"https://api.monday.com/v2\",\n },\n {\n id: \"typeform\",\n name: \"Typeform API\",\n testUrl: \"https://api.typeform.com/\",\n },\n { id: \"jotform\", name: \"Jotform API\", testUrl: \"https://api.jotform.com/\" },\n {\n id: \"gforms\",\n name: \"Google Forms API\",\n testUrl: \"https://forms.googleapis.com/v1/forms\",\n },\n {\n id: \"woocommerce\",\n name: \"WooCommerce (site-specific)\",\n notes: \"Needs site URL, e.g. https://{site}/wp-json/wc/v3/\",\n },\n { id: \"klaviyo\", name: \"Klaviyo API\", testUrl: \"https://a.klaviyo.com/api/\" },\n {\n id: \"activecampaign\",\n name: \"ActiveCampaign (needs account host)\",\n notes: \"Needs account host, e.g. https://{account}.api-us1.com/api/3/\",\n },\n {\n id: \"calendly\",\n name: \"Calendly API\",\n testUrl: \"https://api.calendly.com/\",\n },\n {\n id: \"docusign\",\n name: \"DocuSign API (demo)\",\n testUrl: \"https://demo.docusign.net/restapi/\",\n },\n {\n id: \"pandadoc\",\n name: \"PandaDoc API\",\n testUrl: \"https://api.pandadoc.com/public/v1/\",\n },\n {\n id: \"onedrive\",\n name: \"OneDrive (via Graph)\",\n testUrl: \"https://graph.microsoft.com/v1.0/me/drive\",\n },\n { id: \"box\", name: \"Box API\", testUrl: \"https://api.box.com/2.0/\" },\n {\n id: \"pipedrive\",\n name: \"Pipedrive API\",\n testUrl: \"https://api.pipedrive.com/v1/\",\n },\n {\n id: \"close\",\n name: \"Close CRM API\",\n testUrl: \"https://api.close.com/api/v1/\",\n },\n {\n id: \"google_ads\",\n name: \"Google Ads API\",\n testUrl: \"https://googleads.googleapis.com/\",\n },\n {\n id: \"meta_ads\",\n name: \"Meta Ads (Graph)\",\n testUrl: \"https://graph.facebook.com/\",\n },\n {\n id: \"linkedin\",\n name: \"LinkedIn APIs\",\n testUrl: \"https://api.linkedin.com/v2/\",\n },\n {\n id: \"confluence\",\n name: \"Confluence Cloud (Atlassian)\",\n testUrl: \"https://api.atlassian.com/\",\n },\n { id: \"miro\", name: \"Miro API\", testUrl: \"https://api.miro.com/v1/\" },\n { id: \"figma\", name: \"Figma API\", testUrl: \"https://api.figma.com/v1/\" },\n { id: \"webflow\", name: \"Webflow API\", testUrl: \"https://api.webflow.com/\" },\n { id: \"wix\", name: \"Wix APIs\", testUrl: \"https://www.wixapis.com/\" },\n {\n id: \"squarespace\",\n name: \"Squarespace APIs\",\n testUrl: \"https://api.squarespace.com/\",\n },\n {\n id: \"gcontacts\",\n name: \"Google People API (Contacts)\",\n testUrl: \"https://people.googleapis.com/v1/\",\n },\n {\n id: \"qbo\",\n name: \"QuickBooks Online API\",\n testUrl: \"https://quickbooks.api.intuit.com/\",\n },\n {\n id: \"xero\",\n name: \"Xero API\",\n testUrl: \"https://api.xero.com/api.xro/2.0/\",\n },\n {\n id: \"freshbooks\",\n name: \"FreshBooks API\",\n testUrl: \"https://api.freshbooks.com/\",\n },\n {\n id: \"smartsheet\",\n name: \"Smartsheet API\",\n testUrl: \"https://api.smartsheet.com/2.0/\",\n },\n { id: \"coda\", name: \"Coda API\", testUrl: \"https://coda.io/apis/v1/\" },\n {\n id: \"todoist\",\n name: \"Todoist API\",\n testUrl: \"https://api.todoist.com/rest/v2/\",\n },\n {\n id: \"gdocs\",\n name: \"Google Docs API\",\n testUrl: \"https://docs.googleapis.com/v1/documents\",\n },\n {\n id: \"basecamp\",\n name: \"Basecamp API\",\n testUrl: \"https://3.basecampapi.com/\",\n },\n {\n id: \"zoho_crm\",\n name: \"Zoho CRM API\",\n testUrl: \"https://www.zohoapis.com/crm/v2/\",\n },\n {\n id: \"dynamics365\",\n name: \"Microsoft Dynamics 365 (instance-specific)\",\n notes:\n \"Needs your org URL, e.g. https://{org}.crm.dynamics.com/api/data/v9.2/\",\n },\n {\n id: \"insightly\",\n name: \"Insightly API\",\n testUrl: \"https://api.insightly.com/v3.1/\",\n },\n {\n id: \"helpscout\",\n name: \"Help Scout API\",\n testUrl: \"https://api.helpscout.net/v2/\",\n },\n { id: \"front\", name: \"Front API\", testUrl: \"https://api2.frontapp.com/\" },\n {\n id: \"gorgias\",\n name: \"Gorgias (needs domain)\",\n notes: \"Needs domain URL, e.g. https://{domain}.gorgias.com/api/\",\n },\n {\n id: \"mailerlite\",\n name: \"MailerLite API\",\n testUrl: \"https://api.mailerlite.com/api/v2/\",\n },\n {\n