[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_353":354,"_355":356},"routes/_app.x.$handle.$name",{"_98":97,"_32":46,"_106":88,"_27":107,"_13":14,"_108":-5,"_11":109,"_110":111,"_112":113,"_114":115,"_116":117,"_20":-5,"_118":-5,"_119":-5,"_120":25,"_121":122,"_123":60,"_124":-5,"_125":-5,"_126":127},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_44":45,"_32":46,"_39":47,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",23,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":33,"_34":35,"_36":38,"_39":40,"_41":14,"_42":43,"_24":25},"previous",{"_30":31,"_32":33,"_34":35,"_36":37},"deleted",false,"deletedHere","path","config/beats.ts","latestPath","fileId","0098bf2c-6767-11f1-ba26-1607ee4eb77e","name","beats.ts","fileType","script","content","// Demo constants — every magic number the beats depend on lives here so a\n// recording is reproducible and a reviewer can see the scenario at a glance.\n// (Referenced by seed.ts, the dashboard controls, and the recorder's movie.)\n\nexport const BEATS = {\n /** Deterministic RNG seed — same data every run (RUBRIC: identical re-runs). */\n seed: 0xc0ffee,\n\n /** Beat 2 (happy path): orders appended one at a time to show sub-second pickup. */\n happyPathOrders: 1,\n\n /** Beat 3 (cut the poke): orders appended with the poke channel down. The lag\n * climbs to exactly this, then one heartbeat drains all of them at once. */\n cutPokeBurst: 10,\n\n /** Beat 4 (abuse the poke): how the dashboard's #poke-abuse button misbehaves —\n * the same hint fired N times, one out-of-order, one stale (below the cursor). */\n abuse: { repeats: 5, includeOutOfOrder: true, includeStale: true },\n\n /** Beat 5 (isolation): ms of artificial work analytics' handle() adds when its\n * #analytics-sleep toggle is on, so it visibly lags while inventory stays flat. */\n analyticsSleepMs: 1500,\n\n /** The real val.town cron floor we disclose on camera. The poke is the\n * sub-second path; the heartbeat is the safety net. During recording the\n * dashboard's #heartbeat-now button fires the heartbeat early (disclosed). */\n heartbeatCronFloorLabel: \"1 min\",\n\n /** Local-runtime heartbeat timer (ms). 0 disables the auto heartbeat so the\n * cut-poke beat stays flat until the button fires it — set >0 for an\n * unattended local stack that self-heals like the deployed cron would. */\n // Guarded: on val.town (Deno) `process` may be absent at module load, and this\n // value is local-only anyway (the deployed cron is the heartbeat there).\n localHeartbeatMs: Number((typeof process !== \"undefined\" && process.env.WEBPOKE_HEARTBEAT_MS) || \"0\") || 0,\n\n /** The /changes retention floor the shim advertises in its meta (the script's\n * stated open question: S2 retention = the replay window). */\n retentionFloorSeq: 0,\n\n /** Max events one /changes call will return (bounded read). */\n changesLimit: 256,\n} as const;\n\n// The order catalog the deterministic generator draws from. Small and legible —\n// the point on camera is the cursor/lag/latency, not the order contents.\nexport const CATALOG = [\n { sku: \"DESK-01\", name: \"Writing desk\", price: 420 },\n { sku: \"CHAIR-02\", name: \"Task chair\", price: 180 },\n { sku: \"LAMP-03\", name: \"Desk lamp\", price: 65 },\n { sku: \"SHELF-04\", name: \"Bookshelf\", price: 240 },\n { sku: \"RUG-05\", name: \"Wool rug\", price: 310 },\n] as const;\n\nexport const CUSTOMERS = [\"Ada\", \"Grace\", \"Katherine\", \"Hedy\", \"Radia\"] as const;\n\n// The consumers the stack runs — one source of truth for the local runtime\n// (name → factory + dormant flag + mount), the endpoint resolver (addresses\n// each by URL), and reset.ts (zeroes every one). On val.town each is its own\n// val at its own origin; locally they share one port under these prefixes.\nexport interface ConsumerSpec {\n name: string;\n /** Local mount prefix under the single port. */\n localPath: string;\n /** A card on the filmed dashboard (inventory-v2 is poked but stays off-camera). */\n onDashboard: boolean;\n /** Deployed dormant — beat 5 spins it up to bootstrap from cursor 0. */\n dormant: boolean;\n}\n\nexport const CONSUMERS: ConsumerSpec[] = [\n { name: \"inventory\", localPath: \"/c/inventory\", onDashboard: true, dormant: false },\n { name: \"analytics\", localPath: \"/c/analytics\", onDashboard: true, dormant: true },\n { name: \"inventory-v2\", localPath: \"/c/inventory-v2\", onDashboard: false, dormant: false },\n];\n","// Demo constants — every magic number the beats depend on lives here so a\n// recording is reproducible and a reviewer can see the scenario at a glance.\n// (Referenced by seed.ts, the dashboard controls, and the recorder's movie.)\n\nexport const BEATS = {\n /** Deterministic RNG seed — same data every run (RUBRIC: identical re-runs). */\n seed: 0xc0ffee,\n\n /** Beat 2 (happy path): orders appended one at a time to show sub-second pickup. */\n happyPathOrders: 1,\n\n /** Beat 3 (cut the poke): orders appended with the poke channel down. The lag\n * climbs to exactly this, then one heartbeat drains all of them at once. */\n cutPokeBurst: 10,\n\n /** Beat 4 (abuse the poke): how the dashboard's #poke-abuse button misbehaves —\n * the same hint fired N times, one out-of-order, one stale (below the cursor). */\n abuse: { repeats: 5, includeOutOfOrder: true, includeStale: true },\n\n /** Beat 5 (isolation): ms of artificial work analytics' handle() adds when its\n * #analytics-sleep toggle is on, so it visibly lags while inventory stays flat. */\n analyticsSleepMs: 8000,\n\n /** The real val.town cron floor we disclose on camera. The poke is the\n * sub-second path; the heartbeat is the safety net. During recording the\n * dashboard's #heartbeat-now button fires the heartbeat early (disclosed). */\n heartbeatCronFloorLabel: \"1 min\",\n\n /** Local-runtime heartbeat timer (ms). 0 disables the auto heartbeat so the\n * cut-poke beat stays flat until the button fires it — set >0 for an\n * unattended local stack that self-heals like the deployed cron would. */\n // Guarded: on val.town (Deno) `process` may be absent at module load, and this\n // value is local-only anyway (the deployed cron is the heartbeat there).\n localHeartbeatMs: Number((typeof process !== \"undefined\" && process.env.WEBPOKE_HEARTBEAT_MS) || \"0\") || 0,\n\n /** The /changes retention floor the shim advertises in its meta (the script's\n * stated open question: S2 retention = the replay window). */\n retentionFloorSeq: 0,\n\n /** Max events one /changes call will return (bounded read). */\n changesLimit: 256,\n} as const;\n\n// The order catalog the deterministic generator draws from. Small and legible —\n// the point on camera is the cursor/lag/latency, not the order contents.\nexport const CATALOG = [\n { sku: \"DESK-01\", name: \"Writing desk\", price: 420 },\n { sku: \"CHAIR-02\", name: \"Task chair\", price: 180 },\n { sku: \"LAMP-03\", name: \"Desk lamp\", price: 65 },\n { sku: \"SHELF-04\", name: \"Bookshelf\", price: 240 },\n { sku: \"RUG-05\", name: \"Wool rug\", price: 310 },\n] as const;\n\nexport const CUSTOMERS = [\"Ada\", \"Grace\", \"Katherine\", \"Hedy\", \"Radia\"] as const;\n\n// The consumers the stack runs — one source of truth for the local runtime\n// (name → factory + dormant flag + mount), the endpoint resolver (addresses\n// each by URL), and reset.ts (zeroes every one). On val.town each is its own\n// val at its own origin; locally they share one port under these prefixes.