[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_341":342,"_343":344},"routes/_app.x.$handle.$name",{"_95":94,"_31":44,"_103":85,"_26":104,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":24,"_118":119,"_120":57,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":30,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":24},"version",18,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","src/vals/main.ts","latestPath","fileId","77516510-6767-11f1-996b-1607ee4eb77e","name","main.ts","fileType","http","content","import { BEATS, CONSUMERS, type ConsumerSpec } from \"../../config/beats.ts\";\nimport type { Consumer } from \"../lib/consumer-runtime.ts\";\nimport { ambientEnv, type Env, makeEnv } from \"../lib/runtime-env.ts\";\nimport { createAnalytics } from \"./consumer-analytics.ts\";\nimport { createChanges } from \"./changes.ts\";\nimport { createDashboard } from \"./dashboard.ts\";\nimport { createEmit } from \"./emit.ts\";\nimport { createInventory } from \"./consumer-inventory.ts\";\nimport { createInventoryV2 } from \"./consumer-inventory-v2.ts\";\n\n// val.town combined entry (Architecture A): the WHOLE webpoke stack as one val,\n// mirroring src/local/runtime.ts's wiring minus the s2-lite spawn. Here S2 is the\n// real cloud basin (from ambient Deno.env) and every mounted val shares one\n// std/sqlite store (so the baseline in \"webpoke:global\" is shared). The vals call\n// each other same-origin via VAL_ORIGIN (set after the first deploy, once the\n// val's URL is known). This default export is the val's HTTP handler; the cron\n// heartbeat lives in heartbeat.ts.\n\nconst env = ambientEnv();\nconst ORIGIN = (env.get(\"VAL_ORIGIN\") ?? \"\").replace(/\\/+$/, \"\");\nconst secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\nconst s2env: Record = {\n S2_ENDPOINT: env.get(\"S2_ENDPOINT\"),\n S2_TOKEN: env.get(\"S2_TOKEN\"),\n S2_BASIN: env.get(\"S2_BASIN\"),\n S2_STREAM: env.get(\"S2_STREAM\"),\n};\n\nconst FACTORIES: Record Consumer> = {\n inventory: createInventory,\n analytics: createAnalytics,\n \"inventory-v2\": createInventoryV2,\n};\n\nconst consumerUrl = (spec: ConsumerSpec): string => `${ORIGIN}${spec.localPath}`;\nconst changesUrl = `${ORIGIN}/changes`;\n\ninterface Mount {\n prefix: string;\n fetch: (req: Request) => Promise;\n}\nconst mounts: Mount[] = [];\n\nfor (const spec of CONSUMERS) {\n const factory = FACTORIES[spec.name];\n if (!factory) throw new Error(`main: no factory for consumer \"${spec.name}\"`);\n const consumer = factory(\n makeEnv({\n CHANGES_URL: changesUrl,\n POKE_SECRET: secret,\n START_ACTIVE: spec.dormant ? \"0\" : \"1\",\n SLEEP_MS: String(BEATS.analyticsSleepMs),\n }),\n );\n mounts.push({ prefix: spec.localPath, fetch: consumer.fetch });\n}\n\nconst emit = createEmit(\n makeEnv({ ...s2env, POKE_SECRET: secret, POKE_TARGETS: CONSUMERS.map(consumerUrl).join(\",\") }),\n);\nconst changes = createChanges(makeEnv(s2env));\nconst dashboard = createDashboard(\n makeEnv({\n ...s2env,\n EMIT_URL: `${ORIGIN}/emit`,\n CONSUMERS: JSON.stringify(\n CONSUMERS.filter((c) => c.onDashboard).map((c) => ({ name: c.name, url: consumerUrl(c) })),\n ),\n }),\n);\nmounts.push({ prefix: \"/emit\", fetch: emit.fetch });\nmounts.push({ prefix: \"/changes\", fetch: changes.fetch });\n\n// Longest-prefix-safe match: \"/c/inventory\" never swallows \"/c/inventory-v2\"\n// because the boundary is an exact segment (\"===\" or prefix + \"/\").\nfunction matchMount(pathname: string): { mount: Mount; rest: string } | null {\n for (const m of mounts) {\n if (pathname === m.prefix) return { mount: m, rest: \"/\" };\n if (pathname.startsWith(`${m.prefix}/`)) return { mount: m, rest: pathname.slice(m.prefix.length) };\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const hit = matchMount(url.pathname);\n // No mount → the dashboard owns the root, /api/state, and /control/*.\n if (!hit) return dashboard.fetch(req);\n // Strip the mount prefix so each val's own Router sees the path it expects.\n const target = new URL(req.url);\n target.pathname = hit.rest;\n const init: RequestInit = { method: req.method, headers: req.headers };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") init.body = await req.arrayBuffer();\n return hit.mount.fetch(new Request(target.toString(), init));\n}\n","createdAt",["D",1781382950613],"branchVersion","branchId","6d4da68d-1a5a-47ce-9df4-9316f76b557a","id","d267b633-5b62-4847-8e55-80c10d65fda2","webpoke_demo",["D",1781382627825],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Webpoke: webhooks rebuilt on an append-only S2 log (full stack)","imageUrl","1d223401-2709-4d51-8314-0ca7611e9d9a","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","efaf76f0-0509-4f61-99e7-4d9e2d1a202a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_102":98},"org",{"_95":94,"_96":-5,"_97":98,"_18":54,"_99":100,"_101":24},"branch",{"_13":84,"_31":85,"_42":41,"_86":43,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":44,"_93":94},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","devdoshi","handle","displayName","avatar","https://secure.gravatar.com/avatar/08f709e5b52546fbf4413cdceb625fc7&d=identicon","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":337,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":30,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":338,"_79":339,"_81":340,"_83":24},"tree",[162,164,183],"files",[162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183],"counts",{"_151":61,"_152":132,"_153":61,"_154":155,"_156":157},"contents",[125,126,127],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":145,"_31":146,"_29":147,"_131":-5,"_40":41,"_39":148,"_133":57,"_37":149,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_26":150},{"_42":138,"_31":139,"_29":140,"_131":-5,"_40":41,"_39":141,"_133":57,"_37":142,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_26":144},{"_42":128,"_31":129,"_29":130,"_131":-5,"_40":41,"_39":132,"_133":57,"_37":134,"_13":61,"_33":20,"_35":135,"_23":24,"_136":-5,"_26":137},"50837783-7432-4995-8259-73fc4a5eb98e","README.md","b6ef1a1a-6766-11f1-b7ab-1607ee4eb77e","parentId",1,"latest",["D",1781382627845],"# webpoke_demo\nFull stack deployed as one val. HTTP entry: src/vals/main.ts. Cron: src/vals/heartbeat.ts.