id: \"postmark\",\n name: \"Postmark API\",\n testUrl: \"https://api.postmarkapp.com/\",\n },\n {\n id: \"cloudconvert\",\n name: \"CloudConvert API\",\n testUrl: \"https://api.cloudconvert.com/v2/\",\n },\n { id: \"pdfco\", name: \"PDF.co API\", testUrl: \"https://api.pdf.co/v1/\" },\n {\n id: \"docparser\",\n name: \"Docparser API\",\n testUrl: \"https://api.docparser.com/v1/\",\n },\n {\n id: \"parseur\",\n name: \"Parseur / Mailparser\",\n testUrl: \"https://api.parseur.com/\",\n },\n { id: \"apify\", name: \"Apify API\", testUrl: \"https://api.apify.com/v2/\" },\n {\n id: \"clearbit\",\n name: \"Clearbit API\",\n testUrl: \"https://api.clearbit.com/v1/\",\n },\n { id: \"hunter\", name: \"Hunter.io API\", testUrl: \"https://api.hunter.io/v2/\" },\n { id: \"bitly\", name: \"Bitly API\", testUrl: \"https://api-ssl.bitly.com/v4/\" },\n {\n id: \"uptimerobot\",\n name: \"UptimeRobot API\",\n testUrl: \"https://api.uptimerobot.com/v2/\",\n },\n {\n id: \"gcs\",\n name: \"Google Cloud Storage JSON API\",\n testUrl: \"https://storage.googleapis.com/storage/v1/\",\n },\n {\n id: \"azure_blob\",\n name: \"Azure Blob Storage (account-specific)\",\n notes: \"Needs account URL, e.g. https://{account}.blob.core.windows.net/\",\n },\n {\n id: \"mysql\",\n name: \"MySQL (not HTTP)\",\n notes:\n \"Not an HTTP API; CORS not applicable. Use a proxy/service URL in Custom URL if relevant.\",\n },\n {\n id: \"postgres\",\n name: \"PostgreSQL (not HTTP)\",\n notes:\n \"Not an HTTP API; CORS not applicable. Use a proxy/service URL in Custom URL if relevant.\",\n },\n {\n id: \"mongodb\",\n name: \"MongoDB (Atlas Data API)\",\n testUrl: \"https://data.mongodb-api.com/\",\n },\n {\n id: \"bigquery\",\n name: \"BigQuery API\",\n testUrl: \"https://bigquery.googleapis.com/bigquery/v2/\",\n },\n {\n id: \"snowflake\",\n name: \"Snowflake (account-specific)\",\n notes: \"Needs account URL, e.g. https://{account}.snowflakecomputing.com/\",\n },\n { id: \"ebay\", name: \"eBay APIs\", testUrl: \"https://api.ebay.com/\" },\n { id: \"etsy\", name: \"Etsy API\", testUrl: \"https://openapi.etsy.com/v3/\" },\n\n // ======== Extra asked: LogicMonitor + Tenable + similar ========\n {\n id: \"logicmonitor\",\n name: \"LogicMonitor API (needs company)\",\n notes:\n \"Needs company URL, e.g. https://{company}.logicmonitor.com/santaba/rest/\",\n },\n {\n id: \"tenable\",\n name: \"Tenable.io API\",\n testUrl: \"https://cloud.tenable.com/\",\n },\n {\n id: \"qualys\",\n name: \"Qualys API\",\n testUrl: \"https://qualysapi.qualys.com/\",\n },\n {\n id: \"rapid7\",\n name: \"Rapid7 Insight Platform APIs\",\n testUrl: \"https://us.api.insight.rapid7.com/\",\n },\n {\n id: \"crowdstrike\",\n name: \"CrowdStrike API\",\n testUrl: \"https://api.crowdstrike.com/\",\n },\n\n // ======== Free no-auth APIs list ========\n {\n id: \"wikipedia_action\",\n name: \"Wikipedia / MediaWiki Action API\",\n testUrl:\n \"https://en.wikipedia.org/w/api.php?action=query&format=json&meta=siteinfo\",\n },\n {\n id: \"wikipedia_rest\",\n name: \"Wikipedia REST API\",\n testUrl: \"https://en.wikipedia.org/api/rest_v1/\",\n },\n {\n id: \"wikidata_sparql\",\n name: \"Wikidata Query Service (SPARQL)\",\n testUrl:\n \"https://query.wikidata.org/sparql?query=SELECT%20*%20WHERE%20%7B%20%3Fs%20%3Fp%20%3Fo%20%7D%20LIMIT%201\",\n },\n {\n id: \"nominatim\",\n name: \"OSM Nominatim\",\n testUrl:\n \"https://nominatim.openstreetmap.org/search?q=New%20York&format=json\",\n },\n {\n id: \"overpass\",\n name: \"Overpass API\",\n testUrl:\n \"https://overpass-api.de/api/interpreter?data=%5Bout%3Ajson%5D%5Btimeout%3A5%5D%3Bnode%5Bamenity%3Dcafe%5D(40.73%2C-74.01%2C40.74%2C-74.00)%3Bout%201%3B\",\n },\n {\n id: \"open_meteo\",\n name: \"Open-Meteo\",\n testUrl:\n \"https://api.open-meteo.com/v1/forecast?latitude=40.7128&longitude=-74.0060¤t=temperature_2m\",\n },\n {\n id: \"nws\",\n name: \"US National Weather Service (api.weather.gov)\",\n testUrl: \"https://api.weather.gov/\",\n },\n {\n id: \"openlibrary\",\n name: \"Open Library\",\n testUrl: \"https://openlibrary.org/search.json?q=lord%20of%20the%20rings\",\n },\n {\n id: \"crossref\",\n name: \"Crossref REST API\",\n testUrl: \"https://api.crossref.org/works?rows=1\",\n },\n {\n id: \"openalex\",\n name: \"OpenAlex\",\n testUrl: \"https://api.openalex.org/works?per-page=1\",\n },\n {\n id: \"worldbank\",\n name: \"World Bank API\",\n testUrl:\n \"https://api.worldbank.org/v2/country/us/indicator/SP.POP.TOTL?format=json\",\n },\n {\n id: \"usgs_eq\",\n name: \"USGS Earthquake API\",\n testUrl:\n \"https://earthquake.usgs.gov/fdsnws/event/1/query?format=geojson&limit=1\",\n },\n {\n id: \"uk_bank_holidays\",\n name: \"UK Bank Holidays (JSON)\",\n testUrl: \"https://www.gov.uk/bank-holidays.json\",\n },\n {\n id: \"nager\",\n name: \"Nager.Date (Public Holidays)\",\n testUrl: \"https://date.nager.at/api/v3/PublicHolidays/2026/US\",\n },\n {\n id: \"exchangerate_erapi\",\n name: \"ExchangeRate (er-api open endpoint)\",\n testUrl: \"https://open.er-api.com/v6/latest/USD\",\n },\n {\n id: \"fawaz_currency\",\n name: \"fawazahmed0 Currency API (jsDelivr)\",\n testUrl:\n \"https://cdn.jsdelivr.net/npm/@fawazahmed0/currency-api@latest/v1/currencies/usd.json\",\n },\n {\n id: \"binance_vision\",\n name: \"Binance Market Data (binance.vision)\",\n testUrl: \"https://data-api.binance.vision/api/v3/time\",\n },\n {\n id: \"coinbase_currencies\",\n name: \"Coinbase Currencies\",\n testUrl: \"https://api.coinbase.com/v2/currencies\",\n },\n {\n id: \"pokeapi\",\n name: \"PokéAPI\",\n testUrl: \"https://pokeapi.co/api/v2/pokemon/ditto\",\n },\n {\n id: \"swapi\",\n name: \"SWAPI (Star Wars)\",\n testUrl: \"https://swapi.dev/api/people/1/\",\n },\n {\n id: \"rickmorty\",\n name: \"Rick and Morty API\",\n testUrl: \"https://rickandmortyapi.com/api/character/1\",\n },\n {\n id: \"tvmaze\",\n name: \"TVMaze\",\n testUrl: \"https://api.tvmaze.com/search/shows?q=girls\",\n },\n {\n id: \"hackernews\",\n name: \"Hacker News API\",\n testUrl: \"https://hacker-news.firebaseio.com/v0/topstories.json\",\n },\n {\n id: \"jsonplaceholder\",\n name: \"JSONPlaceholder\",\n testUrl: \"https://jsonplaceholder.typicode.com/posts/1\",\n },\n {\n id: \"dummyjson\",\n name: \"DummyJSON\",\n testUrl: \"https://dummyjson.com/products/1\",\n },\n { id: \"reqres\", name: \"ReqRes\", testUrl: \"https://reqres.in/api/users/2\" },\n { id: \"httpbin\", name: \"httpbin\", testUrl: \"https://httpbin.org/get\" },\n {\n id: \"apis_guru\",\n name: \"APIs.guru OpenAPI Directory\",\n testUrl: \"https://api.apis.guru/v2/list.json\",\n },\n {\n id: \"artic\",\n name: \"Art Institute of Chicago\",\n testUrl: \"https://api.artic.edu/api/v1/artworks?limit=1\",\n },\n {\n id: \"metmuseum\",\n name: \"Met Museum Collection API\",\n testUrl:\n \"https://collectionapi.metmuseum.org/public/collection/v1/objects?metadataDate=2020-01-01\",\n },\n {\n id: \"openfoodfacts\",\n name: \"Open Food Facts\",\n testUrl: \"https://world.openfoodfacts.org/api/v2/product/737628064502.json\",\n },\n {\n id: \"openbrewerydb\",\n name: \"Open Brewery DB\",\n testUrl: \"https://api.openbrewerydb.org/v1/breweries?per_page=1\",\n },\n {\n id: \"datamuse\",\n name: \"Datamuse\",\n testUrl: \"https://api.datamuse.com/words?ml=ringing&max=1\",\n },\n {\n id: \"dictionaryapi\",\n name: \"DictionaryAPI.dev\",\n testUrl: \"https://api.dictionaryapi.dev/api/v2/entries/en/hello\",\n },\n {\n id: \"randomuser\",\n name: \"RandomUser\",\n testUrl: \"https://randomuser.me/api/\",\n },\n {\n id: \"bored\",\n name: \"Bored API\",\n testUrl: \"https://bored-api.appbrewery.com/random\",\n },\n { id: \"ipify\", name: \"IPify\", testUrl: \"https://api.ipify.org?format=json\" },\n {\n id: \"cf_trace\",\n name: \"Cloudflare Trace\",\n testUrl: \"https://1.1.1.1/cdn-cgi/trace\",\n },\n {\n id: \"do_status\",\n name: \"DigitalOcean Status\",\n testUrl: \"https://status.digitalocean.com/api/v2/summary.json\",\n },\n {\n id: \"google_favicon\",\n name: \"Google Favicon Fetcher\",\n testUrl: \"https://www.google.com/s2/favicons?domain=example.com&sz=64\",\n },\n {\n id: \"goqr\",\n name: \"goQR (QR code)\",\n testUrl:\n \"https://api.qrserver.com/v1/create-qr-code/?data=hello&size=120x120\",\n },\n {\n id: \"dicebear\",\n name: \"DiceBear Avatars\",\n testUrl: \"https://api.dicebear.com/6.x/pixel-art/svg?seed=curt\",\n },\n {\n id: \"picsum\",\n name: \"Lorem Picsum\",\n testUrl: \"https://picsum.photos/200/300\",\n },\n {\n id: \"dogceo\",\n name: \"Dog CEO\",\n testUrl: \"https://dog.ceo/api/breeds/image/random\",\n },\n {\n id: \"randomdog\",\n name: \"RandomDog\",\n testUrl: \"https://random.dog/woof.json\",\n },\n {\n id: \"randomfox\",\n name: \"RandomFox\",\n testUrl: \"https://randomfox.ca/floof/\",\n },\n {\n id: \"robohash\",\n name: \"RoboHash\",\n testUrl: \"https://robohash.org/curt.png\",\n },\n { id: \"httpcat\", name: \"http.cat\", testUrl: \"https://http.cat/418\" },\n {\n id: \"resmush\",\n name: \"ReSmush (image optimization)\",\n testUrl: \"http://api.resmush.it/ws.php?img=https://picsum.photos/200/300\",\n },\n\n // ======== Government APIs list ========\n {\n id: \"census\",\n name: \"US Census API\",\n testUrl: \"https://api.census.gov/data.html\",\n },\n {\n id: \"sec_edgar\",\n name: \"SEC EDGAR data (data.sec.gov)\",\n testUrl: \"https://data.sec.gov/\",\n },\n {\n id: \"nvd\",\n name: \"NIST NVD API\",\n testUrl:\n \"https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=1\",\n },\n {\n id: \"treasury_fiscal\",\n name: \"US Treasury Fiscal Data API\",\n testUrl: \"https://api.fiscaldata.treasury.gov/services/api/fiscal_service/\",\n },\n {\n id: \"bls\",\n name: \"BLS Public Data API\",\n testUrl: \"https://api.bls.gov/publicAPI/v2/timeseries/data/\",\n },\n {\n id: \"eia\",\n name: \"US EIA Open Data API\",\n testUrl: \"https://api.eia.gov/v2/\",\n },\n { id: \"fred\", name: \"FRED API\", testUrl: \"https://api.stlouisfed.org/fred/\" },\n {\n id: \"noaa_coops\",\n name: \"NOAA CO-OPS Tides & Currents\",\n testUrl:\n \"https://api.tidesandcurrents.noaa.gov/api/prod/datagetter?date=latest&station=8720218&product=water_level&datum=MLLW&time_zone=gmt&units=metric&format=json\",\n },\n {\n id: \"federalregister\",\n name: \"FederalRegister.gov API\",\n testUrl: \"https://www.federalregister.gov/api/v1/articles.json?per_page=1\",\n },\n { id: \"govinfo\", name: \"GovInfo API\", testUrl: \"https://api.govinfo.gov/\" },\n {\n id: \"congress\",\n name: \"Congress.gov API\",\n testUrl: \"https://api.congress.gov/v3/\",\n },\n {\n id: \"usaspending\",\n name: \"USAspending.gov API\",\n testUrl: \"https://api.usaspending.gov/api/v2/\",\n },\n {\n id: \"openfema\",\n name: \"OpenFEMA\",\n testUrl:\n \"https://www.fema.gov/api/open/v2/DisasterDeclarationsSummaries?$top=1\",\n },\n {\n id: \"clinicaltrials\",\n name: \"ClinicalTrials.gov API\",\n testUrl: \"https://clinicaltrials.gov/api/v2/studies?pageSize=1\",\n },\n {\n id: \"openfda\",\n name: \"openFDA\",\n testUrl: \"https://api.fda.gov/food/enforcement.json?limit=1\",\n },\n {\n id: \"noaa_cdo\",\n name: \"NOAA NCEI CDO API\",\n testUrl: \"https://www.ncdc.noaa.gov/cdo-web/webservices/v2/datasets\",\n },\n {\n id: \"epa_echo\",\n name: \"EPA ECHO Web Services\",\n testUrl: \"https://echo.epa.gov/echo/\",\n },\n { id: \"airnow\", name: \"AirNow API\", testUrl: \"https://www.airnowapi.org/\" },\n {\n id: \"usda_fdc\",\n name: \"USDA FoodData Central\",\n testUrl: \"https://api.nal.usda.gov/fdc/v1/\",\n },\n {\n id: \"nhtsa_vpic\",\n name: \"NHTSA vPIC\",\n testUrl:\n \"https://vpic.nhtsa.dot.gov/api/vehicles/decodevinvalues/1?format=json\",\n },\n {\n id: \"nps\",\n name: \"National Park Service API\",\n testUrl: \"https://developer.nps.gov/api/v1/parks?limit=1\",\n },\n {\n id: \"collegescorecard\",\n name: \"College Scorecard (api.data.gov)\",\n testUrl: \"https://api.data.gov/ed/collegescorecard/v1/schools?per_page=1\",\n },\n {\n id: \"regulations\",\n name: \"Regulations.gov API\",\n testUrl: \"https://api.regulations.gov/v4/\",\n },\n { id: \"samgov\", name: \"SAM.gov API\", testUrl: \"https://api.sam.gov/\" },\n { id: \"grants\", name: \"Grants.gov APIs\", testUrl: \"https://api.grants.gov/\" },\n {\n id: \"cisa_kev\",\n name: \"CISA KEV JSON feed\",\n testUrl:\n \"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json\",\n },\n {\n id: \"nara\",\n name: \"NARA Catalog API\",\n testUrl: \"https://catalog.archives.gov/api/v1/\",\n },\n {\n id: \"patentsview\",\n name: \"PatentsView API\",\n testUrl:\n \"https://api.patentsview.org/patents/query?q=%7B%22_per_page%22%3A1%7D\",\n },\n {\n id: \"uspto\",\n name: \"USPTO (example endpoint)\",\n testUrl:\n \"https://developer.uspto.gov/ibd-api/v1/patent/application?searchText=computer&start=0&rows=1\",\n },\n {\n id: \"nsf_awards\",\n name: \"NSF Awards API\",\n testUrl:\n \"https://api.nsf.gov/services/v1/awards.json?keyword=robot&offset=1\",\n },\n { id: \"bea\", name: \"BEA API\", testUrl: \"https://apps.bea.gov/api/data/\" },\n { id: \"openfec\", name: \"OpenFEC\", testUrl: \"https://api.open.fec.gov/v1/\" },\n {\n id: \"fcc\",\n name: \"FCC APIs (example)\",\n testUrl: \"https://data.fcc.gov/api/\",\n },\n {\n id: \"usps\",\n name: \"USPS APIs (legacy gateway)\",\n testUrl: \"https://secure.shippingapis.com/ShippingAPI.dll\",\n },\n {\n id: \"datagov\",\n name: \"Data.gov (catalog)\",\n testUrl: \"https://catalog.data.gov/api/3/action/site_read\",\n },\n {\n id: \"nrel_altfuel\",\n name: \"NREL Alt Fuel Stations (api.data.gov)\",\n testUrl:\n \"https://developer.nrel.gov/api/alt-fuel-stations/v1/nearest.json?location=Denver%2CCO\",\n },\n {\n id: \"usda_ers\",\n name: \"USDA ERS (api.data.gov)\",\n testUrl: \"https://api.data.gov/ers/\",\n },\n {\n id: \"fac\",\n name: \"Federal Audit Clearinghouse (api.data.gov)\",\n testUrl: \"https://api.data.gov/gsa/fac/\",\n },\n\n // Non-US gov/open-data\n {\n id: \"datagovuk_ckan\",\n name: \"data.gov.uk CKAN Action API\",\n testUrl: \"https://data.gov.uk/api/action/status_show\",\n },\n {\n id: \"uk_police\",\n name: \"UK Police API\",\n testUrl: \"https://data.police.uk/api/crime-categories\",\n },\n {\n id: \"tfl\",\n name: \"Transport for London Unified API\",\n testUrl: \"https://api.tfl.gov.uk/Line/Mode/tube/Status\",\n },\n {\n id: \"companies_house\",\n name: \"UK Companies House API\",\n testUrl: \"https://api.company-information.service.gov.uk/\",\n },\n {\n id: \"eurostat\",\n name: \"Eurostat API (dissemination)\",\n testUrl:\n \"https://ec.europa.eu/eurostat/api/dissemination/statistics/1.0/data/\",\n },\n {\n id: \"ecb_sdmx\",\n name: \"ECB SDMX API\",\n testUrl: \"https://data-api.ecb.europa.eu/service/\",\n },\n {\n id: \"statcan_wds\",\n name: \"Statistics Canada WDS\",\n testUrl: \"https://www150.statcan.gc.ca/t1/wds/en/grp/wds\",\n },\n {\n id: \"france_opendata\",\n name: \"France data.gouv.fr API\",\n testUrl: \"https://www.data.gouv.fr/api/1/\",\n },\n {\n id: \"abs\",\n name: \"Australia ABS Data API\",\n testUrl: \"https://api.data.abs.gov.au/\",\n },\n {\n id: \"datagovsg\",\n name: \"Singapore data.gov.sg (CKAN-style)\",\n testUrl: \"https://data.gov.sg/api/action/site_read\",\n },\n];\n\nfunction uniqApis(list: ApiItem[]): ApiItem[] {\n const seen = new Map();\n for (const a of list) {\n const key = a.id.trim();\n if (!seen.has(key)) seen.set(key, a);\n }\n return Array.from(seen.values()).sort((a, b) => a.name.localeCompare(b.name));\n}\n\nfunction escapeHtml(input: string): string {\n return input\n .replaceAll(\"&\", \"&\")\n .replaceAll(\"<\", \"<\")\n .replaceAll(\">\", \">\")\n .replaceAll('\"', \""\")\n .replaceAll(\"'\", \"'\");\n}\n\nfunction pickHeaders(h: Headers): Record {\n const keys = [\n \"access-control-allow-origin\",\n \"access-control-allow-methods\",\n \"access-control-allow-headers\",\n \"access-control-expose-headers\",\n \"access-control-max-age\",\n \"vary\",\n \"content-type\",\n \"server\",\n ];\n const out: Record = {};\n for (const k of keys) out[k] = h.get(k) ?? undefined;\n return out;\n}\n\nasync function fetchWithTimeout(\n url: string,\n init: RequestInit,\n timeoutMs: number,\n): Promise {\n const controller = new AbortController();\n const t = setTimeout(() => controller.abort(), timeoutMs);\n try {\n return await fetch(url, { ...init, signal: controller.signal });\n } finally {\n clearTimeout(t);\n }\n}\n\nasync function probe(\n url: string,\n method: string,\n origin: string,\n timeoutMs: number,\n): Promise {\n const headers: Record = {\n \"Origin\": origin,\n \"Accept\": \"application/json,text/plain,*/*\",\n // Some gov APIs prefer an identifying UA; server-side fetch allows setting it.