\nexport interface ConsumerSpec {\n name: string;\n /** Local mount prefix under the single port. */\n localPath: string;\n /** A card on the filmed dashboard (inventory-v2 is poked but stays off-camera). */\n onDashboard: boolean;\n /** Deployed dormant — beat 5 spins it up to bootstrap from cursor 0. */\n dormant: boolean;\n}\n\nexport const CONSUMERS: ConsumerSpec[] = [\n { name: \"inventory\", localPath: \"/c/inventory\", onDashboard: true, dormant: false },\n { name: \"analytics\", localPath: \"/c/analytics\", onDashboard: true, dormant: true },\n { name: \"inventory-v2\", localPath: \"/c/inventory-v2\", onDashboard: false, dormant: false },\n];\n","createdAt",["D",1781408741910],"branchVersion","branchId","6d4da68d-1a5a-47ce-9df4-9316f76b557a","id","d267b633-5b62-4847-8e55-80c10d65fda2","webpoke_demo",["D",1781382627825],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Webpoke: webhooks rebuilt on an append-only S2 log (full stack)","imageUrl","1d223401-2709-4d51-8314-0ca7611e9d9a","pinnedFileId","77516510-6767-11f1-996b-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","efaf76f0-0509-4f61-99e7-4d9e2d1a202a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_105":101},"org",{"_98":97,"_99":-5,"_100":101,"_18":56,"_102":103,"_104":25},"branch",{"_13":87,"_32":88,"_44":43,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":46,"_96":97},"isOwned",24,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","devdoshi","handle","displayName","avatar","https://secure.gravatar.com/avatar/08f709e5b52546fbf4413cdceb625fc7&d=identicon","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_44":45,"_32":46,"_39":349,"_48":-5,"_49":25,"_50":51,"_52":51,"_53":54,"_55":-5,"_18":56,"_57":58,"_59":60,"_61":-5,"_62":-5,"_63":64,"_65":66,"_67":-5,"_68":-5,"_69":-5,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":350,"_82":351,"_84":352,"_86":25},"tree",[165,167,187],"files",[165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187],"counts",{"_154":64,"_155":135,"_156":64,"_157":158,"_159":160},"contents",[128,129,130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_44":148,"_32":149,"_30":150,"_134":-5,"_42":43,"_41":151,"_136":60,"_39":152,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_27":153},{"_44":141,"_32":142,"_30":143,"_134":-5,"_42":43,"_41":144,"_136":60,"_39":145,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_27":147},{"_44":131,"_32":132,"_30":133,"_134":-5,"_42":43,"_41":135,"_136":60,"_39":137,"_13":64,"_34":20,"_36":138,"_24":25,"_139":-5,"_27":140},"50837783-7432-4995-8259-73fc4a5eb98e","README.md","b6ef1a1a-6766-11f1-b7ab-1607ee4eb77e","parentId",1,"latest",["D",1781382627845],"# webpoke_demo\nFull stack deployed as one val. HTTP entry: src/vals/main.ts. Cron: src/vals/heartbeat.ts.\n","label",[132],"e7198b4a-a53e-4c00-90f8-4786a20f105e","src","e2c8c30f-0c01-4bcd-b3f0-e7ba9512e569",2,["D",1781382688901],"directory",[142],"d63efafb-acfe-4132-b22b-10b7f787c70a","config","8b26c48a-9394-4e00-bdd4-a930ff92af2d",7,["D",1781382751420],[149],"pulls","branches","forks","envVars",{"_161":163,"_164":64},"connections",{"_161":64,"_162":64},"count","unfilledCount",6,"emptyCount",{"_44":148,"_32":149,"_30":150,"_134":-5,"_42":43,"_41":151,"_136":60,"_39":346,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_189":347,"_27":348},{"_44":342,"_32":33,"_30":31,"_134":150,"_42":43,"_41":14,"_136":60,"_39":343,"_13":135,"_34":35,"_36":38,"_24":25,"_139":-5,"_189":344,"_27":345},{"_44":141,"_32":142,"_30":143,"_134":-5,"_42":43,"_41":144,"_136":60,"_39":339,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_189":340,"_27":341},{"_44":335,"_32":273,"_30":267,"_134":143,"_42":43,"_41":144,"_136":60,"_39":336,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_189":337,"_27":338},{"_44":327,"_32":328,"_30":329,"_134":267,"_42":43,"_41":330,"_136":60,"_39":331,"_13":64,"_34":35,"_36":332,"_24":25,"_139":-5,"_189":333,"_27":334},{"_44":319,"_32":320,"_30":321,"_134":267,"_42":43,"_41":322,"_136":60,"_39":323,"_13":64,"_34":35,"_36":324,"_24":25,"_139":-5,"_189":325,"_27":326},{"_44":311,"_32":312,"_30":313,"_134":267,"_42":43,"_41":314,"_136":60,"_39":315,"_13":64,"_34":35,"_36":316,"_24":25,"_139":-5,"_189":317,"_27":318},{"_44":304,"_32":305,"_30":306,"_134":267,"_42":43,"_41":224,"_136":60,"_39":307,"_13":64,"_34":35,"_36":308,"_24":25,"_139":-5,"_189":309,"_27":310},{"_44":297,"_32":298,"_30":299,"_134":267,"_42":43,"_41":163,"_136":60,"_39":300,"_13":64,"_34":35,"_36":301,"_24":25,"_139":-5,"_189":302,"_27":303},{"_44":289,"_32":290,"_30":291,"_134":267,"_42":43,"_41":292,"_136":60,"_39":293,"_13":64,"_34":35,"_36":294,"_24":25,"_139":-5,"_189":295,"_27":296},{"_44":282,"_32":283,"_30":284,"_134":267,"_42":43,"_41":144,"_136":60,"_39":285,"_13":64,"_34":35,"_36":286,"_24":25,"_139":-5,"_189":287,"_27":288},{"_44":274,"_32":275,"_30":276,"_134":267,"_42":43,"_41":277,"_136":60,"_39":278,"_13":64,"_34":35,"_36":279,"_24":25,"_139":-5,"_189":280,"_27":281},{"_44":264,"_32":265,"_30":266,"_134":267,"_42":43,"_41":268,"_136":60,"_39":269,"_13":64,"_34":35,"_36":270,"_24":25,"_139":-5,"_189":271,"_27":272},{"_44":260,"_32":201,"_30":194,"_134":143,"_42":43,"_41":231,"_136":60,"_39":261,"_13":64,"_34":146,"_36":-5,"_24":25,"_139":-5,"_189":262,"_27":263},{"_44":252,"_32":253,"_30":254,"_134":194,"_42":43,"_41":255,"_136":60,"_39":256,"_13":64,"_34":35,"_36":257,"_24":25,"_139":-5,"_189":258,"_27":259},{"_44":244,"_32":245,"_30":246,"_134":194,"_42":43,"_41":247,"_136":60,"_39":248,"_13":64,"_34":35,"_36":249,"_24":25,"_139":-5,"_189":250,"_27":251},{"_44":236,"_32":237,"_30":238,"_134":194,"_42":43,"_41":239,"_136":60,"_39":240,"_13":64,"_34":35,"_36":241,"_24":25,"_139":-5,"_189":242,"_27":243},{"_44":228,"_32":229,"_30":230,"_134":194,"_42":43,"_41":231,"_136":60,"_39":232,"_13":64,"_34":35,"_36":233,"_24":25,"_139":-5,"_189":234,"_27":235},{"_44":219,"_32":220,"_30":221,"_134":194,"_42":43,"_41":222,"_136":60,"_39":223,"_13":224,"_34":35,"_36":225,"_24":25,"_139":-5,"_189":226,"_27":227},{"_44":211,"_32":212,"_30":213,"_134":194,"_42":43,"_41":214,"_136":60,"_39":215,"_13":64,"_34":35,"_36":216,"_24":25,"_139":-5,"_189":217,"_27":218},{"_44":202,"_32":203,"_30":204,"_134":194,"_42":43,"_41":205,"_136":60,"_39":206,"_13":64,"_34":207,"_36":208,"_24":25,"_139":-5,"_189":209,"_27":210},{"_44":192,"_32":193,"_30":58,"_134":194,"_42":43,"_41":195,"_136":25,"_39":196,"_13":64,"_34":197,"_36":198,"_24":25,"_139":-5,"_189":199,"_27":200},{"_44":131,"_32":132,"_30":133,"_134":-5,"_42":43,"_41":135,"_136":60,"_39":188,"_13":64,"_34":20,"_36":138,"_24":25,"_139":-5,"_189":190,"_27":191},["D",1781382627845],"children",[],[132],"9e3c401d-0ab1-4016-8564-457868528bbc","main.ts","ed0b27de-0558-428a-b448-4d305abc648c",18,["D",1781382950613],"http","import { BEATS, CONSUMERS, type ConsumerSpec } from \"../../config/beats.ts\";\nimport type { Consumer } from \"../lib/consumer-runtime.ts\";\nimport { ambientEnv, type Env, makeEnv } from \"../lib/runtime-env.ts\";\nimport { createAnalytics } from \"./consumer-analytics.ts\";\nimport { createChanges } from \"./changes.ts\";\nimport { createDashboard } from \"./dashboard.ts\";\nimport { createEmit } from \"./emit.ts\";\nimport { createInventory } from \"./consumer-inventory.ts\";\nimport { createInventoryV2 } from \"./consumer-inventory-v2.ts\";\n\n// val.town combined entry (Architecture A): the WHOLE webpoke stack as one val,\n// mirroring src/local/runtime.ts's wiring minus the s2-lite spawn. Here S2 is the\n// real cloud basin (from ambient Deno.env) and every mounted val shares one\n// std/sqlite store (so the baseline in \"webpoke:global\" is shared). The vals call\n// each other same-origin via VAL_ORIGIN (set after the first deploy, once the\n// val's URL is known). This default export is the val's HTTP handler; the cron\n// heartbeat lives in heartbeat.ts.