\n","label",[129],"e7198b4a-a53e-4c00-90f8-4786a20f105e","src","e2c8c30f-0c01-4bcd-b3f0-e7ba9512e569",2,["D",1781382688901],"directory",[139],"d63efafb-acfe-4132-b22b-10b7f787c70a","config","8b26c48a-9394-4e00-bdd4-a930ff92af2d",7,["D",1781382751420],[146],"pulls","branches","forks","envVars",{"_158":160,"_161":61},"connections",{"_158":61,"_159":61},"count","unfilledCount",6,"emptyCount",{"_42":145,"_31":146,"_29":147,"_131":-5,"_40":41,"_39":148,"_133":57,"_37":334,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_185":335,"_26":336},{"_42":327,"_31":328,"_29":329,"_131":147,"_40":41,"_39":148,"_133":24,"_37":330,"_13":61,"_33":208,"_35":331,"_23":24,"_136":-5,"_185":332,"_26":333},{"_42":138,"_31":139,"_29":140,"_131":-5,"_40":41,"_39":141,"_133":57,"_37":324,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_185":325,"_26":326},{"_42":320,"_31":257,"_29":251,"_131":140,"_40":41,"_39":141,"_133":57,"_37":321,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_185":322,"_26":323},{"_42":312,"_31":313,"_29":314,"_131":251,"_40":41,"_39":315,"_133":57,"_37":316,"_13":61,"_33":208,"_35":317,"_23":24,"_136":-5,"_185":318,"_26":319},{"_42":304,"_31":305,"_29":306,"_131":251,"_40":41,"_39":307,"_133":57,"_37":308,"_13":61,"_33":208,"_35":309,"_23":24,"_136":-5,"_185":310,"_26":311},{"_42":296,"_31":297,"_29":298,"_131":251,"_40":41,"_39":299,"_133":57,"_37":300,"_13":61,"_33":208,"_35":301,"_23":24,"_136":-5,"_185":302,"_26":303},{"_42":288,"_31":289,"_29":290,"_131":251,"_40":41,"_39":291,"_133":57,"_37":292,"_13":61,"_33":208,"_35":293,"_23":24,"_136":-5,"_185":294,"_26":295},{"_42":281,"_31":282,"_29":283,"_131":251,"_40":41,"_39":160,"_133":57,"_37":284,"_13":61,"_33":208,"_35":285,"_23":24,"_136":-5,"_185":286,"_26":287},{"_42":273,"_31":274,"_29":275,"_131":251,"_40":41,"_39":276,"_133":57,"_37":277,"_13":61,"_33":208,"_35":278,"_23":24,"_136":-5,"_185":279,"_26":280},{"_42":266,"_31":267,"_29":268,"_131":251,"_40":41,"_39":141,"_133":57,"_37":269,"_13":61,"_33":208,"_35":270,"_23":24,"_136":-5,"_185":271,"_26":272},{"_42":258,"_31":259,"_29":260,"_131":251,"_40":41,"_39":261,"_133":57,"_37":262,"_13":61,"_33":208,"_35":263,"_23":24,"_136":-5,"_185":264,"_26":265},{"_42":248,"_31":249,"_29":250,"_131":251,"_40":41,"_39":252,"_133":57,"_37":253,"_13":61,"_33":208,"_35":254,"_23":24,"_136":-5,"_185":255,"_26":256},{"_42":244,"_31":193,"_29":189,"_131":140,"_40":41,"_39":215,"_133":57,"_37":245,"_13":61,"_33":143,"_35":-5,"_23":24,"_136":-5,"_185":246,"_26":247},{"_42":236,"_31":237,"_29":238,"_131":189,"_40":41,"_39":239,"_133":57,"_37":240,"_13":61,"_33":208,"_35":241,"_23":24,"_136":-5,"_185":242,"_26":243},{"_42":228,"_31":229,"_29":230,"_131":189,"_40":41,"_39":231,"_133":57,"_37":232,"_13":61,"_33":208,"_35":233,"_23":24,"_136":-5,"_185":234,"_26":235},{"_42":220,"_31":221,"_29":222,"_131":189,"_40":41,"_39":223,"_133":57,"_37":224,"_13":61,"_33":208,"_35":225,"_23":24,"_136":-5,"_185":226,"_26":227},{"_42":212,"_31":213,"_29":214,"_131":189,"_40":41,"_39":215,"_133":57,"_37":216,"_13":61,"_33":208,"_35":217,"_23":24,"_136":-5,"_185":218,"_26":219},{"_42":203,"_31":204,"_29":205,"_131":189,"_40":41,"_39":206,"_133":57,"_37":207,"_13":61,"_33":208,"_35":209,"_23":24,"_136":-5,"_185":210,"_26":211},{"_42":194,"_31":195,"_29":196,"_131":189,"_40":41,"_39":197,"_133":57,"_37":198,"_13":61,"_33":199,"_35":200,"_23":24,"_136":-5,"_185":201,"_26":202},{"_42":188,"_31":32,"_29":30,"_131":189,"_40":41,"_39":14,"_133":24,"_37":190,"_13":61,"_33":34,"_35":36,"_23":24,"_136":-5,"_185":191,"_26":192},{"_42":128,"_31":129,"_29":130,"_131":-5,"_40":41,"_39":132,"_133":57,"_37":184,"_13":61,"_33":20,"_35":135,"_23":24,"_136":-5,"_185":186,"_26":187},["D",1781382627845],"children",[],[129],"9e3c401d-0ab1-4016-8564-457868528bbc","ed0b27de-0558-428a-b448-4d305abc648c",["D",1781382950613],[],[139,193,32],"vals","66ff34df-2410-4da1-9f06-ae8c91e69cd8","heartbeat.ts","69c6bc06-6767-11f1-abd7-1607ee4eb77e",17,["D",1781382927903],"interval","import { CONSUMERS } from \"../../config/beats.ts\";\nimport { ambientEnv } from \"../lib/runtime-env.ts\";\n\n// The DEPLOYED heartbeat — the safety net. On val.town this is a cron val; its\n// floor is 1 minute (disclosed on camera). The poke is the sub-second path; this\n// is the backstop that drains any consumer whose poke was lost. It pulls each\n// consumer same-origin, exactly what the local runtime's interval timer does.\nexport default async function (): Promise {\n const origin = (ambientEnv().get(\"VAL_ORIGIN\") ?? \"\").replace(/\\/+$/, \"\");\n if (!origin) return;\n await Promise.all(\n CONSUMERS.map((c) => fetch(`${origin}${c.localPath}/heartbeat`, { method: \"POST\" }).catch(() => {})),\n );\n}\n",[],[139,193,195],"c77e31f1-3690-438e-83e0-4d294112a3bc","emit.ts","6412d4de-6767-11f1-b890-1607ee4eb77e",15,["D",1781382918317],"script","import { makeOrder, type OrderEvent } from \"../lib/events.ts\";\nimport { Router, json, readJson } from \"../lib/http.ts\";\nimport { type PokeBody, signPoke } from \"../lib/poke.ts\";\nimport { type Env, ambientEnv } from \"../lib/runtime-env.ts\";\nimport { openStream, s2ConfigFromEnv } from \"../lib/s2-client.ts\";\nimport { getStore } from \"../lib/store.ts\";\n\n// VENDOR · producer. The whole essential job: append to the log, then say\n// \"something changed.\" The poke is best-effort and content-free — `.catch(() =>\n// {})`, no retry — because losing it costs latency, not data. POKE_ENABLED is\n// the beat-3 cut lever; /abuse is the beat-4 misbehaviour.\n\nexport function createEmit(injected?: Env): { fetch: (req: Request) => Promise } {\n const env = injected ?? ambientEnv();\n const s2 = openStream(s2ConfigFromEnv(env));\n const streamId = `${env.get(\"S2_BASIN\") ?? \"acme\"}/${env.get(\"S2_STREAM\") ?? \"orders\"}`;\n const secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\n const targets = (env.get(\"POKE_TARGETS\") ?? \"\")\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean);\n const store = getStore(\"emit\");\n\n const pokeEnabled = async (): Promise => (await store.getJSON(\"pokeEnabled\")) ?? true;\n async function nextN(): Promise {\n const n = ((await store.getJSON(\"nextN\")) ?? 