${esc(data.domain)} is in the .${esc(data.tld)} registry.

${rows}\n ${note(data)}\n ${pricingSlot(data)}\n ${source(data)}\n `;\n}\n\n/**\n * Deliberately unstamped and non-committal. All the registry has said is that\n * it holds no record, which is true of names nobody can buy, so the card shows\n * what is known and names the question it is still waiting on.\n */\nfunction availableCard(data) {\n return `\n ${head(data)}\n

\n The .${esc(data.tld)} registry holds no record for ${esc(data.domain)}.\n Asking Porkbun whether it's actually for sale…\n

\n ${note(data)}\n ${pricingSlot(data)}\n ${source(data)}\n `;\n}\n\nfunction messageCard(data) {\n const titles = {\n invalid: \"Not a domain name\",\n unsupported: `.${data.tld} isn't reachable by RDAP`,\n error: \"No answer from the registry\",\n };\n const extra = data.status === \"unsupported\"\n ? `

ICANN's own lookup tool covers some registries that don't publish RDAP.

`\n : \"\";\n\n return `\n

${data.status === \"invalid\" ? \"Check the spelling\" : \"Can't check\"}

${esc(titles[data.status] ?? \"Lookup failed\")}

${esc(data.message ?? \"\")}

\n ${extra}\n ${pricingSlot(data)}\n ${source(data)}\n `;\n}\n\nfunction head(data, mark = \"\") {\n const idn = data.unicodeName && data.unicodeName !== data.domain\n ? `

${esc(data.unicodeName)}

`\n : \"\";\n\n return `\n

Registry record

${esc(data.domain)}

\n ${idn}\n

\n ${mark}\n

\n `;\n}\n\n/** The stamp is the verdict, so it is only ever pressed onto a settled one. */\nfunction stamp(tone, label) {\n return `

${esc(label)}

`;\n}\n\nfunction row(label, value) {\n if (!value) return \"\";\n return `

${esc(label)}

${value}

`;\n}\n\nfunction withAside(value, aside) {\n return aside ? `${esc(value)} ${esc(aside)}` : esc(value);\n}\n\nfunction stack(values) {\n return values.map((v) => `${esc(v)}`).join(\"\");\n}\n\nfunction dateCell(iso) {\n if (!iso) return null;\n const date = new Date(iso);\n if (Number.isNaN(date.getTime())) return esc(iso);\n return withAside(date.toISOString().slice(0, 10), relative(date));\n}\n\n/** \"3 years ago\" / \"in 2 months\", for judging how settled a registration is. */\nfunction relative(date) {\n const days = Math.round((date.getTime() - Date.now()) / 86_400_000);\n const fmt = new Intl.RelativeTimeFormat(\"en\", { numeric: \"auto\" });\n if (Math.abs(days) >= 365) return fmt.format(Math.round(days / 365.25), \"year\");\n if (Math.abs(days) >= 31) return fmt.format(Math.round(days / 30.44), \"month\");\n return fmt.format(days, \"day\");\n}\n\nfunction note(data) {\n return data.note ? `

${esc(data.note)}

` : \"\";\n}\n\n/**\n * Ask Porkbun whether it will sell this exact name, and only then say a word\n * about it. RDAP's 404 and a name that is reserved, blocked, or held back by\n * the registry are the same 404; the registrar is the only one who can tell\n * them apart. An unanswered check leaves the registry's own hedged reading\n * standing — silence is never allowed to read as a confirmation.\n */\nasync function settleVerdict(data, card, token) {\n let availability;\n try {\n const res = await fetch(`/api/availability?domain=${encodeURIComponent(data.domain)}`);\n if (res.ok) ({ availability } = await res.json());\n } catch {\n // Unknown, which is what an absent availability already means.\n }\n\n if (token !== searchToken) return; // a newer search owns the page now\n\n const held = availability && !availability.registrable;\n card.querySelector(\".card-head\")?.insertAdjacentHTML(\n \"beforeend\",\n held ? stamp(\"held\", \"Withheld\") : stamp(\"free\", \"Available\"),\n );\n\n const verdict = card.querySelector(\"[data-verdict]\");\n if (verdict) verdict.innerHTML = verdictText(data, availability);\n\n mountPricing(card, data, availability);\n}\n\nfunction verdictText(data, a) {\n const record =\n `The .${esc(data.tld)} registry holds no record for ${esc(data.domain)}`;\n\n // Porkbun didn't answer. Claim no more than the registry itself said, which\n // is exactly what this page claimed before it ever asked.\n if (!a) {\n return `${record}.\n A registrar should be able to sell it — reserved and premium names are the exception.`;\n }\n\n if (!a.registrable) {\n return `${record}, but Porkbun won't sell it. Names that are reserved, blocked, or held back\n by the registry look unregistered over RDAP — this one isn't yours to take.`;\n }\n\n if (a.premium) {\n // The one case where \"available\" on its own misleads about the cost, so the\n // number belongs in the verdict rather than behind the price button.\n const quote = typeof a.price === \"number\"\n ? `quoted at ${money(a.price)}, not the .${esc(data.tld)} list price`\n : `quoted per name rather than off the .${esc(data.tld)} list`;\n return `${record}, and Porkbun will sell it as a premium name — ${quote}.`;\n }\n\n return `${record}, and Porkbun confirms it will sell this exact name.`;\n}\n\n/**\n * The price list is its own slow question: Porkbun rebuilds the whole 900-TLD\n * table per request and can take twenty seconds cold. Most visitors came for\n * the verdict, so the price waits behind a button they can ignore.\n */\nfunction pricingSlot(data) {\n return data.tld ? `` : \"\";\n}\n\nfunction mountPricing(card, data, availability) {\n const slot = card.querySelector(\"[data-pricing]\");\n if (!slot) return;\n\n slot.innerHTML = `\n