\n \"User-Agent\": \"val-town-cors-checker/1.0 (+https://val.town)\",\n };\n\n if (method === \"OPTIONS\") {\n headers[\"Access-Control-Request-Method\"] = \"GET\";\n headers[\"Access-Control-Request-Headers\"] = \"content-type,authorization\";\n }\n\n try {\n const resp = await fetchWithTimeout(\n url,\n { method, redirect: \"follow\", headers },\n timeoutMs,\n );\n // Do not consume body; we only need headers.\n try {\n resp.body?.cancel();\n } catch { /* ignore */ }\n return {\n ok: resp.ok,\n status: resp.status,\n statusText: resp.statusText,\n headers: pickHeaders(resp.headers),\n };\n } catch (e: any) {\n return {\n ok: false,\n error: e?.name === \"AbortError\"\n ? `timeout after ${timeoutMs}ms`\n : String(e),\n headers: {},\n };\n }\n}\n\nfunction classifyCors(headOrGet: Probe, options: Probe, origin: string): {\n classification: string;\n browserSimpleGet: string;\n preflight: string;\n} {\n const acao = (headOrGet.headers[\"access-control-allow-origin\"] ?? \"\").trim();\n\n let classification = \"NO (no ACAO header)\";\n if (acao === \"*\") classification = \"* (public)\";\n else if (acao && acao.toLowerCase() !== \"null\") {\n // Some servers return a single origin; others return a list.\n const parts = acao.split(\",\").map((s) => s.trim()).filter(Boolean);\n if (parts.includes(origin)) {\n classification = `WL (includes this origin: ${origin})`;\n } else classification = `WL/Other (ACAO=${acao})`;\n } else if (acao.toLowerCase() === \"null\") {\n classification = \"ACAO=null (special-case; usually not helpful)\";\n }\n\n // \"Simple GET\" in browsers can work without preflight if request is \"simple\"\n // and response has ACAO permitting the page origin.\n const simpleGetOk = (acao === \"*\") ||\n (acao && acao.toLowerCase() !== \"null\" && acao.includes(origin));\n const browserSimpleGet = simpleGetOk\n ? \"Likely OK (simple requests)\"\n : \"Likely BLOCKED\";\n\n // Preflight: check if OPTIONS responded and ACAM mentions GET (best-effort).\n const optAcaO = (options.headers[\"access-control-allow-origin\"] ?? \"\").trim();\n const optAcam = (options.headers[\"access-control-allow-methods\"] ?? \"\")\n .toUpperCase();\n const preflightOk =\n (options.status && options.status >= 200 && options.status < 500) &&\n ((optAcaO === \"*\") || (optAcaO && optAcaO.includes(origin))) &&\n (optAcam.includes(\"GET\") || optAcam.includes(\"*\") || optAcam === \"\");\n const preflight = preflightOk ? \"Likely OK\" : \"Unknown/No\";\n\n return { classification, browserSimpleGet, preflight };\n}\n\nasync function mapLimit(\n items: T[],\n limit: number,\n fn: (item: T) => Promise,\n): Promise {\n const results: R[] = [];\n let i = 0;\n const workers = Array.from({ length: Math.max(1, limit) }, async () => {\n while (true) {\n const idx = i++;\n if (idx >= items.length) break;\n results[idx] = await fn(items[idx]);\n }\n });\n await Promise.all(workers);\n return results;\n}\n\nfunction renderPage(htmlBody: string, title = \"CORS Checker\"): Response {\n const html = `\n\n \n \n \n ${escapeHtml(title)}\n \n \n \n ${htmlBody}\n \n`;\n return new Response(html, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\nfunction renderForm(apis: ApiItem[]): Response {\n const apiHtml = apis.map((a) => {\n const hasUrl = !!a.testUrl;\n const disabled = hasUrl ? \"\" : \"disabled\";\n const value = escapeHtml(a.id);\n const name = escapeHtml(a.name);\n const url = a.testUrl ? escapeHtml(a.testUrl) : \"\";\n const note = a.notes\n ? escapeHtml(a.notes)\n : (hasUrl ? \"\" : \"No default URL; use the Custom URL field.\");\n return `\n