0) + 1;\n await store.setJSON(\"nextN\", n);\n return n;\n }\n\n async function appendOne(order?: OrderEvent): Promise<{ seq: number; tail: number; order: OrderEvent }> {\n const o = order ?? makeOrder(await nextN());\n o.ts = Date.now(); // stamped at append — the latency reference\n const res = await s2.append([JSON.stringify(o)]); // <- the ledger (essential)\n return { seq: res.end - 1, tail: res.tail, order: o };\n }\n\n function signed(hint: number): { headers: Record; body: string } {\n const body = JSON.stringify({ stream: streamId, hint } satisfies PokeBody);\n return { headers: { \"x-poke-sig\": signPoke(body, secret), \"content-type\": \"application/json\" }, body };\n }\n async function fire(send: { headers: Record; body: string }): Promise {\n await Promise.all(\n targets.map((u) => fetch(`${u}/poke`, { method: \"POST\", ...send }).catch(() => {})),\n );\n }\n\n const r = new Router();\n\n // append one order, then best-effort poke (no retry)\n r.post(\"/\", async (req) => {\n const provided = await readJson(req);\n const { seq, tail, order } = await appendOne(provided ?? undefined);\n if (await pokeEnabled()) await fire(signed(tail));\n return json({ seq, tail, order });\n });\n\n // beat 3 — cut / restore the poke channel\n r.post(\"/control/poke\", async (_req, { url }) => {\n await store.setJSON(\"pokeEnabled\", url.searchParams.get(\"enabled\") !== \"0\");\n return json({ ok: true, pokeEnabled: await pokeEnabled() });\n });\n\n // beat 4 — abuse: duplicates, out-of-order, stale, and one forged. None move\n // the processed count; the forged one is dropped on signature.\n r.post(\"/abuse\", async () => {\n const tail = await s2.tail();\n const sends = [\n ...Array.from({ length: 5 }, () => signed(tail)), // 5× duplicate\n signed(Math.max(0, tail - 2)), // out of order (older hint)\n signed(0), // stale\n { headers: { \"x-poke-sig\": \"0\".repeat(64), \"content-type\": \"application/json\" }, body: signed(tail).body }, // forged\n ];\n for (const s of sends) await fire(s);\n return json({ ok: true, fired: sends.length, targets: targets.length });\n });\n\n r.get(\"/status\", async () =>\n json({ pokeEnabled: await pokeEnabled(), nextN: (await store.getJSON(\"nextN\")) ?? 0, targets }),\n );\n r.post(\"/reset\", async () => {\n await store.clear();\n return json({ ok: true });\n });\n r.get(\"/\", async () => json({ val: \"emit\", how: \"POST / to append+poke; POST /control/poke?enabled=0|1; POST /abuse\" }));\n\n return { fetch: r.fetch };\n}\n",[],[139,193,204],"e42984c3-1b8c-48a3-a445-a3f2c445ffbc","consumer-inventory.ts","41ca9dee-6767-11f1-9a08-1607ee4eb77e",12,["D",1781382860818],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER. Everything below `handle` is the shared template. The customer\n// writes ONLY `handle` — a pure reducer over the events it pulled. That purity\n// is the whole point: rewind the cursor and re-run it, and you get byte-for-byte\n// the same state (beat 6).\n\ninterface Inventory {\n units: Record;\n revenue: number;\n orders: number;\n}\n\n// ▶ the one function they write\nfunction handle(events: OrderEvent[], state: Inventory): Inventory {\n for (const e of events) {\n state.units[e.sku] = (state.units[e.sku] ?? 0) + e.qty;\n state.revenue += e.amount;\n state.orders += 1;\n }\n return state;\n}\n\nexport function createInventory(env?: Env): Consumer {\n return makeConsumer({\n name: \"inventory\",\n env,\n initialState: { units: {}, revenue: 0, orders: 0 },\n handle,\n });\n}\n",[],[139,193,213],"e7e2cf71-70db-463c-9224-386b79ed7ec7","consumer-inventory-v2.ts","47cb937e-6767-11f1-95bd-1607ee4eb77e",14,["D",1781382870883],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER, v2 (beat 6 — blue/green). Same log, its OWN checkpoint, a `handle`\n// that derives MORE: it adds per-customer revenue the v1 reducer never computed.\n// Run side-by-side and diff /state against v1 to verify a new version before\n// promoting it — \"the cursor makes the rehearsal free.\" No vendor change.\n\ninterface InventoryV2 {\n units: Record;\n revenue: number;\n orders: number;\n revenueByCustomer: Record; // the new derived view\n}\n\nfunction handle(events: OrderEvent[], state: InventoryV2): InventoryV2 {\n for (const e of events) {\n state.units[e.sku] = (state.units[e.sku] ?? 0) + e.qty;\n state.revenue += e.amount;\n state.orders += 1;\n state.revenueByCustomer[e.customer] = (state.revenueByCustomer[e.customer] ?? 0) + e.amount;\n }\n return state;\n}\n\nexport function createInventoryV2(env?: Env): Consumer {\n return makeConsumer({\n name: \"inventory-v2\",\n env,\n initialState: { units: {}, revenue: 0, orders: 0, revenueByCustomer: {} },\n handle,\n });\n}\n",[],[139,193,221],"7ec06b25-cd55-4036-8414-bebcebc879bf","consumer-analytics.ts","44d9bb8c-6767-11f1-825e-1607ee4eb77e",13,["D",1781382865952],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER #2 (beat 5). A different `handle` — same events, a different view.\n// Deployed dormant (START_ACTIVE=0) so the film can spin it up and watch it\n// bootstrap the full history from cursor zero through the same /changes door,\n// while consumer #1's cursor is untouched. Its SLEEP toggle makes it lag alone.\n\ninterface Analytics {\n ordersByCustomer: Record;\n totalOrders: number;\n totalRevenue: number;\n}\n\nfunction handle(events: OrderEvent[], state: Analytics): Analytics {\n for (const e of events) {\n state.ordersByCustomer[e.customer] = (state.ordersByCustomer[e.customer] ?? 0) + 1;\n state.totalOrders += 1;\n state.totalRevenue += e.amount;\n }\n return state;\n}\n\nexport function createAnalytics(env?: Env): Consumer {\n return makeConsumer({\n name: \"analytics\",\n env,\n initialState: { ordersByCustomer: {}, totalOrders: 0, totalRevenue: 0 },\n handle,\n });\n}\n",[],[139,193,229],"763d019d-c990-4dff-b889-c11dc66a9947","changes.ts","682242a8-6767-11f1-b6b8-1607ee4eb77e",16,["D",1781382925135],"import { BEATS } from \"../../config/beats.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport { Router, json } from \"../lib/http.ts\";\nimport { type Env, ambientEnv } from \"../lib/runtime-env.ts\";\nimport { openStream, s2ConfigFromEnv } from \"../lib/s2-client.ts\";\n\n// VENDOR · changes endpoint. A thin shim over a ranged S2 read — the ONE read\n// path, so \"history\" and \"live\" come through the same door. Ordered, bounded,\n// replayable. It advertises the retention floor in `meta` (the script's stated\n// open question: S2 retention IS the replay window).