Retail price

\n \n `;\n slot.hidden = false;\n slot.querySelector(\"button\").addEventListener(\n \"click\",\n (event) => loadPricing(slot, event.currentTarget, data, availability),\n );\n}\n\n/**\n * Nothing guards against a stale response here: the slot belongs to one card,\n * and a newer search has already replaced that card, so a late answer writes\n * into a node nobody is looking at.\n */\nasync function loadPricing(slot, button, data, availability) {\n button.disabled = true;\n button.textContent = \"Asking Porkbun…\";\n\n let pricing;\n try {\n const res = await fetch(`/api/pricing?domain=${encodeURIComponent(data.domain || data.query)}`);\n if (!res.ok) throw new Error(`pricing failed: ${res.status}`);\n ({ pricing } = await res.json());\n } catch {\n // They asked for this one, so leave them a way to ask again.\n button.disabled = false;\n button.textContent = \"No answer — ask again\";\n return;\n }\n\n slot.innerHTML = pricingPanel(pricing, availability) || `\n

Retail price

Porkbun doesn't sell .${esc(data.tld)} names.

\n `;\n}\n\n/** What the name costs, kept visibly apart from the registry's own record. */\nfunction pricingPanel(p, availability) {\n const rows = p\n ? [\n row(\"First year\", money(p.registration)),\n row(\"Renewal\", money(p.renewal, \"/yr\")),\n row(\"Transfer in\", money(p.transfer)),\n ].join(\"\")\n : \"\";\n const foot = availabilityFoot(availability, Boolean(rows));\n if (!rows && !foot) return \"\";\n\n const head = p\n ? `Porkbun\n list price · .${esc(p.suffix)} · ${esc(p.currency)}`\n : `Porkbun`;\n\n return `\n

${head}

\n ${rows ? `

${rows}` : \"\"}\n ${foot ?? `

Premium and reserved names are quoted individually.

`}\n `;\n}\n\n/**\n * Porkbun's per-name answer, which is the only thing here that knows about this\n * name rather than about its suffix. Null when the check didn't run, leaving the\n * generic caveat in place — silence never gets reported as a confirmation.\n */\nfunction availabilityFoot(a, hasListPrice) {\n if (!a) return null;\n\n if (!a.registrable) {\n // Only point at the list price when there is one to point at.\n return hasListPrice\n ? `

Porkbun won't sell this name. The prices above are\n what the suffix costs, not what this name costs.

`\n : `

Porkbun won't sell this name.

`;\n }\n\n if (typeof a.price !== \"number\") {\n return `

Porkbun confirms this exact name is registrable.

`;\n }\n\n const minimum = a.minDuration ? `, ${a.minDuration}-year minimum` : \"\";\n if (a.premium) {\n return `

Porkbun quotes ${money(a.price)} for this\n exact name — a premium registration, priced apart from the list${esc(minimum)}.

`;\n }\n\n const then = a.firstYearPromo && typeof a.regularPrice === \"number\"\n ? ` for the first year, then ${money(a.regularPrice)}`\n : \"\";\n return `

Porkbun confirms this exact name is registrable at\n ${money(a.price)}${then}${esc(minimum)}.

`;\n}\n\nfunction money(amount, per = \"\") {\n if (typeof amount !== \"number\") return null;\n // Free is a real price here — some registries don't charge to transfer in.\n if (amount === 0) return \"Free\";\n // Premium names reach four and five figures, where an ungrouped number is\n // genuinely hard to read at a glance.\n const digits = { minimumFractionDigits: 2, maximumFractionDigits: 2 };\n return esc(`$${amount.toLocaleString(\"en-US\", digits)}${per}`);\n}\n\nfunction source(data) {\n if (!data.source) return \"\";\n const at = data.answeredAt ? ` · ${data.answeredAt.slice(11, 19)} UTC` : \"\";\n return `

Answered by ${esc(data.source)}${esc(at)}

`;\n}\n\nfunction esc(value) {\n return String(value).replace(\n /[&<>\"']/g,\n (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c]),\n );\n}\n",[19,60],"e89ccef8-720b-46fa-bcbd-d438fbd0e858","index.html","b8d5c3c0-89d4-11f1-96e4-1607ee4eb77e",32,["D",1787604523827],2,"\n\n \n \n \n WHOIS Lookup\n \n \n \n \n \n \n \n \n \n \n