${name} ${\n hasUrl ? \"\" : `needs URL`\n }

\n ${hasUrl ? `

${url}

` : \"\"}\n ${note ? `

${note}

` : \"\"}\n

\n `;\n }).join(\"\");\n\n const body = `\n

CORS policy checker

\n Select APIs to probe. This checks Access-Control-* headers by sending an OPTIONS preflight and a HEAD/GET with an Origin header.\n (Some APIs block OPTIONS; that is still useful signal.)\n

\n\n \n\n \n `;\n\n return renderPage(body);\n}\n\nfunction renderResults(origin: string, rows: ResultRow[]): Response {\n const escapedOrigin = escapeHtml(origin);\n\n const tableRows = rows.map((r) => {\n const acaoG = escapeHtml(\n r.headOrGet.headers[\"access-control-allow-origin\"] ?? \"\",\n );\n const acamO = escapeHtml(\n r.options.headers[\"access-control-allow-methods\"] ?? \"\",\n );\n const acahO = escapeHtml(\n r.options.headers[\"access-control-allow-headers\"] ?? \"\",\n );\n const getStatus = r.headOrGet.error\n ? `ERR: ${escapeHtml(r.headOrGet.error)}`\n : `${r.headOrGet.status ?? \"\"} ${\n escapeHtml(r.headOrGet.statusText ?? \"\")\n }`.trim();\n const optStatus = r.options.error\n ? `ERR: ${escapeHtml(r.options.error)}`\n : `${r.options.status ?? \"\"} ${escapeHtml(r.options.statusText ?? \"\")}`\n .trim();\n\n const allHeadersJson = escapeHtml(\n JSON.stringify(\n { headOrGet: r.headOrGet.headers, options: r.options.headers },\n null,\n 2,\n ),\n );\n\n return `\n \n \n

${escapeHtml(r.name)}

${escapeHtml(r.url)}

\n ${r.notes ? `

${escapeHtml(r.notes)}

` : \"\"}\n \n ${escapeHtml(r.classification)}\n ${escapeHtml(r.browserSimpleGet)}\n ${escapeHtml(r.preflight)}\n \n

HEAD/GET: ${getStatus}

OPTIONS: ${optStatus}

GET ACAO: ${\n acaoG || \"(none)\"\n }

OPTIONS ACAM: ${\n acamO || \"(none)\"\n }

OPTIONS ACAH: ${\n acahO || \"(none)\"\n }

Headers

${allHeadersJson}

\n \n \n `;\n }).join(\"\");\n\n const jsonOut = escapeHtml(JSON.stringify(rows, null, 2));\n\n const body = `\n