\n\nconst env = ambientEnv();\nconst ORIGIN = (env.get(\"VAL_ORIGIN\") ?? \"\").replace(/\\/+$/, \"\");\nconst secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\nconst s2env: Record = {\n S2_ENDPOINT: env.get(\"S2_ENDPOINT\"),\n S2_TOKEN: env.get(\"S2_TOKEN\"),\n S2_BASIN: env.get(\"S2_BASIN\"),\n S2_STREAM: env.get(\"S2_STREAM\"),\n};\n\nconst FACTORIES: Record Consumer> = {\n inventory: createInventory,\n analytics: createAnalytics,\n \"inventory-v2\": createInventoryV2,\n};\n\nconst consumerUrl = (spec: ConsumerSpec): string => `${ORIGIN}${spec.localPath}`;\nconst changesUrl = `${ORIGIN}/changes`;\n\ninterface Mount {\n prefix: string;\n fetch: (req: Request) => Promise;\n}\nconst mounts: Mount[] = [];\n\nfor (const spec of CONSUMERS) {\n const factory = FACTORIES[spec.name];\n if (!factory) throw new Error(`main: no factory for consumer \"${spec.name}\"`);\n const consumer = factory(\n makeEnv({\n CHANGES_URL: changesUrl,\n POKE_SECRET: secret,\n START_ACTIVE: spec.dormant ? \"0\" : \"1\",\n SLEEP_MS: String(BEATS.analyticsSleepMs),\n }),\n );\n mounts.push({ prefix: spec.localPath, fetch: consumer.fetch });\n}\n\nconst emit = createEmit(\n makeEnv({ ...s2env, POKE_SECRET: secret, POKE_TARGETS: CONSUMERS.map(consumerUrl).join(\",\") }),\n);\nconst changes = createChanges(makeEnv(s2env));\nconst dashboard = createDashboard(\n makeEnv({\n ...s2env,\n EMIT_URL: `${ORIGIN}/emit`,\n CONSUMERS: JSON.stringify(\n CONSUMERS.filter((c) => c.onDashboard).map((c) => ({ name: c.name, url: consumerUrl(c) })),\n ),\n }),\n);\nmounts.push({ prefix: \"/emit\", fetch: emit.fetch });\nmounts.push({ prefix: \"/changes\", fetch: changes.fetch });\n\n// Longest-prefix-safe match: \"/c/inventory\" never swallows \"/c/inventory-v2\"\n// because the boundary is an exact segment (\"===\" or prefix + \"/\").\nfunction matchMount(pathname: string): { mount: Mount; rest: string } | null {\n for (const m of mounts) {\n if (pathname === m.prefix) return { mount: m, rest: \"/\" };\n if (pathname.startsWith(`${m.prefix}/`)) return { mount: m, rest: pathname.slice(m.prefix.length) };\n }\n return null;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const hit = matchMount(url.pathname);\n // No mount → the dashboard owns the root, /api/state, and /control/*.\n if (!hit) return dashboard.fetch(req);\n // Strip the mount prefix so each val's own Router sees the path it expects.\n const target = new URL(req.url);\n target.pathname = hit.rest;\n const init: RequestInit = { method: req.method, headers: req.headers };\n if (req.method !== \"GET\" && req.method !== \"HEAD\") init.body = await req.arrayBuffer();\n return hit.mount.fetch(new Request(target.toString(), init));\n}\n",[],[142,201,193],"vals","66ff34df-2410-4da1-9f06-ae8c91e69cd8","heartbeat.ts","69c6bc06-6767-11f1-abd7-1607ee4eb77e",17,["D",1781382927903],"interval","import { CONSUMERS } from \"../../config/beats.ts\";\nimport { ambientEnv } from \"../lib/runtime-env.ts\";\n\n// The DEPLOYED heartbeat — the safety net. On val.town this is a cron val; its\n// floor is 1 minute (disclosed on camera). The poke is the sub-second path; this\n// is the backstop that drains any consumer whose poke was lost. It pulls each\n// consumer same-origin, exactly what the local runtime's interval timer does.\nexport default async function (): Promise {\n const origin = (ambientEnv().get(\"VAL_ORIGIN\") ?? \"\").replace(/\\/+$/, \"\");\n if (!origin) return;\n await Promise.all(\n CONSUMERS.map((c) => fetch(`${origin}${c.localPath}/heartbeat`, { method: \"POST\" }).catch(() => {})),\n );\n}\n",[],[142,201,203],"c77e31f1-3690-438e-83e0-4d294112a3bc","emit.ts","6412d4de-6767-11f1-b890-1607ee4eb77e",15,["D",1781382918317],"import { makeOrder, type OrderEvent } from \"../lib/events.ts\";\nimport { Router, json, readJson } from \"../lib/http.ts\";\nimport { type PokeBody, signPoke } from \"../lib/poke.ts\";\nimport { type Env, ambientEnv } from \"../lib/runtime-env.ts\";\nimport { openStream, s2ConfigFromEnv } from \"../lib/s2-client.ts\";\nimport { getStore } from \"../lib/store.ts\";\n\n// VENDOR · producer. The whole essential job: append to the log, then say\n// \"something changed.\" The poke is best-effort and content-free — `.catch(() =>\n// {})`, no retry — because losing it costs latency, not data. POKE_ENABLED is\n// the beat-3 cut lever; /abuse is the beat-4 misbehaviour.\n\nexport function createEmit(injected?: Env): { fetch: (req: Request) => Promise } {\n const env = injected ?? ambientEnv();\n const s2 = openStream(s2ConfigFromEnv(env));\n const streamId = `${env.get(\"S2_BASIN\") ?? \"acme\"}/${env.get(\"S2_STREAM\") ?? \"orders\"}`;\n const secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\n const targets = (env.get(\"POKE_TARGETS\") ?? \"\")\n .split(\",\")\n .map((s) => s.trim())\n .filter(Boolean);\n const store = getStore(\"emit\");\n\n const pokeEnabled = async (): Promise => (await store.getJSON(\"pokeEnabled\")) ?? true;\n async function nextN(): Promise {\n const n = ((await store.getJSON(\"nextN\")) ?? 0) + 1;\n await store.setJSON(\"nextN\", n);\n return n;\n }\n\n async function appendOne(order?: OrderEvent): Promise<{ seq: number; tail: number; order: OrderEvent }> {\n const o = order ?? makeOrder(await nextN());\n o.ts = Date.now(); // stamped at append — the latency reference\n const res = await s2.append([JSON.stringify(o)]); // <- the ledger (essential)\n return { seq: res.end - 1, tail: res.tail, order: o };\n }\n\n function signed(hint: number): { headers: Record; body: string } {\n const body = JSON.stringify({ stream: streamId, hint } satisfies PokeBody);\n return { headers: { \"x-poke-sig\": signPoke(body, secret), \"content-type\": \"application/json\" }, body };\n }\n async function fire(send: { headers: Record; body: string }): Promise {\n await Promise.all(\n targets.map((u) => fetch(`${u}/poke`, { method: \"POST\", ...send }).catch(() => {})),\n );\n }\n\n const r = new Router();\n\n // append one order, then best-effort poke (no retry)\n r.post(\"/\", async (req) => {\n const provided = await readJson(req);\n const { seq, tail, order } = await appendOne(provided ?? undefined);\n if (await pokeEnabled()) await fire(signed(tail));\n return json({ seq, tail, order });\n });\n\n // beat 3 — cut / restore the poke channel\n r.post(\"/control/poke\", async (_req, { url }) => {\n await store.setJSON(\"pokeEnabled\", url.searchParams.get(\"enabled\") !== \"0\");\n return json({ ok: true, pokeEnabled: await pokeEnabled() });\n });\n\n // beat 4 — abuse: duplicates, out-of-order, stale, and one forged. None move\n // the processed count; the forged one is dropped on signature.\n r.post(\"/abuse\", async () => {\n const tail = await s2.tail();\n const sends = [\n ...Array.from({ length: 5 }, () => signed(tail)), // 5× duplicate\n signed(Math.max(0, tail - 2)), // out of order (older hint)\n signed(0), // stale\n { headers: { \"x-poke-sig\": \"0\".repeat(64), \"content-type\": \"application/json\" }, body: signed(tail).body }, // forged\n ];\n for (const s of sends) await fire(s);\n return json({ ok: true, fired: sends.length, targets: targets.length });\n });\n\n r.get(\"/status\", async () =>\n json({ pokeEnabled: await pokeEnabled(), nextN: (await store.getJSON(\"nextN\")) ?? 0, targets }),\n );\n r.post(\"/reset\", async () => {\n await store.clear();\n return json({ ok: true });\n });\n r.get(\"/\", async () => json({ val: \"emit\", how: \"POST / to append+poke; POST /control/poke?enabled=0|1; POST /abuse\" }));\n\n return { fetch: r.fetch };\n}\n",[],[142,201,212],"1a49a7f1-c5c0-4e6a-a5c1-6a9835861f11","dashboard.ts","9603f5b8-6767-11f1-a907-1607ee4eb77e",22,["D",1781407980807],3,"import { BEATS } from \"../../config/beats.ts\";\nimport { Router, html, json } from \"../lib/http.ts\";\nimport { type Env, ambientEnv } from \"../lib/runtime-env.ts\";\nimport { openStream, s2ConfigFromEnv } from \"../lib/s2-client.ts\";\nimport { getStore } from \"../lib/store.ts\";\n\n// THE FILMED SURFACE. Every number is labelled in plain words; the page is a\n// wall of big tiles, never a JSON wall (RUBRIC hygiene 4). It reads the ledger\n// head straight from S2's tail and fans out to each consumer's /stats, so\n// lag = head − cursor. The control buttons (stable ids) all proxy through here\n// so the page can drive the whole stack same-origin and Playwright can click\n// real buttons.