WHOIS Lookup

\n\n \n\n

\n\n \n \n\n",[19,69],"64242c32-bb1f-495a-b292-5472fd3ed691",["D",1785168214803],0,"directory",[19],{"_36":161,"_13":162,"_39":163,"_41":-5,"_43":44,"_45":51,"_47":48,"_49":164,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":165,"_18":166},{"_36":76,"_13":19,"_39":42,"_41":-5,"_43":44,"_45":64,"_47":48,"_49":146,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":147,"_18":148},{"_36":131,"_13":132,"_39":133,"_41":-5,"_43":44,"_45":73,"_47":48,"_49":134,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":135,"_18":136},{"_36":123,"_13":124,"_39":125,"_41":-5,"_43":44,"_45":126,"_47":48,"_49":127,"_17":78,"_52":24,"_53":128,"_55":56,"_57":-5,"_96":129,"_18":130},{"_36":115,"_13":116,"_39":117,"_41":-5,"_43":44,"_45":118,"_47":48,"_49":119,"_17":78,"_52":24,"_53":120,"_55":56,"_57":-5,"_96":121,"_18":122},{"_36":107,"_13":108,"_39":109,"_41":-5,"_43":44,"_45":110,"_47":48,"_49":111,"_17":73,"_52":24,"_53":112,"_55":56,"_57":-5,"_96":113,"_18":114},{"_36":99,"_13":100,"_39":101,"_41":-5,"_43":44,"_45":102,"_47":48,"_49":103,"_17":78,"_52":24,"_53":104,"_55":56,"_57":-5,"_96":105,"_18":106},{"_36":89,"_13":90,"_39":91,"_41":-5,"_43":44,"_45":92,"_47":48,"_49":93,"_17":64,"_52":94,"_53":95,"_55":56,"_57":14,"_96":97,"_18":98},"5a5ee57b-69ee-414f-9125-633f1a12031f","main.ts","1ae3c4c2-89d0-11f1-8211-1607ee4eb77e",28,["D",1787603564789],"http","import { Hono } from \"https://esm.sh/hono@4.6.14\";\nimport { readProjectFile, serveProjectFile } from \"./backend/files.ts\";\nimport { lookupAvailability, lookupPricing } from \"./backend/porkbun.ts\";\nimport { lookupDomain } from \"./backend/rdap.ts\";\n\nconst app = new Hono();\n\n// Unwrap Hono errors to see original error details\napp.onError((err, _c) => {\n throw err;\n});\n\napp.get(\"/frontend/*\", (c) => serveProjectFile(c.req.path, import.meta.url));\n\napp.get(\"/api/lookup\", async (c) => {\n const query = c.req.query(\"domain\") ?? \"\";\n const result = await lookupDomain(query);\n return c.json(result, {\n // Registry data changes rarely; a short cache keeps repeat searches off the\n // registries without hiding a registration that just happened.\n headers: { \"cache-control\": result.status === \"error\" ? \"no-store\" : \"public, max-age=60\" },\n });\n});\n\n// Asks Porkbun whether it will sell this exact name, which is a different\n// question from RDAP's \"is there a registration record?\" and the only one that\n// can contradict it. The page blocks its verdict on this, so it stays a lone\n// fast call: no price list attached, and the answer is small enough that the\n// wait is Porkbun's round trip and nothing else. Only called for names the\n// registry reported as available — a registered name has nothing to learn here,\n// and the check is metered per account rather than per visitor.\napp.get(\"/api/availability\", async (c) => {\n const result = await lookupAvailability(c.req.query(\"domain\") ?? \"\");\n return c.json(result, {\n headers: {\n // No answer is not a cacheable fact — the next visitor should get a real\n // check rather than inherit a rate-limited silence.\n \"cache-control\": result.availability ? \"public, max-age=300\" : \"no-store\",\n },\n });\n});\n\n// Kept off the lookup path on purpose: Porkbun rebuilds its whole price list\n// per request and can take 20 seconds cold, which is no reason to hold up the\n// registry's answer — or the verdict above. Nobody waits on this unless they\n// ask for it, which the page makes a button.\napp.get(\"/api/pricing\", async (c) => {\n const result = await lookupPricing(c.req.query(\"domain\") ?? \"\");\n return c.json(result, {\n headers: {\n \"cache-control\": result.pricing ? \"public, max-age=3600\" : \"no-store\",\n },\n });\n});\n\napp.get(\"/\", async (c) => c.html(await readProjectFile(\"/frontend/index.html\", import.meta.url)));\n\nexport default app.fetch;\n","children",[],[90],"482c4167-2489-4dc5-8d09-755c0e9334ed","deno.json","b8c0f422-89d4-11f1-96e4-1607ee4eb77e",6,["D",1785168215020],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/98f62cee78e85bfc47c62ed703777c6bc8794f1c/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"include\": [\"deno:/https/esm.town/**/*\"],\n \"rules\": {\n \"exclude\": [\"no-explicit-any\"]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[],[100],"d5a0ab4b-8863-4b5f-8adc-b2afc548ac83","README.md","b8efa9a2-89d4-11f1-8c5f-1607ee4eb77e",30,["D",1787603564691],"# whois\n\nType a domain, find out whether it's registered. The answer comes from the\nregistry of record over [RDAP](https://www.icann.org/rdap) — the protocol ICANN\nrequires registries to run alongside WHOIS — rather than from a reseller's\ncached list.