CORS probe results

Origin used for probes: ${escapedOrigin}

\n \n

\n\n \n \n \n \n \n \n \n \n \n \n \n ${tableRows}\n \n

API	ACAO classification	Browser simple GET?	Preflight?	Details

\n\n

Copy results as JSON

${jsonOut}

\n `;\n\n return renderPage(body, \"CORS Probe Results\");\n}\n\nexport default async function handler(req: Request): Promise {\n const apis = uniqApis(APIS);\n const origin = new URL(req.url).origin;\n\n if (req.method === \"GET\") {\n return renderForm(apis);\n }\n\n if (req.method !== \"POST\") {\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const form = await req.formData();\n const selectedIds = (form.getAll(\"api\") as string[]).map(String);\n const customUrlRaw = String(form.get(\"customUrl\") ?? \"\").trim();\n const customNameRaw = String(form.get(\"customName\") ?? \"\").trim();\n\n const selectedItems: ApiItem[] = [];\n const byId = new Map(apis.map((a) => [a.id, a]));\n\n for (const id of selectedIds) {\n const item = byId.get(id);\n if (item && item.testUrl) selectedItems.push(item);\n }\n\n if (customUrlRaw) {\n try {\n const u = new URL(customUrlRaw);\n selectedItems.push({\n id: \"custom\",\n name: customNameRaw || \"Custom URL\",\n testUrl: u.toString(),\n });\n } catch {\n selectedItems.push({\n id: \"custom_invalid\",\n name: customNameRaw || \"Custom URL (invalid)\",\n testUrl: \"invalid://\",\n notes: `Invalid URL: ${customUrlRaw}`,\n });\n }\n }\n\n if (selectedItems.length === 0) {\n return renderPage(`\n

No APIs selected

Select at least one API checkbox (or provide a Custom URL), then submit.

\n \n `);\n }\n\n const TIMEOUT_MS = 10_000;\n const CONCURRENCY = 8;\n\n const rows = await mapLimit(selectedItems, CONCURRENCY, async (item) => {\n const url = item.testUrl ?? \"\";\n if (!url || url.startsWith(\"invalid://\")) {\n const emptyProbe: Probe = { ok: false, error: \"no URL\", headers: {} };\n return {\n name: item.name,\n url: item.testUrl ?? \"\",\n classification: \"N/A\",\n browserSimpleGet: \"N/A\",\n preflight: \"N/A\",\n headOrGet: emptyProbe,\n options: emptyProbe,\n notes: item.notes ?? \"No usable URL\",\n } satisfies ResultRow;\n }\n\n const options = await probe(url, \"OPTIONS\", origin, TIMEOUT_MS);\n\n // Try HEAD first; fallback to GET because many APIs reject HEAD.\n let headOrGet = await probe(url, \"HEAD\", origin, TIMEOUT_MS);\n if (\n (headOrGet.status &&\n (headOrGet.status === 405 || headOrGet.status === 501)) ||\n headOrGet.error\n ) {\n headOrGet = await probe(url, \"GET\", origin, TIMEOUT_MS);\n }\n\n const c = classifyCors(headOrGet, options, origin);\n\n return {\n name: item.name,\n url,\n classification: c.classification,\n browserSimpleGet: c.browserSimpleGet,\n preflight: c.preflight,\n headOrGet,\n options,\n notes: item.notes,\n } satisfies ResultRow;\n });\n\n return renderResults(origin, rows);\n}","deleted","label","children",[],"path",[41],{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":14,"_61":65},["D",1769545880880],[41],"pulls",0,"branches",1,"forks","envVars",{"_75":67,"_77":67},"connections",{"_75":67,"_76":67},"count","unfilledCount","emptyCount","431eb41c-fbbc-11f0-953a-42dde27851f2",["D",1769544644696],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Checks the CORS policy of various APIs.","imageUrl","userId","d94f277a-b37f-4f26-9abc-7694e9eb756e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","f5b49853-c2ee-4295-85e9-f0a0c32af35f","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_132":128},"org",{"_11":12,"_126":-5,"_127":128,"_88":89,"_129":130,"_131":36},"branch",{"_16":48,"_13":117,"_39":46,"_118":78,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yYlhYcFBTUEY0bVhuenlHd1pCbmpYckRLZlEifQ","tier","pro","canRestrictVals","profileImageUrl","","adoptOrgId",{"_39":78,"_13":14,"_50":159,"_80":-5,"_81":36,"_82":83,"_84":83,"_85":86,"_87":-5,"_88":89,"_90":-5,"_91":36,"_92":-5,"_93":-5,"_94":69,"_95":96,"_97":-5,"_98":-5,"_99":-5,"_100":-5,"_101":102,"_103":102,"_104":105,"_106":105,"_107":105,"_108":102,"_109":102,"_110":160,"_112":161,"_114":162,"_116":36},"tree",[156],[156],{"_66":67,"_68":69,"_70":67,"_71":154,"_73":155},[152],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":64,"_16":52,"_53":54,"_55":56,"_57":36,"_58":14,"_61":153},[41],{"_75":67,"_77":67},{"_75":67,"_76":67},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":34,"_50":51,"_16":52,"_53":54,"_55":56,"_57":36,"_58":14,"_59":157,"_61":158},[],[41],["D",1769544644696],{"_11":12,"_132":128},{"_11":12,"_126":-5,"_127":128,"_88":89,"_129":130,"_131":36},{"_16":48,"_13":117,"_39":46,"_118":78,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"ctx",{"_110":-5,"_149":196,"_197":198,"_199":200,"_201":36,"_202":36,"_203":36,"_204":34,"_205":-5,"_206":-7,"_207":-7,"_208":67,"_209":36,"_210":36,"_211":-5,"_212":36,"_213":36,"_214":36,"_215":-5},"ENV",{"_167":168,"_169":170,"_171":117,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191,"_192":193,"_194":195},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]