\n\ninterface ConsumerRef {\n name: string;\n url: string;\n}\n\nexport function createDashboard(injected?: Env): { fetch: (req: Request) => Promise } {\n const env = injected ?? ambientEnv();\n const s2 = openStream(s2ConfigFromEnv(env));\n const emitUrl = env.get(\"EMIT_URL\") ?? \"\";\n const consumers: ConsumerRef[] = JSON.parse(env.get(\"CONSUMERS\") ?? \"[]\");\n const byName = new Map(consumers.map((c) => [c.name, c.url]));\n // Deployment-wide origin: the stream head the demo treats as \"0\". Absent → 0\n // (local, where the stream is recreated fresh). On a shared append-only cloud\n // stream, reset re-baselines this to the live head so displayed positions still\n // read 0-based. Shared across vals via the global store namespace.\n const globalStore = getStore(\"webpoke:global\");\n const baseline = (): Promise => globalStore.getJSON(\"baseline\").then((v) => v ?? 0);\n\n async function postTo(base: string, path: string): Promise {\n try {\n const res = await fetch(`${base}${path}`, { method: \"POST\" });\n return await res.json().catch(() => ({}));\n } catch {\n return { error: \"unreachable\" };\n }\n }\n\n // The cloud substrate has a hard ceiling: val.town caps a free account at\n // 1,000 requests/min, and every /api/state fans out to S2's tail + each\n // consumer's /stats. A page polling sub-second, plus the recorder's waits,\n // would blow past that and the endpoint starts 500ing mid-film. Cache the\n // aggregate briefly so the fan-out happens at most once per STATE_CACHE_MS no\n // matter how fast clients poll — the recorder waits on every action with a\n // tolerance well above this, so a sub-1.2s lag in what the page reports is\n // invisible. Locally the cache is harmless (head is cheap).\n const STATE_CACHE_MS = 1200;\n let stateCache: { at: number; payload: unknown } | null = null;\n\n const r = new Router();\n\n // ── aggregated live state ──────────────────────────────────────────────────\n r.get(\"/api/state\", async () => {\n if (stateCache && Date.now() - stateCache.at < STATE_CACHE_MS) return json(stateCache.payload);\n const realTail = await s2.tail().catch(() => 0);\n const base = await baseline();\n const head = Math.max(0, realTail - base); // displayed head, relative to the baseline\n const emitStatus = (await fetch(`${emitUrl}/status`)\n .then((x) => x.json())\n .catch(() => ({ pokeEnabled: true }))) as { pokeEnabled?: boolean };\n const rows = await Promise.all(\n consumers.map(async (c) => {\n const s = (await fetch(`${c.url}/stats`)\n .then((x) => x.json())\n .catch(() => null)) as Record | null;\n const absCursor = (s?.cursor as number) ?? base; // /stats reports absolute seqs\n return {\n name: c.name,\n cursor: Math.max(0, absCursor - base),\n lag: Math.max(0, realTail - absCursor), // delta — baseline-independent\n processed: (s?.processed as number) ?? 0,\n pokesDropped: (s?.pokesDropped as number) ?? 0,\n p50: (s?.p50 as number | null) ?? null,\n p95: (s?.p95 as number | null) ?? null,\n sleeping: Boolean(s?.sleeping),\n active: s?.active === undefined ? true : Boolean(s.active),\n eventsLost: (s?.eventsLost as number) ?? 0,\n reachable: s !== null,\n };\n }),\n );\n const payload = {\n head,\n pokeEnabled: emitStatus.pokeEnabled !== false,\n eventsLost: rows.reduce((n, r2) => n + r2.eventsLost, 0),\n heartbeatFloor: BEATS.heartbeatCronFloorLabel,\n consumers: rows,\n };\n stateCache = { at: Date.now(), payload };\n return json(payload);\n });\n\n // ── control endpoints (each wired to a button) ─────────────────────────────\n r.post(\"/control/append\", async () => json(await postTo(emitUrl, \"/\")));\n r.post(\"/control/poke\", async (_req, { url }) =>\n json(await postTo(emitUrl, `/control/poke?enabled=${url.searchParams.get(\"enabled\") ?? \"1\"}`)),\n );\n r.post(\"/control/abuse\", async () => json(await postTo(emitUrl, \"/abuse\")));\n r.post(\"/control/seed\", async (_req, { url }) => {\n const n = Math.max(1, Number(url.searchParams.get(\"n\") ?? \"1\") || 1);\n for (let i = 0; i < n; i++) await postTo(emitUrl, \"/\");\n return json({ ok: true, seeded: n });\n });\n r.post(\"/control/heartbeat\", async () => {\n const out = await Promise.all(consumers.map((c) => postTo(c.url, \"/heartbeat\")));\n return json({ ok: true, out });\n });\n const consumerCtl = (path: (url: string) => string) => async (_req: Request, { url }: { url: URL }) => {\n const base = byName.get(url.searchParams.get(\"consumer\") ?? \"\");\n if (!base) return json({ error: \"unknown consumer\" }, 404);\n return json(await postTo(base, path(url.toString())));\n };\n r.post(\"/control/rewind\", consumerCtl(() => \"/rewind\"));\n r.post(\"/control/activate\", consumerCtl(() => \"/control/activate\"));\n r.post(\"/control/sleep\", consumerCtl((u) => `/control/sleep?on=${new URL(u).searchParams.get(\"on\") ?? \"1\"}`));\n\n // Cloud reset: the shared stream is append-only and not ours to truncate, so\n // \"back to zero\" means re-baseline — treat the live head as the new origin.\n // Locally this is unused (reset recreates the stream; head is really 0).\n r.post(\"/control/rebaseline\", async () => {\n const realTail = await s2.tail().catch(() => 0);\n await globalStore.setJSON(\"baseline\", realTail);\n return json({ ok: true, baseline: realTail });\n });\n\n r.get(\"/\", () => html(PAGE));\n return { fetch: r.fetch };\n}\n\n// One self-contained page. Inline CSS/JS, no external assets. Tiles are large so\n// every number is readable at half scale; the inline script polls /api/state and\n// avoids template literals so it nests cleanly in this module.\nconst PAGE = `\n\nWebpoke — Acme Orders\n\n\n

Webpoke — Acme Orders

A content-free poke wakes each consumer; the consumer pulls from the log at its own pace. Heartbeat floor: 1 min · poke: on

\n\n

Ledger head

Events lost

\n\n

\n \n \n \n \n \n \n \n

\n\n\n`;\n",[],[142,201,220],"e42984c3-1b8c-48a3-a445-a3f2c445ffbc","consumer-inventory.ts","41ca9dee-6767-11f1-9a08-1607ee4eb77e",12,["D",1781382860818],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER. Everything below `handle` is the shared template. The customer\n// writes ONLY `handle` — a pure reducer over the events it pulled. That purity\n// is the whole point: rewind the cursor and re-run it, and you get byte-for-byte\n// the same state (beat 6).\n\ninterface Inventory {\n units: Record;\n revenue: number;\n orders: number;\n}\n\n// ▶ the one function they write\nfunction handle(events: OrderEvent[], state: Inventory): Inventory {\n for (const e of events) {\n state.units[e.sku] = (state.units[e.sku] ?? 0) + e.qty;\n state.revenue += e.amount;\n state.orders += 1;\n }\n return state;\n}\n\nexport function createInventory(env?: Env): Consumer {\n return makeConsumer({\n name: \"inventory\",\n env,\n initialState: { units: {}, revenue: 0, orders: 0 },\n handle,\n });\n}\n",[],[142,201,229],"e7e2cf71-70db-463c-9224-386b79ed7ec7","consumer-inventory-v2.ts","47cb937e-6767-11f1-95bd-1607ee4eb77e",14,["D",1781382870883],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER, v2 (beat 6 — blue/green). Same log, its OWN checkpoint, a `handle`\n// that derives MORE: it adds per-customer revenue the v1 reducer never computed.\n// Run side-by-side and diff /state against v1 to verify a new version before\n// promoting it — \"the cursor makes the rehearsal free.\" No vendor change.\n\ninterface InventoryV2 {\n units: Record;\n revenue: number;\n orders: number;\n revenueByCustomer: Record; // the new derived view\n}\n\nfunction handle(events: OrderEvent[], state: InventoryV2): InventoryV2 {\n for (const e of events) {\n state.units[e.sku] = (state.units[e.sku] ?? 