\n\n## How a lookup works\n\n1. `backend/rdap.ts` normalizes what was typed: pasted URLs lose their scheme\n and path, IDNs are punycoded, a leading `www.` is dropped.\n2. The TLD is resolved to an RDAP service through\n [IANA's bootstrap file](https://data.iana.org/rdap/dns.json), cached for 12\n hours per instance.\n3. `GET /domain/` decides it: `200` means registered and carries\n the record, `404` means the registry has no entry.\n\nA handful of registries run RDAP without appearing in the bootstrap file\n(`.ac`, `.de`, `.io`, `.sh`). Those are listed in `SUPPLEMENTAL_SERVICES`, each\nverified against a known-registered name in that exact TLD. Never point a TLD at\na service that isn't authoritative for it — a foreign service answers `404`, and\n`404` is what makes this site say \"available\".\n\nTLDs with no RDAP service at all (`.co`, `.me`, and other ccTLDs) return\n`unsupported` instead of a guess.\n\n## What it costs\n\n`GET /api/pricing?domain=` answers with Porkbun's list price for the name's\nsuffix — first year, renewal, and inbound transfer, in USD. Porkbun publishes\n[its whole price list](https://api.porkbun.com/api/json/v3/pricing/get)\nunauthenticated, so this needs no API key.\n\nTwo things shape how it's wired up:\n\n- **Nobody waits on it who didn't ask.** Porkbun rebuilds the entire 900-TLD\n list per request and measures 15–20 seconds cold, so this is neither part of\n `/api/lookup` nor fired on every search: the settled card offers a button, and\n only a visitor who presses it pays the wait. A shared 6-hour cache (plus\n in-flight de-duplication, since a 20-second fetch is long enough for visitors\n to pile up behind it) means only the first press pays it at all.\n- **The suffix is matched longest-first.** Porkbun sells some ccTLDs at the\n second level — `co.uk` is priced apart from `uk` — so `bbc.co.uk` is priced as\n `co.uk`, not `uk`.\n\nEntries marked `specialType: handshake` are dropped: those are Handshake names,\nwhich resolve outside ICANN DNS and so describe nothing this site can look up.\nThese are list prices for ordinary names; premium and reserved names are quoted\nper-domain. Losing this call costs the price panel and nothing else.\n\n## Whether you can actually buy it\n\nRDAP answers \"is there a registration record?\", which is not the question a\nvisitor is asking. Reserved, blocked and registry-held names own no RDAP object,\nso the registry reports `404` and the site reads that as available — correctly,\nand still misleadingly. `claude.run` is the example that prompted this: no\nregistry record, no DNS delegation, and not for sale.\n\nSet both of these to close the gap:\n\n```sh\nPORKBUN_API_KEY=pk1_...\nPORKBUN_SECRET_API_KEY=sk1_...\n```\n\nWith them set, `GET /api/availability?domain=` asks Porkbun's authenticated\n[`checkDomain`](https://porkbun.com/api/json/v3/documentation) whether it will\nsell that exact name and returns an `availability` block: `registrable`,\n`premium`, and the per-name price.\n\n**The page asks before it answers.** A name the registry has no record of gets\nrendered without a stamp — the card shows the domain, the source, and the plain\nfact that the registry holds no record, then says it is asking Porkbun. The\nstamp is pressed only once that comes back, so nobody is ever shown an\n**Available** that turns into a **Withheld** a second later. Which stamp lands\ndepends on the answer:\n\n| Porkbun says | Stamp | Verdict |\n| ----------------- | ------------- | --------------------------------------------------- |\n| won't sell it | **Withheld** | reserved, blocked, or registry-held — not yours to take |\n| will sell it | **Available** | confirmed registrable |\n| premium | **Available** | confirmed, with the per-name quote in the verdict |\n| nothing (see below) | **Available** | the registry's own hedged reading, unchanged |\n\nFour constraints shape it:\n\n- **The check is rationed.** Porkbun's default is one check per 10 seconds *per\n account*, not per caller, so every visitor shares one budget. Results are\n cached per name for 10 minutes, concurrent checks for the same name share one\n request, and a name that misses the cache while the window is shut simply goes\n unanswered rather than queueing behind it. A card is waiting on this: the\n registry's hedged answer now beats the confirmed one ten seconds late.\n- **It travels alone.** The check is a separate endpoint from the price list\n precisely because the verdict blocks on it. It carries one small question and\n answers in about a second; the list's cold 20-second rebuild stays behind its\n button where it can't hold up an answer.\n- **Only an `available` verdict spends a check.** That is the one answer a\n registrar can contradict; a name the registry already reports as registered\n has nothing to learn from asking.