\n\nexport function createChanges(injected?: Env): { fetch: (req: Request) => Promise } {\n const env = injected ?? ambientEnv();\n const s2 = openStream(s2ConfigFromEnv(env));\n\n const handler = async (_req: Request, { url }: { url: URL }): Promise => {\n const since = Math.max(0, Number(url.searchParams.get(\"since\") ?? \"0\") || 0);\n const asked = Number(url.searchParams.get(\"limit\") ?? String(BEATS.changesLimit)) || BEATS.changesLimit;\n const limit = Math.min(BEATS.changesLimit, Math.max(1, asked)); // bounded\n const { records, nextSeq, tail } = await s2.read({ since, limit });\n const events = records.map((rec) => JSON.parse(rec.body) as OrderEvent);\n return json({\n events,\n next_cursor: nextSeq,\n meta: { tail, retention_floor_seq: BEATS.retentionFloorSeq, limit },\n });\n };\n\n const r = new Router();\n r.get(\"/\", handler);\n r.get(\"/changes\", handler);\n return { fetch: r.fetch };\n}\n",[],[139,193,237],"b4254817-2deb-4592-93b0-7bb9379b67fc",["D",1781382860818],[176,177,178,179,180,181,182],[139,193],"0f435798-77bf-4138-971a-a08f77756d40","store.ts","07e0d792-6767-11f1-8090-1607ee4eb77e","d0fc993d-cf06-4f17-9a2f-d189260e76b1",8,["D",1781382763655],"import { isDeno } from \"./runtime-env.ts\";\n\n// Tiny async key/value store, the one piece of persistence a val needs (its\n// cursor, counters, and a bounded latency ring). Two backends behind one\n// interface:\n// - val.town → std/sqlite (survives the val going cold between requests)\n// - local → an in-process Map (the local runtime is one long-lived process)\n// Same interface either way, so the val code never branches on runtime.\n\nexport interface Store {\n getJSON(key: string): Promise;\n setJSON(key: string, value: unknown): Promise;\n /** Wipe this store's namespace — the reset path's \"zero the cursor\". */\n clear(): Promise;\n}\n\n// ── local: in-process Map, one bucket per namespace ──────────────────────────\nconst BUCKETS = new Map>();\n\nclass MemStore implements Store {\n private bucket: Map;\n constructor(ns: string) {\n this.bucket = BUCKETS.get(ns) ?? new Map();\n BUCKETS.set(ns, this.bucket);\n }\n getJSON(key: string): Promise {\n const raw = this.bucket.get(key);\n return Promise.resolve(raw === undefined ? undefined : (JSON.parse(raw) as T));\n }\n setJSON(key: string, value: unknown): Promise {\n this.bucket.set(key, JSON.stringify(value));\n return Promise.resolve();\n }\n clear(): Promise {\n this.bucket.clear();\n return Promise.resolve();\n }\n}\n\n// ── val.town: std/sqlite, keys prefixed by namespace ─────────────────────────\ninterface SqliteClient {\n execute(q: string | { sql: string; args?: unknown[] }): Promise<{ rows: unknown[][] }>;\n}\n\nclass SqliteStore implements Store {\n private ready: Promise;\n constructor(private ns: string) {\n this.ready = this.init();\n }\n private async init(): Promise {\n // Computed specifier so Node's bundler never tries to resolve this esm.town\n // URL — it is only ever evaluated on Deno (val.town).\n const url = \"https://esm.town/v/std/\" + \"sqlite\";\n const mod = (await import(url)) as { sqlite: SqliteClient };\n await mod.sqlite.execute(\"CREATE TABLE IF NOT EXISTS webpoke_kv (k TEXT PRIMARY KEY, v TEXT)\");\n return mod.sqlite;\n }\n private k(key: string): string {\n return `${this.ns}:${key}`;\n }\n async getJSON(key: string): Promise {\n const db = await this.ready;\n const res = await db.execute({ sql: \"SELECT v FROM webpoke_kv WHERE k = ?\", args: [this.k(key)] });\n const raw = res.rows[0]?.[0];\n return raw == null ? undefined : (JSON.parse(String(raw)) as T);\n }\n async setJSON(key: string, value: unknown): Promise {\n const db = await this.ready;\n await db.execute({\n sql: \"INSERT OR REPLACE INTO webpoke_kv (k, v) VALUES (?, ?)\",\n args: [this.k(key), JSON.stringify(value)],\n });\n }\n async clear(): Promise {\n const db = await this.ready;\n await db.execute({ sql: \"DELETE FROM webpoke_kv WHERE k LIKE ?\", args: [`${this.ns}:%`] });\n }\n}\n\nexport function getStore(namespace: string): Store {\n return isDeno ? new SqliteStore(namespace) : new MemStore(namespace);\n}\n",[],[139,257,249],"lib","0f8c1448-e3fb-4d75-bdf9-f3c8bc5e24ae","s2-client.ts","29c21e8e-6767-11f1-acfc-1607ee4eb77e",10,["D",1781382820494],"import type { Env } from \"./runtime-env.ts\";\n\n// One stream interface, one wire contract — real S2 v1 REST — verified live\n// against s2-lite (local) and the S2 cloud. (S2Config is inlined here rather than\n// imported from config/targets.ts, which pulls node:fs; the type is erased on\n// Deno anyway, but inlining removes any import-resolution risk on val.town.)\n\ninterface S2Config {\n endpoint: string;\n token: string;\n basin: string;\n stream: string;\n}\n\nexport interface LedgerRecord {\n seqNum: number;\n body: string;\n}\nexport interface AppendResult {\n start: number;\n end: number;\n tail: number;\n}\nexport interface ReadResult {\n records: LedgerRecord[];\n nextSeq: number;\n tail: number;\n}\n\nexport interface S2Stream {\n append(bodies: string[], opts?: { matchSeqNum?: number }): Promise;\n read(opts: { since: number; limit: number }): Promise;\n tail(): Promise;\n}\n\n/** Open the configured stream. One REST client, both substrates. */\nexport function openStream(cfg: S2Config): S2Stream {\n return new RestStream(cfg);\n}\n\n/** Build an S2Config from a val's injected Env (val.town Deno.env, or local). */\nexport function s2ConfigFromEnv(env: Env): S2Config {\n const endpoint = env.get(\"S2_ENDPOINT\");\n if (!endpoint) throw new Error(\"S2_ENDPOINT is required\");\n return {\n endpoint,\n token: env.get(\"S2_TOKEN\") ?? \"ignored\",\n basin: env.get(\"S2_BASIN\") ?? \"acme-shop\",\n stream: env.get(\"S2_STREAM\") ?? \"orders\",\n };\n}\n\n// S2 addresses a basin one of two ways, distinguished by a `{basin}` placeholder:\n// • cloud: https://{basin}.b.aws.s2.dev → basin in the subdomain, no header\n// • s2-lite: http://localhost:9090 → fixed origin, basin via s2-basin header\ntype StreamPosition = { seq_num: number; timestamp: number };\n\nclass RestStream implements S2Stream {\n private base: string;\n private basinHeader?: string;\n constructor(private cfg: S2Config) {\n let root = cfg.endpoint.replace(/\\/+$/, \"\");\n if (root.includes(\"{basin}\")) {\n root = root.replace(\"{basin}\", encodeURIComponent(cfg.basin));\n } else {\n this.basinHeader = cfg.basin;\n }\n this.base = `${root}/v1/streams/${encodeURIComponent(cfg.stream)}`;\n }\n private headers(): Record {\n const h: Record = {\n authorization: `Bearer ${this.cfg.token}`,\n \"s2-format\": \"raw\",\n \"content-type\": \"application/json\",\n };\n if (this.basinHeader) h[\"s2-basin\"] = this.basinHeader;\n return h;\n }\n async append(bodies: string[], opts: { matchSeqNum?: number } = {}): Promise {\n const payload: Record = { records: bodies.map((body) => ({ body })) };\n if (typeof opts.matchSeqNum === \"number\") payload.match_seq_num = opts.matchSeqNum;\n const res = await fetch(`${this.base}/records`, {\n method: \"POST\",\n headers: this.headers(),\n body: JSON.stringify(payload),\n });\n if (!res.ok) throw new Error(`s2 append ${res.status}: ${await res.text()}`);\n const ack = (await res.json()) as { start: StreamPosition; end: StreamPosition; tail: StreamPosition };\n return { start: ack.start.seq_num, end: ack.end.seq_num, tail: ack.tail.seq_num };\n }\n async read(opts: { since: number; limit: number }): Promise {\n const u = new URL(`${this.base}/records`);\n u.searchParams.set(\"seq_num\", String(opts.since));\n u.searchParams.set(\"count\", String(opts.limit));\n const res = await fetch(u, { headers: this.headers() });\n if (res.status === 416) {\n const body = (await res.json().catch(() => ({}))) as { tail?: StreamPosition };\n return { records: [], nextSeq: opts.since, tail: body.tail?.seq_num ?? opts.since };\n }\n if (!res.ok) throw new Error(`s2 read ${res.status}: ${await res.text()}`);\n const batch = (await res.json()) as { records: { seq_num: number; body: string }[]; tail?: StreamPosition };\n const records = batch.records.map((r) => ({ seqNum: r.seq_num, body: r.body }));\n const last = records[records.length - 1];\n const nextSeq = last ? last.seqNum + 1 : opts.since;\n return { records, nextSeq, tail: batch.tail?.seq_num ?? nextSeq };\n }\n async tail(): Promise {\n const res = await fetch(`${this.base}/records/tail`, { headers: this.headers() });\n if (!res.ok) throw new Error(`s2 tail ${res.status}: ${await res.text()}`);\n return ((await res.json()) as { tail: StreamPosition }).tail.seq_num;\n }\n}\n",[],[139,257,259],"7f2304b1-e0d6-4605-94b6-6230931064df","runtime-env.ts","db540b68-6766-11f1-9a66-1607ee4eb77e",["D",1781382688901],"// The one place that knows whether we're on Deno (val.town) or Node (local).\n//\n// On val.town each val is its own deployment with its own env vars (Deno.env).\n// Locally we run *all* the vals in one Node process, so they can't share\n// process.env for per-val config. Every val is therefore built by a factory\n// that takes an `Env`; on val.town the factory is fed the ambient Deno.env, and\n// locally the runtime feeds each val its own injected record.\n\nexport interface Env {\n get(key: string): string | undefined;\n}\n\n/** The platform's own environment — Deno.env on val.town, process.env on Node. */\nexport function ambientEnv(): Env {\n const deno = (globalThis as { Deno?: { env?: { get(k: string): string | undefined } } }).Deno;\n if (deno?.env && typeof deno.env.get === \"function\") {\n return { get: (k) => deno.env!.get(k) };\n }\n return { get: (k) => (typeof process !== \"undefined\" ? process.env[k] : undefined) };\n}\n\n/** A fixed lookup, for injecting one val's config in the local runtime. */\nexport function makeEnv(record: Record): Env {\n return { get: (k) => record[k] };\n}\n\nexport const isDeno = typeof (globalThis as { Deno?: unknown }).Deno !== \"undefined\";\n",[],[139,257,267],"51305476-90c3-417a-8a1f-194924413636","poke.ts","e492f91e-6766-11f1-babd-1607ee4eb77e",4,["D",1781382704417],"import { Buffer } from \"node:buffer\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\n// The poke is content-free and best-effort, so the signature is NOT a\n// correctness mechanism — it just lets a consumer ignore a forged poke. A\n// bad or missing sig at worst drops one poke (the heartbeat covers it); it can\n// never lose or corrupt data, because the poke carries no data. This is\n// deliberately simple and flagged on-screen as an open question.\n\nexport function signPoke(body: string, secret: string): string {\n return createHmac(\"sha256\", secret).update(body).digest(\"hex\");\n}\n\nexport function verifyPoke(body: string, sig: string | null | undefined, secret: string): boolean {\n if (!sig) return false;\n const expected = signPoke(body, secret);\n if (sig.length !== expected.length) return false;\n try {\n return timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n } catch {\n return false;\n }\n}\n\nexport interface PokeBody {\n stream: string;\n hint: number; // the ledger tail the vendor saw — monotone, coalesced by max()\n}\n",[],[139,257,274],"abacbf28-a9f0-46d0-bdc0-8771176b0be6","metrics.ts","ee298fec-6766-11f1-81ab-1607ee4eb77e",["D",1781382720506],"import type { Store } from \"./store.ts\";\n\n// The only place that knows both ends of the latency: it records, per event,\n// (handled time − the event's append time) into a bounded ring, and keeps the\n// counters the dashboard reads. eventsLost is structurally 0 — a cursor only\n// advances past events that handle() actually saw — so it is reported as the\n// constant it is. That zero, through every failure beat, is the payload.\n\nconst RING = 200;\n\nexport interface Snapshot {\n processed: number;\n pokesReceived: number;\n pokesDropped: number; // pokes that caused no forward progress (forged, stale, coalesced)\n eventsLost: number; // always 0\n p50: number | null;\n p95: number | null;\n samples: number;\n}\n\nexport class Metrics {\n constructor(private store: Store) {}\n\n async recordLatency(ms: number): Promise {\n const ring = (await this.store.getJSON(\"lat\")) ?? [];\n ring.push(Math.max(0, Math.round(ms)));\n while (ring.length > RING) ring.shift();\n await this.store.setJSON(\"lat\", ring);\n }\n\n async bump(counter: \"processed\" | \"pokesReceived\" | \"pokesDropped\", by = 1): Promise {\n const v = (await this.store.getJSON(counter)) ?? 0;\n await this.store.setJSON(counter, v + by);\n }\n\n /** Beat 6 rewind: clear the derived metrics so a re-drain reproduces them. */\n async resetCounters(): Promise {\n await this.store.setJSON(\"processed\", 0);\n await this.store.setJSON(\"lat\", []);\n }\n\n async snapshot(): Promise {\n const ring = (await this.store.getJSON(\"lat\")) ?? [];\n return {\n processed: (await this.store.getJSON(\"processed\")) ?? 0,\n pokesReceived: (await this.store.getJSON(\"pokesReceived\")) ?? 0,\n pokesDropped: (await this.store.getJSON(\"pokesDropped\")) ?? 