0) + e.qty;\n state.revenue += e.amount;\n state.orders += 1;\n state.revenueByCustomer[e.customer] = (state.revenueByCustomer[e.customer] ?? 0) + e.amount;\n }\n return state;\n}\n\nexport function createInventoryV2(env?: Env): Consumer {\n return makeConsumer({\n name: \"inventory-v2\",\n env,\n initialState: { units: {}, revenue: 0, orders: 0, revenueByCustomer: {} },\n handle,\n });\n}\n",[],[142,201,237],"7ec06b25-cd55-4036-8414-bebcebc879bf","consumer-analytics.ts","44d9bb8c-6767-11f1-825e-1607ee4eb77e",13,["D",1781382865952],"import { type Consumer, makeConsumer } from \"../lib/consumer-runtime.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport type { Env } from \"../lib/runtime-env.ts\";\n\n// CUSTOMER #2 (beat 5). A different `handle` — same events, a different view.\n// Deployed dormant (START_ACTIVE=0) so the film can spin it up and watch it\n// bootstrap the full history from cursor zero through the same /changes door,\n// while consumer #1's cursor is untouched. Its SLEEP toggle makes it lag alone.\n\ninterface Analytics {\n ordersByCustomer: Record;\n totalOrders: number;\n totalRevenue: number;\n}\n\nfunction handle(events: OrderEvent[], state: Analytics): Analytics {\n for (const e of events) {\n state.ordersByCustomer[e.customer] = (state.ordersByCustomer[e.customer] ?? 0) + 1;\n state.totalOrders += 1;\n state.totalRevenue += e.amount;\n }\n return state;\n}\n\nexport function createAnalytics(env?: Env): Consumer {\n return makeConsumer({\n name: \"analytics\",\n env,\n initialState: { ordersByCustomer: {}, totalOrders: 0, totalRevenue: 0 },\n handle,\n });\n}\n",[],[142,201,245],"763d019d-c990-4dff-b889-c11dc66a9947","changes.ts","682242a8-6767-11f1-b6b8-1607ee4eb77e",16,["D",1781382925135],"import { BEATS } from \"../../config/beats.ts\";\nimport type { OrderEvent } from \"../lib/events.ts\";\nimport { Router, json } from \"../lib/http.ts\";\nimport { type Env, ambientEnv } from \"../lib/runtime-env.ts\";\nimport { openStream, s2ConfigFromEnv } from \"../lib/s2-client.ts\";\n\n// VENDOR · changes endpoint. A thin shim over a ranged S2 read — the ONE read\n// path, so \"history\" and \"live\" come through the same door. Ordered, bounded,\n// replayable. It advertises the retention floor in `meta` (the script's stated\n// open question: S2 retention IS the replay window).\n\nexport function createChanges(injected?: Env): { fetch: (req: Request) => Promise } {\n const env = injected ?? ambientEnv();\n const s2 = openStream(s2ConfigFromEnv(env));\n\n const handler = async (_req: Request, { url }: { url: URL }): Promise => {\n const since = Math.max(0, Number(url.searchParams.get(\"since\") ?? \"0\") || 0);\n const asked = Number(url.searchParams.get(\"limit\") ?? String(BEATS.changesLimit)) || BEATS.changesLimit;\n const limit = Math.min(BEATS.changesLimit, Math.max(1, asked)); // bounded\n const { records, nextSeq, tail } = await s2.read({ since, limit });\n const events = records.map((rec) => JSON.parse(rec.body) as OrderEvent);\n return json({\n events,\n next_cursor: nextSeq,\n meta: { tail, retention_floor_seq: BEATS.retentionFloorSeq, limit },\n });\n };\n\n const r = new Router();\n r.get(\"/\", handler);\n r.get(\"/changes\", handler);\n return { fetch: r.fetch };\n}\n",[],[142,201,253],"b4254817-2deb-4592-93b0-7bb9379b67fc",["D",1781382860818],[179,180,181,182,183,184,185,186],[142,201],"0f435798-77bf-4138-971a-a08f77756d40","store.ts","07e0d792-6767-11f1-8090-1607ee4eb77e","d0fc993d-cf06-4f17-9a2f-d189260e76b1",8,["D",1781382763655],"import { isDeno } from \"./runtime-env.ts\";\n\n// Tiny async key/value store, the one piece of persistence a val needs (its\n// cursor, counters, and a bounded latency ring). Two backends behind one\n// interface:\n// - val.town → std/sqlite (survives the val going cold between requests)\n// - local → an in-process Map (the local runtime is one long-lived process)\n// Same interface either way, so the val code never branches on runtime.\n\nexport interface Store {\n getJSON(key: string): Promise;\n setJSON(key: string, value: unknown): Promise;\n /** Wipe this store's namespace — the reset path's \"zero the cursor\". */\n clear(): Promise;\n}\n\n// ── local: in-process Map, one bucket per namespace ──────────────────────────\nconst BUCKETS = new Map>();\n\nclass MemStore implements Store {\n private bucket: Map;\n constructor(ns: string) {\n this.bucket = BUCKETS.get(ns) ?? new Map();\n BUCKETS.set(ns, this.bucket);\n }\n getJSON(key: string): Promise {\n const raw = this.bucket.get(key);\n return Promise.resolve(raw === undefined ? undefined : (JSON.parse(raw) as T));\n }\n setJSON(key: string, value: unknown): Promise {\n this.bucket.set(key, JSON.stringify(value));\n return Promise.resolve();\n }\n clear(): Promise {\n this.bucket.clear();\n return Promise.resolve();\n }\n}\n\n// ── val.town: std/sqlite, keys prefixed by namespace ─────────────────────────\ninterface SqliteClient {\n execute(q: string | { sql: string; args?: unknown[] }): Promise<{ rows: unknown[][] }>;\n}\n\nclass SqliteStore implements Store {\n private ready: Promise;\n constructor(private ns: string) {\n this.ready = this.init();\n }\n private async init(): Promise {\n // Computed specifier so Node's bundler never tries to resolve this esm.town\n // URL — it is only ever evaluated on Deno (val.town).\n const url = \"https://esm.town/v/std/\" + \"sqlite\";\n const mod = (await import(url)) as { sqlite: SqliteClient };\n await mod.sqlite.execute(\"CREATE TABLE IF NOT EXISTS webpoke_kv (k TEXT PRIMARY KEY, v TEXT)\");\n return mod.sqlite;\n }\n private k(key: string): string {\n return `${this.ns}:${key}`;\n }\n async getJSON(key: string): Promise {\n const db = await this.ready;\n const res = await db.execute({ sql: \"SELECT v FROM webpoke_kv WHERE k = ?\", args: [this.k(key)] });\n const raw = res.rows[0]?.[0];\n return raw == null ? undefined : (JSON.parse(String(raw)) as T);\n }\n async setJSON(key: string, value: unknown): Promise {\n const db = await this.ready;\n await db.execute({\n sql: \"INSERT OR REPLACE INTO webpoke_kv (k, v) VALUES (?, ?)\",\n args: [this.k(key), JSON.stringify(value)],\n });\n }\n async clear(): Promise {\n const db = await this.ready;\n await db.execute({ sql: \"DELETE FROM webpoke_kv WHERE k LIKE ?\", args: [`${this.ns}:%`] });\n }\n}\n\nexport function getStore(namespace: string): Store {\n return isDeno ? new SqliteStore(namespace) : new MemStore(namespace);\n}\n",[],[142,273,265],"lib","0f8c1448-e3fb-4d75-bdf9-f3c8bc5e24ae","s2-client.ts","29c21e8e-6767-11f1-acfc-1607ee4eb77e",10,["D",1781382820494],"import type { Env } from \"./runtime-env.ts\";\n\n// One stream interface, one wire contract — real S2 v1 REST — verified live\n// against s2-lite (local) and the S2 cloud. (S2Config is inlined here rather than\n// imported from config/targets.ts, which pulls node:fs; the type is erased on\n// Deno anyway, but inlining removes any import-resolution risk on val.town.)