\n- **Silence is never a confirmation.** No credentials, gate shut, timeout, rate\n limit, or an unrecognised `avail` all return no `availability` at all, and the\n card falls back to exactly the hedged wording it used before the check\n existed. Only an explicit answer from Porkbun moves the verdict.\n\nWithout the credentials every name resolves to that last row, which is how the\npage behaved before any of this existed.\n\n## Files\n\n| Path | What it does |\n| --------------------- | -------------------------------------------------- |\n| `main.ts` | Hono app: static routes, `/api/lookup`, `/api/availability`, `/api/pricing` |\n| `backend/rdap.ts` | Bootstrap cache, normalization, RDAP record parsing |\n| `backend/porkbun.ts` | Per-name availability check, price-list cache, suffix matching |\n| `backend/files.ts` | Static file helpers, with a local-disk fallback |\n| `frontend/` | The page: HTML, CSS, and the renderer |\n| `shared/types.ts` | The API response contracts |\n\n## Running it\n\n```sh\nvt push # deploy to Val Town\ndeno run -A serve.ts # or preview locally, see below\n```\n\nFor a local preview, point Deno's server at the exported handler:\n\n```ts\nimport app from \"./main.ts\";\nDeno.serve({ port: 8787 }, app);\n```\n\n`backend/files.ts` reads from disk when it sees a `file://` URL, so the static\nroutes work outside Val Town too.\n",[],[108],"ca69b9ae-1cf9-4d6c-9a61-5651045b9f2b","AGENTS.md","b93476cc-89d4-11f1-aa0d-1607ee4eb77e",15,["D",1785168215146],"You are an advanced assistant specialized in generating Val Town code.\n\n## Core Guidelines\n\n- Ask clarifying questions when requirements are ambiguous\n- Provide complete, functional solutions rather than skeleton implementations\n- Test your logic against edge cases before presenting the final solution\n- Ensure all code follows Val Town's specific platform requirements\n- If a section of code that you're working on is getting too complex, consider refactoring it into subcomponents\n\n## Code Standards\n\n- Generate code in TypeScript or TSX\n- Add appropriate TypeScript types and interfaces for all data structures\n- Prefer official SDKs or libraries than writing API calls directly\n- Ask the user to supply API or library documentation if you are at all unsure about it\n- **Never bake in secrets into the code** - always use environment variables\n- Include comments explaining complex logic (avoid commenting obvious operations)\n- Follow modern ES6+ conventions and functional programming practices if possible\n\n## Types of triggers\n\n### 1. HTTP Trigger\n\n- Create web APIs and endpoints\n- Handle HTTP requests and responses\n- Example structure:\n\n```ts\nexport default async function (req: Request) {\n return new Response(\"Hello World\");\n}\n```\n\nFiles that are HTTP triggers have http in their name like `foobar.http.tsx`\n\n### 2. Cron Triggers\n\n- Run on a schedule\n- Use cron expressions for timing\n- Example structure:\n\n```ts\nexport default async function () {\n // Scheduled task code\n}\n```\n\nFiles that are Cron triggers have cron in their name like `foobar.cron.tsx`\n\n### 3. Email Triggers\n\n- Process incoming emails\n- Handle email-based workflows\n- Example structure:\n\n```ts\nexport default async function (email: Email) {\n // Process email\n}\n```\n\nFiles that are Email triggers have email in their name like `foobar.email.tsx`\n\n\n## Val Town Standard Libraries\n\nVal Town provides several hosted services and utility functions.\n\n### Blob Storage\n\n```ts\nimport { blob } from \"https://esm.town/v/std/blob\";\nawait blob.setJSON(\"myKey\", { hello: \"world\" });\nlet blobDemo = await blob.getJSON(\"myKey\");\nlet appKeys = await blob.list(\"app_\");\nawait blob.delete(\"myKey\");\n```\n\n### SQLite\n\n```ts\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nconst TABLE_NAME = 'todo_app_users_2';\n// Create table - do this before usage and change table name when modifying schema\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL\n)`);\n// Query data\nconst result = await sqlite.execute(`SELECT * FROM ${TABLE_NAME} WHERE id = ?`, [1]);\n```\n\nNote: When changing a SQLite table's schema, change the table's name (e.g., add _2 or _3) to create a fresh table.\n\n### OpenAI\n\n```ts\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\nconst openai = new OpenAI();\nconst completion = await openai.chat.completions.create({\n messages: [\n { role: \"user\", content: \"Say hello in a creative way\" },\n ],\n model: \"gpt-4o-mini\",\n max_tokens: 30,\n});\n```\n\n### Email\n\n```ts\nimport { email } from \"https://esm.town/v/std/email\";\n// By default emails the owner of the val\nawait email({ \n subject: \"Hi\", \n text: \"Hi\", \n html: \"

Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n",[],[116],"1c9e7a6c-9507-4148-bbd1-2fc34f94a828",".vtignore","b8c60a48-89d4-11f1-97dc-1607ee4eb77e",7,["D",1785168215096],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[],[124],"1e49960f-1466-46fa-a5e2-7137c8eecfb7","shared","b8698246-89d4-11f1-97dc-1607ee4eb77e",["D",1785168214472],[137],[132],{"_36":138,"_13":139,"_39":140,"_41":133,"_43":44,"_45":141,"_47":48,"_49":142,"_17":73,"_52":65,"_53":143,"_55":56,"_57":-5,"_96":144,"_18":145},"42a32d37-f183-42f4-bc77-a9c03186f6f3","types.ts","b8b6a26a-89d4-11f1-bf8b-1607ee4eb77e",27,["D",1787603564613],"/** Shape of the /api/lookup and /api/pricing responses. Kept in shared/ as the\n * contract the frontend renders against. */\n\nexport type LookupStatus =\n | \"registered\" // the registry returned a record\n | \"available\" // the registry has no record for this name\n | \"unsupported\" // no RDAP service is published for this TLD\n | \"invalid\" // the input isn't a domain name we can query\n | \"error\"; // the registry failed to answer\n\nexport interface DomainRecord {\n registrar?: string;\n registrarIanaId?: string;\n registered?: string;\n expires?: string;\n updated?: string;\n statuses: string[];\n nameservers: string[];\n dnssec?: boolean;\n}\n\nexport interface DomainPricing {\n /** The suffix Porkbun prices. Some ccTLDs are sold at the second level, so\n * this can be two labels (`co.uk`) rather than the bare TLD. */\n suffix: string;\n /** First-year price. Often promotional, and often below the renewal. */\n registration?: number;\n /** What the name costs every year after the first. */\n renewal?: number;\n /** Price to move an existing registration in, usually a year included. */\n transfer?: number;\n /** ISO 4217 code for the amounts above. */\n currency: string;\n}\n\nexport interface LookupResult {\n /** What the visitor typed. */\n query: string;\n /** The normalized, punycoded name that was queried. */\n domain: string;\n /** Unicode form, when the name was an IDN. */\n unicodeName?: string;\n tld: string;\n status: LookupStatus;\n /** Hostname of the RDAP service that answered. */\n source?: string;\n /** UTC timestamp of the answer. */\n answeredAt?: string;\n record?: DomainRecord;\n /** Human-readable explanation for invalid, unsupported, and error results. */\n message?: string;\n /** Caveat worth showing alongside an otherwise good answer. */\n note?: string;\n}\n\n/**\n * Porkbun's answer to \"will you sell me this exact name?\", which is a different\n * question from RDAP's \"is there a registration record?\". Reserved, blocked and\n * registry-held names have no RDAP object, so they read as available there\n * while a registrar still refuses them.\n */\nexport interface DomainAvailability {\n /** Porkbun will sell it. False means it exists, is reserved, or is withheld. */\n registrable: boolean;\n /** Registry-tier premium, priced per-name rather than off the list. */\n premium: boolean;\n /** Per-name first-year price. Differs from the list price on premium names. */\n price?: number;\n /** The same name's price once any first-year promotion lapses. */\n regularPrice?: number;\n /** Whether `price` is a promotional first-year rate. */\n firstYearPromo?: boolean;\n /** Years the registry makes you buy up front, when it insists on more than one. */\n minDuration?: number;\n /** UTC timestamp of the check. */\n checkedAt: string;\n}\n\nexport interface PricingResult {\n /** The normalized name the price was matched against. */\n domain: string;\n /** Absent when Porkbun doesn't sell the suffix, or didn't answer in time. */\n pricing?: DomainPricing;\n}\n\nexport interface AvailabilityResult {\n /** The normalized name that was checked. */\n domain: string;\n /**\n * Absent whenever the check didn't run or didn't answer — no credentials,\n * rate-limited, timed out, or an error. Absent means \"unknown\", never\n * \"registrable\": only an explicit answer from Porkbun sets this.\n */\n availability?: DomainAvailability;\n}\n",[],[132,139],["D",1785168214803],[149,150,151],[19],{"_36":68,"_13":69,"_39":70,"_41":42,"_43":44,"_45":71,"_47":48,"_49":158,"_17":73,"_52":24,"_53":74,"_55":56,"_57":-5,"_96":159,"_18":160},{"_36":59,"_13":60,"_39":61,"_41":42,"_43":44,"_45":62,"_47":48,"_49":155,"_17":64,"_52":65,"_53":66,"_55":56,"_57":-5,"_96":156,"_18":157},{"_36":37,"_13":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":152,"_17":51,"_52":24,"_53":54,"_55":56,"_57":-5,"_96":153,"_18":154},["D",1787603564596],[],[19,38],["D",1787607349389],[],[19,60],["D",1787604523827],[],[19,69],"57fa537f-e8b3-4f1e-b82d-2babea12af78","backend","b87e942e-89d4-11f1-97dc-1607ee4eb77e",["D",1785168214649],[167,168,169],[162],{"_36":187,"_13":188,"_39":189,"_41":163,"_43":44,"_45":190,"_47":48,"_49":191,"_17":78,"_52":65,"_53":192,"_55":56,"_57":-5,"_96":193,"_18":194},{"_36":178,"_13":179,"_39":180,"_41":163,"_43":44,"_45":181,"_47":48,"_49":182,"_17":183,"_52":65,"_53":184,"_55":56,"_57":-5,"_96":185,"_18":186},{"_36":170,"_13":171,"_39":172,"_41":163,"_43":44,"_45":173,"_47":48,"_49":174,"_17":78,"_52":65,"_53":175,"_55":56,"_57":-5,"_96":176,"_18":177},"62a20e79-1d40-4355-836c-5dc3f1dc3c54","rdap.ts","b8d99310-89d4-11f1-aa02-1607ee4eb77e",10,["D",1785168215079],"import type { DomainRecord, LookupResult } from \"../shared/types.ts\";\n\n/** ICANN/IANA's authoritative map of TLD -> RDAP service. */\nconst BOOTSTRAP_URL = \"https://data.iana.org/rdap/dns.json\";\nconst BOOTSTRAP_TTL_MS = 12 * 60 * 60 * 1000;\nconst REQUEST_TIMEOUT_MS = 10_000;\n\n/**\n * Registries that run RDAP but that IANA's bootstrap file doesn't list.