0,\n eventsLost: 0,\n p50: percentile(ring, 50),\n p95: percentile(ring, 95),\n samples: ring.length,\n };\n }\n}\n\nfunction percentile(arr: number[], p: number): number | null {\n if (arr.length === 0) return null;\n const sorted = [...arr].sort((a, b) => a - b);\n const idx = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));\n return sorted[idx]!;\n}\n",[],[139,257,282],"997ac5a3-ed9f-4ba2-afef-d84b05750ca8","http.ts","e1b5c230-6766-11f1-9a66-1607ee4eb77e",3,["D",1781382699625],"// A tiny router over the Web fetch handler shape, so a val's code is the same\n// on val.town (where the default export IS a `(Request) => Response`) and in the\n// local runtime (which mounts these handlers behind a Node http server). No\n// framework — the routes a val needs fit on one screen.\n\nexport type Handler = (\n req: Request,\n ctx: { url: URL; params: Record },\n) => Response | Promise;\n\ninterface Route {\n method: string;\n parts: string[];\n handler: Handler;\n}\n\nexport class Router {\n private routes: Route[] = [];\n\n on(method: string, path: string, handler: Handler): this {\n this.routes.push({ method, parts: split(path), handler });\n return this;\n }\n get(path: string, handler: Handler): this {\n return this.on(\"GET\", path, handler);\n }\n post(path: string, handler: Handler): this {\n return this.on(\"POST\", path, handler);\n }\n\n async handle(req: Request): Promise {\n const url = new URL(req.url);\n const got = split(url.pathname);\n for (const route of this.routes) {\n if (route.method !== req.method) continue;\n const params = match(route.parts, got);\n if (params) return route.handler(req, { url, params });\n }\n // CORS preflight for the dashboard's cross-val fetches.\n if (req.method === \"OPTIONS\") return cors(new Response(null, { status: 204 }));\n return cors(json({ error: \"not found\", path: url.pathname }, 404));\n }\n\n /** Convenience: a `(Request) => Response` for val.town's default export. */\n get fetch(): (req: Request) => Promise {\n return (req) => this.handle(req);\n }\n}\n\nfunction split(path: string): string[] {\n return path.split(\"/\").filter(Boolean);\n}\n\nfunction match(pattern: string[], got: string[]): Record | null {\n if (pattern.length !== got.length) return null;\n const params: Record = {};\n for (let i = 0; i < pattern.length; i++) {\n const p = pattern[i]!;\n if (p.startsWith(\":\")) params[p.slice(1)] = decodeURIComponent(got[i]!);\n else if (p !== got[i]) return null;\n }\n return params;\n}\n\n// Every demo surface is read cross-origin by the dashboard and (in valtown mode)\n// across vals, so every response carries permissive CORS.\nexport function cors(res: Response): Response {\n res.headers.set(\"access-control-allow-origin\", \"*\");\n res.headers.set(\"access-control-allow-headers\", \"*\");\n res.headers.set(\"access-control-allow-methods\", \"GET,POST,DELETE,OPTIONS\");\n return res;\n}\n\nexport function json(data: unknown, status = 200): Response {\n return cors(\n new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n }),\n );\n}\n\nexport function html(body: string, status = 200): Response {\n return cors(new Response(body, { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } }));\n}\n\nexport function text(body: string, status = 200): Response {\n return cors(new Response(body, { status, headers: { \"content-type\": \"text/plain; charset=utf-8\" } }));\n}\n\nexport async function readJson(req: Request): Promise {\n try {\n const text = await req.text();\n return text ? (JSON.parse(text) as T) : null;\n } catch {\n return null;\n }\n}\n",[],[139,257,289],"8ca04789-2b35-4ed9-b41c-eb2b800d3b48","events.ts","e9467d1e-6766-11f1-8990-1607ee4eb77e",5,["D",1781382712302],"import { CATALOG, CUSTOMERS } from \"../../config/beats.ts\";\n\n// The order events that flow through the ledger. Small and legible — on camera\n// the subject is the cursor / lag / latency, not the order contents. Every\n// event carries `ts`, the moment it was appended, so a consumer can measure\n// end-to-end latency (append → handled) — which is what visibly rises during\n// the cut-poke beat and falls back after the heartbeat drains the backlog.\n\nexport interface OrderEvent {\n type: \"order.created\";\n id: string; // stable order id, derived from n\n n: number; // 1-based demo sequence (deterministic content key)\n sku: string;\n product: string;\n qty: number;\n amount: number; // qty * unit price\n customer: string;\n ts: number; // append timestamp (ms since epoch), stamped by emit\n}\n\n// A tiny seeded PRNG (mulberry32) so the same n always yields the same order.\nfunction rngFor(n: number): () => number {\n let a = (0x9e3779b9 ^ (n * 0x85ebca6b)) >>> 0;\n return () => {\n a |= 0;\n a = (a + 0x6d2b79f5) | 0;\n let t = Math.imul(a ^ (a >>> 15), 1 | a);\n t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;\n return ((t ^ (t >>> 14)) >>> 0) / 4294967296;\n };\n}\n\n/** Deterministic order content for demo entry `n` (1-based). `ts` is stamped later. */\nexport function makeOrder(n: number): OrderEvent {\n const r = rngFor(n);\n const item = CATALOG[Math.floor(r() * CATALOG.length)]!;\n const customer = CUSTOMERS[Math.floor(r() * CUSTOMERS.length)]!;\n const qty = 1 + Math.floor(r() * 3);\n return {\n type: \"order.created\",\n id: `ord-${String(n).padStart(4, \"0\")}`,\n n,\n sku: item.sku,\n product: item.name,\n qty,\n amount: qty * item.price,\n customer,\n ts: 0,\n };\n}\n",[],[139,257,297],"134de356-7058-4d4c-b07e-0227cccdc8c8","cursor.ts","0bbba996-6767-11f1-8e04-1607ee4eb77e",9,["D",1781382770123],"import type { Store } from \"./store.ts\";\n\n// The consumer-owned checkpoint: one number, \"the next seq I want.\" This is the\n// whole of the customer's bookkeeping — remember your place.\n//\n// Sequence numbers are absolute S2 seqs. A consumer onboards at a BASELINE — the\n// stream head at the moment it joined — because an append-only log it doesn't own\n// may already hold history from before its time (and you can't truncate someone\n// else's log). A fresh or rewound cursor therefore starts at the baseline, not at\n// absolute 0; the dashboard shows positions relative to it. Locally the baseline\n// is 0 (the stack recreates its own stream fresh), so all of this is a no-op and\n// the cursor is just \"0, then up.\" lag = head − cursor is computed by the\n// dashboard from the absolute cursor and the absolute tail, so it is unaffected.\n\nexport class Cursor {\n constructor(\n private store: Store,\n private globalStore: Store,\n ) {}\n\n /** The deployment-wide origin; absent (local) means 0. Read live so a cloud\n * re-baseline on reset takes effect without redeploying. */\n baseline(): Promise {\n return this.globalStore.getJSON(\"baseline\").then((v) => v ?? 