\n\ninterface S2Config {\n endpoint: string;\n token: string;\n basin: string;\n stream: string;\n}\n\nexport interface LedgerRecord {\n seqNum: number;\n body: string;\n}\nexport interface AppendResult {\n start: number;\n end: number;\n tail: number;\n}\nexport interface ReadResult {\n records: LedgerRecord[];\n nextSeq: number;\n tail: number;\n}\n\nexport interface S2Stream {\n append(bodies: string[], opts?: { matchSeqNum?: number }): Promise;\n read(opts: { since: number; limit: number }): Promise;\n tail(): Promise;\n}\n\n/** Open the configured stream. One REST client, both substrates. */\nexport function openStream(cfg: S2Config): S2Stream {\n return new RestStream(cfg);\n}\n\n/** Build an S2Config from a val's injected Env (val.town Deno.env, or local). */\nexport function s2ConfigFromEnv(env: Env): S2Config {\n const endpoint = env.get(\"S2_ENDPOINT\");\n if (!endpoint) throw new Error(\"S2_ENDPOINT is required\");\n return {\n endpoint,\n token: env.get(\"S2_TOKEN\") ?? \"ignored\",\n basin: env.get(\"S2_BASIN\") ?? \"acme-shop\",\n stream: env.get(\"S2_STREAM\") ?? \"orders\",\n };\n}\n\n// S2 addresses a basin one of two ways, distinguished by a `{basin}` placeholder:\n// • cloud: https://{basin}.b.aws.s2.dev → basin in the subdomain, no header\n// • s2-lite: http://localhost:9090 → fixed origin, basin via s2-basin header\ntype StreamPosition = { seq_num: number; timestamp: number };\n\nclass RestStream implements S2Stream {\n private base: string;\n private basinHeader?: string;\n constructor(private cfg: S2Config) {\n let root = cfg.endpoint.replace(/\\/+$/, \"\");\n if (root.includes(\"{basin}\")) {\n root = root.replace(\"{basin}\", encodeURIComponent(cfg.basin));\n } else {\n this.basinHeader = cfg.basin;\n }\n this.base = `${root}/v1/streams/${encodeURIComponent(cfg.stream)}`;\n }\n private headers(): Record {\n const h: Record = {\n authorization: `Bearer ${this.cfg.token}`,\n \"s2-format\": \"raw\",\n \"content-type\": \"application/json\",\n };\n if (this.basinHeader) h[\"s2-basin\"] = this.basinHeader;\n return h;\n }\n async append(bodies: string[], opts: { matchSeqNum?: number } = {}): Promise {\n const payload: Record = { records: bodies.map((body) => ({ body })) };\n if (typeof opts.matchSeqNum === \"number\") payload.match_seq_num = opts.matchSeqNum;\n const res = await fetch(`${this.base}/records`, {\n method: \"POST\",\n headers: this.headers(),\n body: JSON.stringify(payload),\n });\n if (!res.ok) throw new Error(`s2 append ${res.status}: ${await res.text()}`);\n const ack = (await res.json()) as { start: StreamPosition; end: StreamPosition; tail: StreamPosition };\n return { start: ack.start.seq_num, end: ack.end.seq_num, tail: ack.tail.seq_num };\n }\n async read(opts: { since: number; limit: number }): Promise {\n const u = new URL(`${this.base}/records`);\n u.searchParams.set(\"seq_num\", String(opts.since));\n u.searchParams.set(\"count\", String(opts.limit));\n const res = await fetch(u, { headers: this.headers() });\n if (res.status === 416) {\n const body = (await res.json().catch(() => ({}))) as { tail?: StreamPosition };\n return { records: [], nextSeq: opts.since, tail: body.tail?.seq_num ?? opts.since };\n }\n if (!res.ok) throw new Error(`s2 read ${res.status}: ${await res.text()}`);\n const batch = (await res.json()) as { records: { seq_num: number; body: string }[]; tail?: StreamPosition };\n const records = batch.records.map((r) => ({ seqNum: r.seq_num, body: r.body }));\n const last = records[records.length - 1];\n const nextSeq = last ? last.seqNum + 1 : opts.since;\n return { records, nextSeq, tail: batch.tail?.seq_num ?? nextSeq };\n }\n async tail(): Promise {\n const res = await fetch(`${this.base}/records/tail`, { headers: this.headers() });\n if (!res.ok) throw new Error(`s2 tail ${res.status}: ${await res.text()}`);\n return ((await res.json()) as { tail: StreamPosition }).tail.seq_num;\n }\n}\n",[],[142,273,275],"7f2304b1-e0d6-4605-94b6-6230931064df","runtime-env.ts","db540b68-6766-11f1-9a66-1607ee4eb77e",["D",1781382688901],"// The one place that knows whether we're on Deno (val.town) or Node (local).\n//\n// On val.town each val is its own deployment with its own env vars (Deno.env).\n// Locally we run *all* the vals in one Node process, so they can't share\n// process.env for per-val config. Every val is therefore built by a factory\n// that takes an `Env`; on val.town the factory is fed the ambient Deno.env, and\n// locally the runtime feeds each val its own injected record.\n\nexport interface Env {\n get(key: string): string | undefined;\n}\n\n/** The platform's own environment — Deno.env on val.town, process.env on Node. */\nexport function ambientEnv(): Env {\n const deno = (globalThis as { Deno?: { env?: { get(k: string): string | undefined } } }).Deno;\n if (deno?.env && typeof deno.env.get === \"function\") {\n return { get: (k) => deno.env!.get(k) };\n }\n return { get: (k) => (typeof process !== \"undefined\" ? process.env[k] : undefined) };\n}\n\n/** A fixed lookup, for injecting one val's config in the local runtime. */\nexport function makeEnv(record: Record): Env {\n return { get: (k) => record[k] };\n}\n\nexport const isDeno = typeof (globalThis as { Deno?: unknown }).Deno !== \"undefined\";\n",[],[142,273,283],"51305476-90c3-417a-8a1f-194924413636","poke.ts","e492f91e-6766-11f1-babd-1607ee4eb77e",4,["D",1781382704417],"import { Buffer } from \"node:buffer\";\nimport { createHmac, timingSafeEqual } from \"node:crypto\";\n\n// The poke is content-free and best-effort, so the signature is NOT a\n// correctness mechanism — it just lets a consumer ignore a forged poke. A\n// bad or missing sig at worst drops one poke (the heartbeat covers it); it can\n// never lose or corrupt data, because the poke carries no data. This is\n// deliberately simple and flagged on-screen as an open question.\n\nexport function signPoke(body: string, secret: string): string {\n return createHmac(\"sha256\", secret).update(body).digest(\"hex\");\n}\n\nexport function verifyPoke(body: string, sig: string | null | undefined, secret: string): boolean {\n if (!sig) return false;\n const expected = signPoke(body, secret);\n if (sig.length !== expected.length) return false;\n try {\n return timingSafeEqual(Buffer.from(sig), Buffer.from(expected));\n } catch {\n return false;\n }\n}\n\nexport interface PokeBody {\n stream: string;\n hint: number; // the ledger tail the vendor saw — monotone, coalesced by max()\n}\n",[],[142,273,290],"abacbf28-a9f0-46d0-bdc0-8771176b0be6","metrics.ts","ee298fec-6766-11f1-81ab-1607ee4eb77e",["D",1781382720506],"import type { Store } from \"./store.ts\";\n\n// The only place that knows both ends of the latency: it records, per event,\n// (handled time − the event's append time) into a bounded ring, and keeps the\n// counters the dashboard reads. eventsLost is structurally 0 — a cursor only\n// advances past events that handle() actually saw — so it is reported as the\n// constant it is. That zero, through every failure beat, is the payload.\n\nconst RING = 200;\n\nexport interface Snapshot {\n processed: number;\n pokesReceived: number;\n pokesDropped: number; // pokes that caused no forward progress (forged, stale, coalesced)\n eventsLost: number; // always 0\n p50: number | null;\n p95: number | null;\n samples: number;\n}\n\nexport class Metrics {\n constructor(private store: Store) {}\n\n async recordLatency(ms: number): Promise {\n const ring = (await this.store.getJSON(\"lat\")) ?? [];\n ring.push(Math.max(0, Math.round(ms)));\n while (ring.length > RING) ring.shift();\n await this.store.setJSON(\"lat\", ring);\n }\n\n async bump(counter: \"processed\" | \"pokesReceived\" | \"pokesDropped\", by = 1): Promise {\n const v = (await this.store.getJSON(counter)) ?? 0;\n await this.store.setJSON(counter, v + by);\n }\n\n /** Beat 6 rewind: clear the derived metrics so a re-drain reproduces them. */\n async resetCounters(): Promise {\n await this.store.setJSON(\"processed\", 0);\n await this.store.setJSON(\"lat\", []);\n }\n\n async snapshot(): Promise {\n const ring = (await this.store.getJSON(\"lat\")) ?? [];\n return {\n processed: (await this.store.getJSON(\"processed\")) ?? 0,\n pokesReceived: (await this.store.getJSON(\"pokesReceived\")) ?? 0,\n pokesDropped: (await this.store.getJSON(\"pokesDropped\")) ?? 