\n * Each entry was checked against a known-registered name in that exact TLD.\n * Never point a TLD at a service that isn't authoritative for it: a foreign\n * RDAP service answers 404, and 404 is how we read \"available\".\n */\nconst SUPPLEMENTAL_SERVICES: Record = {\n ac: \"https://rdap.identitydigital.services/rdap/\",\n de: \"https://rdap.denic.de/\",\n io: \"https://rdap.identitydigital.services/rdap/\",\n sh: \"https://rdap.identitydigital.services/rdap/\",\n};\n\ninterface BootstrapFile {\n publication: string;\n services: [string[], string[]][];\n}\n\nlet bootstrapCache: { fetchedAt: number; map: Map } | null = null;\n\nasync function getServiceMap(): Promise> {\n if (bootstrapCache && Date.now() - bootstrapCache.fetchedAt < BOOTSTRAP_TTL_MS) {\n return bootstrapCache.map;\n }\n\n const res = await fetch(BOOTSTRAP_URL, {\n signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n });\n if (!res.ok) throw new Error(`IANA bootstrap returned ${res.status}`);\n const bootstrap = (await res.json()) as BootstrapFile;\n\n const map = new Map();\n for (const [tlds, urls] of bootstrap.services) {\n const base = urls.find((u) => u.startsWith(\"https://\")) ?? urls[0];\n if (!base) continue;\n for (const tld of tlds) map.set(tld.toLowerCase(), base);\n }\n for (const [tld, base] of Object.entries(SUPPLEMENTAL_SERVICES)) {\n if (!map.has(tld)) map.set(tld, base);\n }\n\n bootstrapCache = { fetchedAt: Date.now(), map };\n return map;\n}\n\ninterface NormalizedDomain {\n domain: string;\n unicodeName?: string;\n tld: string;\n labelCount: number;\n}\n\n/**\n * Reduce whatever was typed to an ASCII (punycoded) domain name. Accepts pasted\n * URLs and IDNs; drops a leading \"www.\" since it is never registrable itself.\n */\nexport function normalizeDomain(input: string): NormalizedDomain | { error: string } {\n const raw = input.trim().replace(/^[a-z][a-z0-9+.-]*:\\/\\//i, \"\").split(/[/?#]/)[0]\n .replace(/\\.$/, \"\");\n if (!raw) return { error: \"Enter a domain name to look up.\" };\n\n let hostname: string;\n try {\n hostname = new URL(`http://${raw}`).hostname;\n } catch {\n return { error: `\"${input.trim()}\" isn't a domain name.` };\n }\n\n const domain = hostname.replace(/^www\\./, \"\");\n const labels = domain.split(\".\");\n if (labels.length < 2) {\n return { error: `Add a top-level domain — try \"${domain}.com\".` };\n }\n if (domain.length > 253 || labels.some((l) => !/^[a-z0-9-]{1,63}$/.test(l))) {\n return { error: `\"${input.trim()}\" isn't a domain name.` };\n }\n\n // URL() punycodes IDNs one way only, so keep what was typed as the unicode form.\n const typed = raw.toLowerCase().replace(/^www\\./, \"\");\n const unicodeName = domain.includes(\"xn--\") && typed !== domain ? typed : undefined;\n return { domain, unicodeName, tld: labels[labels.length - 1], labelCount: labels.length };\n}\n\nexport async function lookupDomain(query: string): Promise {\n const normalized = normalizeDomain(query);\n if (\"error\" in normalized) {\n return { query, domain: \"\", tld: \"\", status: \"invalid\", message: normalized.error };\n }\n\n const { domain, unicodeName, tld, labelCount } = normalized;\n const base = { query, domain, unicodeName, tld };\n\n const services = await getServiceMap();\n const service = services.get(tld);\n if (!service) {\n return {\n ...base,\n status: \"unsupported\",\n message:\n `IANA publishes no RDAP service for .${tld}, so the registry can't be asked directly.`,\n };\n }\n\n const url = `${service.replace(/\\/?$/, \"/\")}domain/${encodeURIComponent(domain)}`;\n const source = new URL(url).hostname;\n const answeredAt = new Date().toISOString();\n\n let res: Response;\n try {\n res = await fetch(url, {\n headers: { accept: \"application/rdap+json, application/json\" },\n signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),\n });\n } catch (err) {\n // A registry that is slow or down is a normal outcome here, not a bug to\n // surface as a 500 — the visitor needs to know who failed to answer.\n const reason = err instanceof DOMException && err.name === \"TimeoutError\"\n ? `${source} took longer than ${REQUEST_TIMEOUT_MS / 1000} seconds to answer.`\n : `${source} couldn't be reached.`;\n return { ...base, status: \"error\", source, message: reason };\n }\n\n if (res.status === 404) {\n return {\n ...base,\n status: \"available\",\n source,\n answeredAt,\n note: labelCount > 2\n ? `${domain} has ${labelCount} labels. If it's a subdomain, look up the name it sits under instead.`\n : undefined,\n };\n }\n\n if (res.status === 429) {\n return {\n ...base,\n status: \"error\",\n source,\n message: `${source} is rate-limiting lookups. Wait a moment and search again.`,\n };\n }\n\n if (!res.ok) {\n return {\n ...base,\n status: \"error\",\n source,\n message: `${source} answered ${res.status} ${res.statusText}.