0);\n }\n async get(): Promise {\n const v = await this.store.getJSON(\"cursor\");\n return v ?? (await this.baseline());\n }\n set(seq: number): Promise {\n return this.store.setJSON(\"cursor\", seq);\n }\n /** Beat 6: rewind to the baseline so the consumer re-derives its state from the log. */\n async rewind(): Promise {\n await this.store.setJSON(\"cursor\", await this.baseline());\n }\n}\n",[],[139,257,305],"59844699-8182-440f-abb9-4f7b6d3c40f7","consumer-runtime.ts","3fd1a8de-6767-11f1-b7ab-1607ee4eb77e",11,["D",1781382857490],"import { BEATS } from \"../../config/beats.ts\";\nimport { Cursor } from \"./cursor.ts\";\nimport type { OrderEvent } from \"./events.ts\";\nimport { Router, json, text } from \"./http.ts\";\nimport { Metrics } from \"./metrics.ts\";\nimport { type PokeBody, verifyPoke } from \"./poke.ts\";\nimport { type Env, ambientEnv } from \"./runtime-env.ts\";\nimport { getStore } from \"./store.ts\";\n\n// THE TEMPLATE ENGINE. Everything a consumer needs is here; the customer writes\n// exactly one function — a pure reducer `handle(events, state) => state`. That\n// purity is what makes the replay beat true: rewind the cursor, clear the\n// derived state, re-drain, and you land on byte-identical state.\n//\n// tick() drain pull -> handle -> commit cursor, until the log is empty\n// POST /poke verify HMAC, coalesce the hint by max(), single-flight a tick\n// interval the heartbeat floor (cron) — the safety net when pokes are lost\n// POST /tick manual \"poll now\"\n// POST /rewind beat 6: zero the cursor + state, re-derive\n// GET /stats the dashboard's data source\n// GET /state the derived state, for the beat-6 blue/green diff\n\nexport interface ConsumerOptions {\n name: string;\n initialState: S;\n handle: (events: OrderEvent[], state: S) => S | Promise;\n /** Local runtime injects per-val config here; on val.town it's the ambient Deno.env. */\n env?: Env;\n}\n\nexport interface Consumer {\n name: string;\n fetch: (req: Request) => Promise;\n interval: () => Promise;\n}\n\nexport function makeConsumer(opts: ConsumerOptions): Consumer {\n const env = opts.env ?? ambientEnv();\n const name = opts.name;\n const changesUrlRaw = env.get(\"CHANGES_URL\");\n if (!changesUrlRaw) throw new Error(`consumer ${name}: CHANGES_URL is required`);\n const changesUrl: string = changesUrlRaw;\n const secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\n const sleepMs = Number(env.get(\"SLEEP_MS\") ?? BEATS.analyticsSleepMs) || BEATS.analyticsSleepMs;\n\n const store = getStore(`consumer:${name}`);\n // Deployment-wide origin (baseline), shared across vals; 0 locally. See Cursor.\n const cursor = new Cursor(store, getStore(\"webpoke:global\"));\n const metrics = new Metrics(store);\n\n // `opts.initialState` is the canonical prototype — never hand it to `handle`\n // or persist it directly. Reducers are free to mutate the state they receive\n // (the simple, natural style), so every working copy must be private. This is\n // what makes rewind/replay byte-identical: a fresh zero every time, never a\n // prototype some earlier drain already mutated.\n const freshInitial = (): S => structuredClone(opts.initialState);\n\n // Single-flight: at most one drain in flight. Five simultaneous pokes cause at\n // most one extra tick — the rest see `running` and coalesce (the beat-4 defense).\n let running = false;\n let coalescedHint = -1;\n\n async function pull(since: number): Promise<{ events: OrderEvent[]; next: number }> {\n const u = `${changesUrl}${changesUrl.includes(\"?\") ? \"&\" : \"?\"}since=${since}&limit=${BEATS.changesLimit}`;\n const res = await fetch(u);\n if (!res.ok) throw new Error(`pull ${res.status}`);\n const data = (await res.json()) as { events?: OrderEvent[]; next_cursor?: number };\n return { events: data.events ?? [], next: data.next_cursor ?? since };\n }\n\n async function drain(): Promise {\n let did = 0;\n for (;;) {\n const since = await cursor.get();\n const { events, next } = await pull(since);\n if (events.length === 0) break;\n if (await sleeping()) await sleep(sleepMs);\n let state = (await store.getJSON(\"state\")) ?? freshInitial();\n state = await opts.handle(events, state);\n const done = Date.now();\n await store.setJSON(\"state\", state);\n await cursor.set(next); // consumer-owned checkpoint — commit AFTER handle\n await metrics.bump(\"processed\", events.length);\n for (const e of events) await metrics.recordLatency(done - (e.ts ?? done));\n did += events.length;\n }\n return did;\n }\n\n async function singleFlight(): Promise {\n if (running) return 0; // coalesced into the in-flight drain\n running = true;\n try {\n return await drain();\n } finally {\n running = false;\n }\n }\n\n async function sleeping(): Promise {\n return (await store.getJSON(\"sleeping\")) ?? false;\n }\n\n // A consumer can be deployed dormant — poked, but not yet listening — so beat 5\n // can spin it up and watch it bootstrap the whole history from cursor zero.\n async function active(): Promise {\n const v = await store.getJSON(\"active\");\n return v === undefined ? (env.get(\"START_ACTIVE\") ?? \"1\") !== \"0\" : v;\n }\n\n const r = new Router();\n\n // The poke receiver. The poke is content-free: its only job is to wake a tick.\n r.post(\"/poke\", async (req) => {\n const raw = await req.text();\n const sig = req.headers.get(\"x-poke-sig\");\n if (!(await active())) return json({ ok: true, skipped: \"dormant\" }); // not subscribed yet\n await metrics.bump(\"pokesReceived\");\n if (!verifyPoke(raw, sig, secret)) {\n await metrics.bump(\"pokesDropped\"); // forged/unsigned — safely ignored\n return json({ ok: false, reason: \"bad signature\" });\n }\n try {\n const body = JSON.parse(raw) as PokeBody;\n coalescedHint = Math.max(coalescedHint, body.hint ?? -1);\n } catch {\n /* the hint is advisory; a malformed body still can't lose data */\n }\n const before = await cursor.get();\n const did = await singleFlight();\n const after = await cursor.get();\n if (after === before) await metrics.bump(\"pokesDropped\"); // stale/duplicate/coalesced — no progress\n return json({ ok: true, processed: did });\n });\n\n // Manual \"poll now\".\n r.post(\"/tick\", async () => json({ ok: true, processed: await singleFlight() }));\n\n // The heartbeat, also exposed as a button for recording (the real cron floor\n // is disclosed on camera).