0,\n eventsLost: 0,\n p50: percentile(ring, 50),\n p95: percentile(ring, 95),\n samples: ring.length,\n };\n }\n}\n\nfunction percentile(arr: number[], p: number): number | null {\n if (arr.length === 0) return null;\n const sorted = [...arr].sort((a, b) => a - b);\n const idx = Math.min(sorted.length - 1, Math.floor((p / 100) * sorted.length));\n return sorted[idx]!;\n}\n",[],[142,273,298],"997ac5a3-ed9f-4ba2-afef-d84b05750ca8","http.ts","e1b5c230-6766-11f1-9a66-1607ee4eb77e",["D",1781382699625],"// A tiny router over the Web fetch handler shape, so a val's code is the same\n// on val.town (where the default export IS a `(Request) => Response`) and in the\n// local runtime (which mounts these handlers behind a Node http server). No\n// framework — the routes a val needs fit on one screen.\n\nexport type Handler = (\n req: Request,\n ctx: { url: URL; params: Record },\n) => Response | Promise;\n\ninterface Route {\n method: string;\n parts: string[];\n handler: Handler;\n}\n\nexport class Router {\n private routes: Route[] = [];\n\n on(method: string, path: string, handler: Handler): this {\n this.routes.push({ method, parts: split(path), handler });\n return this;\n }\n get(path: string, handler: Handler): this {\n return this.on(\"GET\", path, handler);\n }\n post(path: string, handler: Handler): this {\n return this.on(\"POST\", path, handler);\n }\n\n async handle(req: Request): Promise {\n const url = new URL(req.url);\n const got = split(url.pathname);\n for (const route of this.routes) {\n if (route.method !== req.method) continue;\n const params = match(route.parts, got);\n if (params) return route.handler(req, { url, params });\n }\n // CORS preflight for the dashboard's cross-val fetches.\n if (req.method === \"OPTIONS\") return cors(new Response(null, { status: 204 }));\n return cors(json({ error: \"not found\", path: url.pathname }, 404));\n }\n\n /** Convenience: a `(Request) => Response` for val.town's default export. */\n get fetch(): (req: Request) => Promise {\n return (req) => this.handle(req);\n }\n}\n\nfunction split(path: string): string[] {\n return path.split(\"/\").filter(Boolean);\n}\n\nfunction match(pattern: string[], got: string[]): Record | null {\n if (pattern.length !== got.length) return null;\n const params: Record = {};\n for (let i = 0; i < pattern.length; i++) {\n const p = pattern[i]!;\n if (p.startsWith(\":\")) params[p.slice(1)] = decodeURIComponent(got[i]!);\n else if (p !== got[i]) return null;\n }\n return params;\n}\n\n// Every demo surface is read cross-origin by the dashboard and (in valtown mode)\n// across vals, so every response carries permissive CORS.\nexport function cors(res: Response): Response {\n res.headers.set(\"access-control-allow-origin\", \"*\");\n res.headers.set(\"access-control-allow-headers\", \"*\");\n res.headers.set(\"access-control-allow-methods\", \"GET,POST,DELETE,OPTIONS\");\n return res;\n}\n\nexport function json(data: unknown, status = 200): Response {\n return cors(\n new Response(JSON.stringify(data), {\n status,\n headers: { \"content-type\": \"application/json\" },\n }),\n );\n}\n\nexport function html(body: string, status = 200): Response {\n return cors(new Response(body, { status, headers: { \"content-type\": \"text/html; charset=utf-8\" } }));\n}\n\nexport function text(body: string, status = 200): Response {\n return cors(new Response(body, { status, headers: { \"content-type\": \"text/plain; charset=utf-8\" } }));\n}\n\nexport async function readJson(req: Request): Promise {\n try {\n const text = await req.text();\n return text ? (JSON.parse(text) as T) : null;\n } catch {\n return null;\n }\n}\n",[],[142,273,305],"8ca04789-2b35-4ed9-b41c-eb2b800d3b48","events.ts","e9467d1e-6766-11f1-8990-1607ee4eb77e",5,["D",1781382712302],"import { CATALOG, CUSTOMERS } from \"../../config/beats.ts\";\n\n// The order events that flow through the ledger. Small and legible — on camera\n// the subject is the cursor / lag / latency, not the order contents. Every\n// event carries `ts`, the moment it was appended, so a consumer can measure\n// end-to-end latency (append → handled) — which is what visibly rises during\n// the cut-poke beat and falls back after the heartbeat drains the backlog.\n\nexport interface OrderEvent {\n type: \"order.created\";\n id: string; // stable order id, derived from n\n n: number; // 1-based demo sequence (deterministic content key)\n sku: string;\n product: string;\n qty: number;\n amount: number; // qty * unit price\n customer: string;\n ts: number; // append timestamp (ms since epoch), stamped by emit\n}\n\n// A tiny seeded PRNG (mulberry32) so the same n always yields the same order.\nfunction rngFor(n: number): () => number {\n let a = (0x9e3779b9 ^ (n * 0x85ebca6b)) >>> 0;\n return () => {\n a |= 0;\n a = (a + 0x6d2b79f5) | 0;\n let t = Math.imul(a ^ (a >>> 15), 1 | a);\n t = (t + Math.imul(t ^ (t >>> 7), 61 | t)) ^ t;\n return ((t ^ (t >>> 14)) >>> 0) / 4294967296;\n };\n}\n\n/** Deterministic order content for demo entry `n` (1-based). `ts` is stamped later. */\nexport function makeOrder(n: number): OrderEvent {\n const r = rngFor(n);\n const item = CATALOG[Math.floor(r() * CATALOG.length)]!;\n const customer = CUSTOMERS[Math.floor(r() * CUSTOMERS.length)]!;\n const qty = 1 + Math.floor(r() * 3);\n return {\n type: \"order.created\",\n id: `ord-${String(n).padStart(4, \"0\")}`,\n n,\n sku: item.sku,\n product: item.name,\n qty,\n amount: qty * item.price,\n customer,\n ts: 0,\n };\n}\n",[],[142,273,312],"134de356-7058-4d4c-b07e-0227cccdc8c8","cursor.ts","0bbba996-6767-11f1-8e04-1607ee4eb77e",9,["D",1781382770123],"import type { Store } from \"./store.ts\";\n\n// The consumer-owned checkpoint: one number, \"the next seq I want.\" This is the\n// whole of the customer's bookkeeping — remember your place.\n//\n// Sequence numbers are absolute S2 seqs. A consumer onboards at a BASELINE — the\n// stream head at the moment it joined — because an append-only log it doesn't own\n// may already hold history from before its time (and you can't truncate someone\n// else's log). A fresh or rewound cursor therefore starts at the baseline, not at\n// absolute 0; the dashboard shows positions relative to it. Locally the baseline\n// is 0 (the stack recreates its own stream fresh), so all of this is a no-op and\n// the cursor is just \"0, then up.\" lag = head − cursor is computed by the\n// dashboard from the absolute cursor and the absolute tail, so it is unaffected.\n\nexport class Cursor {\n constructor(\n private store: Store,\n private globalStore: Store,\n ) {}\n\n /** The deployment-wide origin; absent (local) means 0. Read live so a cloud\n * re-baseline on reset takes effect without redeploying. */\n baseline(): Promise {\n return this.globalStore.getJSON(\"baseline\").then((v) => v ?? 0);\n }\n async get(): Promise {\n const v = await this.store.getJSON(\"cursor\");\n return v ?? (await this.baseline());\n }\n set(seq: number): Promise {\n return this.store.setJSON(\"cursor\", seq);\n }\n /** Beat 6: rewind to the baseline so the consumer re-derives its state from the log. */\n async rewind(): Promise {\n await this.store.setJSON(\"cursor\", await this.baseline());\n }\n}\n",[],[142,273,320],"59844699-8182-440f-abb9-4f7b6d3c40f7","consumer-runtime.ts","3fd1a8de-6767-11f1-b7ab-1607ee4eb77e",11,["D",1781382857490],"import { BEATS } from \"../../config/beats.ts\";\nimport { Cursor } from \"./cursor.ts\";\nimport type { OrderEvent } from \"./events.ts\";\nimport { Router, json, text } from \"./http.ts\";\nimport { Metrics } from \"./metrics.ts\";\nimport { type PokeBody, verifyPoke } from \"./poke.ts\";\nimport { type Env, ambientEnv } from \"./runtime-env.ts\";\nimport { getStore } from \"./store.ts\";\n\n// THE TEMPLATE ENGINE. Everything a consumer needs is here; the customer writes\n// exactly one function — a pure reducer `handle(events, state) => state`. That\n// purity is what makes the replay beat true: rewind the cursor, clear the\n// derived state, re-drain, and you land on byte-identical state.