\n r.post(\"/heartbeat\", async () => {\n if (!(await active())) return json({ ok: true, skipped: \"dormant\" });\n return json({ ok: true, processed: await singleFlight() });\n });\n\n // Beat 5: spin up a dormant consumer — it bootstraps the full history from zero.\n r.post(\"/control/activate\", async () => {\n await store.setJSON(\"active\", true);\n return json({ ok: true, processed: await singleFlight() });\n });\n\n // Beat 6: rewind to zero and re-derive identical state.\n r.post(\"/rewind\", async () => {\n await cursor.rewind();\n await store.setJSON(\"state\", freshInitial());\n await metrics.resetCounters();\n const did = await singleFlight();\n return json({ ok: true, processed: did, state: await store.getJSON(\"state\") });\n });\n\n // Beat 5: analytics' sleep toggle (?on=1|0).\n r.post(\"/control/sleep\", async (_req, { url }) => {\n await store.setJSON(\"sleeping\", url.searchParams.get(\"on\") !== \"0\");\n return json({ ok: true, sleeping: await sleeping() });\n });\n\n // Full reset to defaults (reset.ts).\n r.post(\"/reset\", async () => {\n await store.clear();\n return json({ ok: true });\n });\n\n r.get(\"/stats\", async () => {\n const snap = await metrics.snapshot();\n return json({\n name,\n cursor: await cursor.get(),\n sleeping: await sleeping(),\n active: await active(),\n coalescedHint,\n ...snap,\n });\n });\n\n r.get(\"/state\", async () => {\n return json({ name, cursor: await cursor.get(), state: (await store.getJSON(\"state\")) ?? freshInitial() });\n });\n\n r.get(\"/\", async () => text(`webpoke consumer \"${name}\" — POST /poke /tick /rewind, GET /stats /state`));\n\n return {\n name,\n fetch: r.fetch,\n interval: async () => {\n if (await active()) await singleFlight();\n },\n };\n}\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n",[],[139,257,313],"75464b4d-fc86-46a6-a530-f0834c28c1bb",["D",1781382688901],[166,167,168,169,170,171,172,173,174],[139,257],["D",1781382688901],[165,175],[139],"d780905a-12aa-40f2-aa99-58ba234ea182","beats.ts","0098bf2c-6767-11f1-ba26-1607ee4eb77e",["D",1781382751420],"// Demo constants — every magic number the beats depend on lives here so a\n// recording is reproducible and a reviewer can see the scenario at a glance.\n// (Referenced by seed.ts, the dashboard controls, and the recorder's movie.)\n\nexport const BEATS = {\n /** Deterministic RNG seed — same data every run (RUBRIC: identical re-runs). */\n seed: 0xc0ffee,\n\n /** Beat 2 (happy path): orders appended one at a time to show sub-second pickup. */\n happyPathOrders: 1,\n\n /** Beat 3 (cut the poke): orders appended with the poke channel down. The lag\n * climbs to exactly this, then one heartbeat drains all of them at once. */\n cutPokeBurst: 10,\n\n /** Beat 4 (abuse the poke): how the dashboard's #poke-abuse button misbehaves —\n * the same hint fired N times, one out-of-order, one stale (below the cursor). */\n abuse: { repeats: 5, includeOutOfOrder: true, includeStale: true },\n\n /** Beat 5 (isolation): ms of artificial work analytics' handle() adds when its\n * #analytics-sleep toggle is on, so it visibly lags while inventory stays flat. */\n analyticsSleepMs: 1500,\n\n /** The real val.town cron floor we disclose on camera. The poke is the\n * sub-second path; the heartbeat is the safety net. During recording the\n * dashboard's #heartbeat-now button fires the heartbeat early (disclosed). */\n heartbeatCronFloorLabel: \"1 min\",\n\n /** Local-runtime heartbeat timer (ms). 0 disables the auto heartbeat so the\n * cut-poke beat stays flat until the button fires it — set >0 for an\n * unattended local stack that self-heals like the deployed cron would. */\n // Guarded: on val.town (Deno) `process` may be absent at module load, and this\n // value is local-only anyway (the deployed cron is the heartbeat there).\n localHeartbeatMs: Number((typeof process !== \"undefined\" && process.env.WEBPOKE_HEARTBEAT_MS) || \"0\") || 0,\n\n /** The /changes retention floor the shim advertises in its meta (the script's\n * stated open question: S2 retention = the replay window). */\n retentionFloorSeq: 0,\n\n /** Max events one /changes call will return (bounded read). */\n changesLimit: 256,\n} as const;\n\n// The order catalog the deterministic generator draws from. Small and legible —\n// the point on camera is the cursor/lag/latency, not the order contents.\nexport const CATALOG = [\n { sku: \"DESK-01\", name: \"Writing desk\", price: 420 },\n { sku: \"CHAIR-02\", name: \"Task chair\", price: 180 },\n { sku: \"LAMP-03\", name: \"Desk lamp\", price: 65 },\n { sku: \"SHELF-04\", name: \"Bookshelf\", price: 240 },\n { sku: \"RUG-05\", name: \"Wool rug\", price: 310 },\n] as const;\n\nexport const CUSTOMERS = [\"Ada\", \"Grace\", \"Katherine\", \"Hedy\", \"Radia\"] as const;\n\n// The consumers the stack runs — one source of truth for the local runtime\n// (name → factory + dormant flag + mount), the endpoint resolver (addresses\n// each by URL), and reset.ts (zeroes every one). On val.town each is its own\n// val at its own origin; locally they share one port under these prefixes.\nexport interface ConsumerSpec {\n name: string;\n /** Local mount prefix under the single port. */\n localPath: string;\n /** A card on the filmed dashboard (inventory-v2 is poked but stays off-camera). */\n onDashboard: boolean;\n /** Deployed dormant — beat 5 spins it up to bootstrap from cursor 0. */\n dormant: boolean;\n}\n\nexport const CONSUMERS: ConsumerSpec[] = [\n { name: \"inventory\", localPath: \"/c/inventory\", onDashboard: true, dormant: false },\n { name: \"analytics\", localPath: \"/c/analytics\", onDashboard: true, dormant: true },\n { name: \"inventory-v2\", localPath: \"/c/inventory-v2\", onDashboard: false, dormant: false },\n];\n",[],[146,328],["D",1781382751420],[163],[146],["D",1781382627825],{"_95":94,"_102":98},{"_95":94,"_96":-5,"_97":98,"_18":54,"_99":100,"_101":24},{"_13":84,"_31":85,"_42":41,"_86":43,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":44,"_93":94},"ctx",{"_77":-5,"_122":374,"_375":376,"_377":378,"_379":24,"_380":24,"_381":24,"_382":57,"_383":-5,"_384":-7,"_385":-7,"_386":61,"_387":24,"_388":24,"_389":-5,"_390":24,"_391":24,"_392":24,"_393":-5},"ENV",{"_345":346,"_347":348,"_349":85,"_350":351,"_352":353,"_354":355,"_356":357,"_358":359,"_360":361,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371,"_372":373},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v18