\n//\n// tick() drain pull -> handle -> commit cursor, until the log is empty\n// POST /poke verify HMAC, coalesce the hint by max(), single-flight a tick\n// interval the heartbeat floor (cron) — the safety net when pokes are lost\n// POST /tick manual \"poll now\"\n// POST /rewind beat 6: zero the cursor + state, re-derive\n// GET /stats the dashboard's data source\n// GET /state the derived state, for the beat-6 blue/green diff\n\nexport interface ConsumerOptions {\n name: string;\n initialState: S;\n handle: (events: OrderEvent[], state: S) => S | Promise;\n /** Local runtime injects per-val config here; on val.town it's the ambient Deno.env. */\n env?: Env;\n}\n\nexport interface Consumer {\n name: string;\n fetch: (req: Request) => Promise;\n interval: () => Promise;\n}\n\nexport function makeConsumer(opts: ConsumerOptions): Consumer {\n const env = opts.env ?? ambientEnv();\n const name = opts.name;\n const changesUrlRaw = env.get(\"CHANGES_URL\");\n if (!changesUrlRaw) throw new Error(`consumer ${name}: CHANGES_URL is required`);\n const changesUrl: string = changesUrlRaw;\n const secret = env.get(\"POKE_SECRET\") ?? \"demo-poke-secret\";\n const sleepMs = Number(env.get(\"SLEEP_MS\") ?? BEATS.analyticsSleepMs) || BEATS.analyticsSleepMs;\n\n const store = getStore(`consumer:${name}`);\n // Deployment-wide origin (baseline), shared across vals; 0 locally. See Cursor.\n const cursor = new Cursor(store, getStore(\"webpoke:global\"));\n const metrics = new Metrics(store);\n\n // `opts.initialState` is the canonical prototype — never hand it to `handle`\n // or persist it directly. Reducers are free to mutate the state they receive\n // (the simple, natural style), so every working copy must be private. This is\n // what makes rewind/replay byte-identical: a fresh zero every time, never a\n // prototype some earlier drain already mutated.\n const freshInitial = (): S => structuredClone(opts.initialState);\n\n // Single-flight: at most one drain in flight. Five simultaneous pokes cause at\n // most one extra tick — the rest see `running` and coalesce (the beat-4 defense).\n let running = false;\n let coalescedHint = -1;\n\n async function pull(since: number): Promise<{ events: OrderEvent[]; next: number }> {\n const u = `${changesUrl}${changesUrl.includes(\"?\") ? \"&\" : \"?\"}since=${since}&limit=${BEATS.changesLimit}`;\n const res = await fetch(u);\n if (!res.ok) throw new Error(`pull ${res.status}`);\n const data = (await res.json()) as { events?: OrderEvent[]; next_cursor?: number };\n return { events: data.events ?? [], next: data.next_cursor ?? since };\n }\n\n async function drain(): Promise {\n let did = 0;\n for (;;) {\n const since = await cursor.get();\n const { events, next } = await pull(since);\n if (events.length === 0) break;\n if (await sleeping()) await sleep(sleepMs);\n let state = (await store.getJSON(\"state\")) ?? freshInitial();\n state = await opts.handle(events, state);\n const done = Date.now();\n await store.setJSON(\"state\", state);\n await cursor.set(next); // consumer-owned checkpoint — commit AFTER handle\n await metrics.bump(\"processed\", events.length);\n for (const e of events) await metrics.recordLatency(done - (e.ts ?? done));\n did += events.length;\n }\n return did;\n }\n\n async function singleFlight(): Promise {\n if (running) return 0; // coalesced into the in-flight drain\n running = true;\n try {\n return await drain();\n } finally {\n running = false;\n }\n }\n\n async function sleeping(): Promise {\n return (await store.getJSON(\"sleeping\")) ?? false;\n }\n\n // A consumer can be deployed dormant — poked, but not yet listening — so beat 5\n // can spin it up and watch it bootstrap the whole history from cursor zero.\n async function active(): Promise {\n const v = await store.getJSON(\"active\");\n return v === undefined ? (env.get(\"START_ACTIVE\") ?? \"1\") !== \"0\" : v;\n }\n\n const r = new Router();\n\n // The poke receiver. The poke is content-free: its only job is to wake a tick.\n r.post(\"/poke\", async (req) => {\n const raw = await req.text();\n const sig = req.headers.get(\"x-poke-sig\");\n if (!(await active())) return json({ ok: true, skipped: \"dormant\" }); // not subscribed yet\n await metrics.bump(\"pokesReceived\");\n if (!verifyPoke(raw, sig, secret)) {\n await metrics.bump(\"pokesDropped\"); // forged/unsigned — safely ignored\n return json({ ok: false, reason: \"bad signature\" });\n }\n try {\n const body = JSON.parse(raw) as PokeBody;\n coalescedHint = Math.max(coalescedHint, body.hint ?? -1);\n } catch {\n /* the hint is advisory; a malformed body still can't lose data */\n }\n const before = await cursor.get();\n const did = await singleFlight();\n const after = await cursor.get();\n if (after === before) await metrics.bump(\"pokesDropped\"); // stale/duplicate/coalesced — no progress\n return json({ ok: true, processed: did });\n });\n\n // Manual \"poll now\".\n r.post(\"/tick\", async () => json({ ok: true, processed: await singleFlight() }));\n\n // The heartbeat, also exposed as a button for recording (the real cron floor\n // is disclosed on camera).\n r.post(\"/heartbeat\", async () => {\n if (!(await active())) return json({ ok: true, skipped: \"dormant\" });\n return json({ ok: true, processed: await singleFlight() });\n });\n\n // Beat 5: spin up a dormant consumer — it bootstraps the full history from zero.\n r.post(\"/control/activate\", async () => {\n await store.setJSON(\"active\", true);\n return json({ ok: true, processed: await singleFlight() });\n });\n\n // Beat 6: rewind to zero and re-derive identical state.\n r.post(\"/rewind\", async () => {\n await cursor.rewind();\n await store.setJSON(\"state\", freshInitial());\n await metrics.resetCounters();\n const did = await singleFlight();\n return json({ ok: true, processed: did, state: await store.getJSON(\"state\") });\n });\n\n // Beat 5: analytics' sleep toggle (?on=1|0).\n r.post(\"/control/sleep\", async (_req, { url }) => {\n await store.setJSON(\"sleeping\", url.searchParams.get(\"on\") !== \"0\");\n return json({ ok: true, sleeping: await sleeping() });\n });\n\n // Full reset to defaults (reset.ts).\n r.post(\"/reset\", async () => {\n await store.clear();\n return json({ ok: true });\n });\n\n r.get(\"/stats\", async () => {\n const snap = await metrics.snapshot();\n return json({\n name,\n cursor: await cursor.get(),\n sleeping: await sleeping(),\n active: await active(),\n coalescedHint,\n ...snap,\n });\n });\n\n r.get(\"/state\", async () => {\n return json({ name, cursor: await cursor.get(), state: (await store.getJSON(\"state\")) ?? freshInitial() });\n });\n\n r.get(\"/\", async () => text(`webpoke consumer \"${name}\" — POST /poke /tick /rewind, GET /stats /state`));\n\n return {\n name,\n fetch: r.fetch,\n interval: async () => {\n if (await active()) await singleFlight();\n },\n };\n}\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n",[],[142,273,328],"75464b4d-fc86-46a6-a530-f0834c28c1bb",["D",1781382688901],[169,170,171,172,173,174,175,176,177],[142,273],["D",1781382688901],[168,178],[142],"b1c78536-c3d5-467c-9835-21a6a97aa8b7",["D",1781408741910],[],[149,33],["D",1781382751420],[166],[149],["D",1781382627825],{"_98":97,"_105":101},{"_98":97,"_99":-5,"_100":101,"_18":56,"_102":103,"_104":25},{"_13":87,"_32":88,"_44":43,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":46,"_96":97},"ctx",{"_80":-5,"_125":386,"_387":388,"_389":390,"_391":25,"_392":25,"_393":25,"_394":60,"_395":-5,"_396":-7,"_397":-7,"_398":64,"_399":25,"_400":25,"_401":-5,"_402":25,"_403":25,"_404":25,"_405":-5},"ENV",{"_357":358,"_359":360,"_361":88,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371,"_372":373,"_374":375,"_376":377,"_378":379,"_380":381,"_382":383,"_384":385},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v23