`.trim(),\n };\n }\n\n const data = await res.json();\n if (data?.errorCode === 404) {\n return { ...base, status: \"available\", source, answeredAt };\n }\n\n return {\n ...base,\n domain: typeof data?.ldhName === \"string\" ? data.ldhName.toLowerCase() : domain,\n unicodeName: typeof data?.unicodeName === \"string\" ? data.unicodeName : unicodeName,\n status: \"registered\",\n source,\n answeredAt,\n record: parseRecord(data),\n };\n}\n\nfunction parseRecord(data: any): DomainRecord {\n const registrar = (data?.entities ?? []).find((e: any) => e?.roles?.includes(\"registrar\"));\n\n return {\n registrar: vcardValue(registrar?.vcardArray, \"fn\"),\n registrarIanaId: (registrar?.publicIds ?? []).find((id: any) =>\n id?.type === \"IANA Registrar ID\"\n )?.identifier,\n registered: eventDate(data, \"registration\"),\n expires: eventDate(data, \"expiration\"),\n updated: eventDate(data, \"last changed\"),\n statuses: (data?.status ?? []).filter((s: unknown) => typeof s === \"string\"),\n nameservers: (data?.nameservers ?? [])\n .map((ns: any) => typeof ns?.ldhName === \"string\" ? ns.ldhName.toLowerCase() : null)\n .filter(Boolean),\n dnssec: data?.secureDNS?.delegationSigned ?? undefined,\n };\n}\n\nfunction eventDate(data: any, action: string): string | undefined {\n const event = (data?.events ?? []).find((e: any) => e?.eventAction === action);\n return typeof event?.eventDate === \"string\" ? event.eventDate : undefined;\n}\n\n/** vCard entries are [\"fn\", {}, \"text\", \"Registrar Name\"] tuples. */\nfunction vcardValue(vcardArray: any, field: string): string | undefined {\n const entry = (vcardArray?.[1] ?? []).find((e: any) => e?.[0] === field);\n const value = entry?.[3];\n return typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n",[],[162,171],"d6be8105-2462-431d-9e07-55d091f81db8","porkbun.ts","5303dab6-9ff8-11f1-8157-1607ee4eb77e",29,["D",1787603564724],1,"import type {\n AvailabilityResult,\n DomainAvailability,\n DomainPricing,\n PricingResult,\n} from \"../shared/types.ts\";\nimport { normalizeDomain } from \"./rdap.ts\";\n\n/**\n * Porkbun publishes its whole retail price list unauthenticated, so a lookup\n * can carry a price without asking anyone for an API key. These are list\n * prices for ordinary names: premium and reserved names are quoted per-domain\n * and only Porkbun's authenticated checkDomain endpoint knows those.\n */\nconst PRICING_URL = \"https://api.porkbun.com/api/json/v3/pricing/get\";\nconst PRICING_TTL_MS = 6 * 60 * 60 * 1000;\n/** Per-name availability, unlike the list above, needs credentials. */\nconst CHECK_URL = \"https://api.porkbun.com/api/json/v3/domain/checkDomain/\";\nconst CHECK_TTL_MS = 10 * 60 * 1000;\n/** Tighter than it looks: the page holds its verdict until this answers, so\n * every second here is a second the visitor stares at an unfinished card.\n * Porkbun normally answers in about a second; past ten it isn't going to. */\nconst CHECK_TIMEOUT_MS = 10_000;\n/** Porkbun's documented default is one check per 10 seconds per account, and it\n * is billed against the account rather than the caller, so a burst of visitors\n * shares one budget. Assume the default until a response tells us otherwise. */\nconst DEFAULT_CHECK_WINDOW_MS = 10_000;\n/** Generous on purpose: Porkbun builds the whole 900-TLD list per request and\n * measures 15-20 seconds cold. Only the request that misses the cache waits. */\nconst REQUEST_TIMEOUT_MS = 30_000;\n\ninterface PricingResponse {\n status: string;\n pricing: Record;\n}\n\nlet cache: { fetchedAt: number; prices: Map } | null = null;\nlet inflight: Promise> | null = null;\n\nfunction getPrices(): Promise> {\n if (cache && Date.now() - cache.fetchedAt < PRICING_TTL_MS) return Promise.resolve(cache.prices);\n // That 15-20 second fetch is long enough that several visitors can pile up\n // behind it. They should share one request, not start their own.\n inflight ??= fetchPrices().finally(() => inflight = null);\n return inflight;\n}\n\nasync function fetchPrices(): Promise> {\n const res = await fetch(PRICING_URL, { signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });\n if (!res.ok) throw new Error(`Porkbun pricing returned ${res.status}`);\n const body = (await res.json()) as PricingResponse;\n if (body?.status !== \"SUCCESS\") throw new Error(`Porkbun pricing returned ${body?.status}`);\n\n const prices = new Map();\n for (const [rawSuffix, entry] of Object.entries(body.pricing ?? {})) {\n // Handshake names resolve outside ICANN DNS, so their prices describe\n // something this site can't look up in a registry.\n if (entry?.specialType === \"handshake\") continue;\n\n const suffix = rawSuffix.toLowerCase();\n const registration = amount(entry?.registration);\n const renewal = amount(entry?.renewal);\n const transfer = amount(entry?.transfer);\n if (registration === undefined && renewal === undefined) continue;\n\n prices.set(suffix, { suffix, registration, renewal, transfer, currency: \"USD\" });\n }\n\n cache = { fetchedAt: Date.now(), prices };\n return prices;\n}\n\nfunction amount(value: unknown): number | undefined {\n if (typeof value !== \"string\" || !value.trim()) return undefined;\n const price = Number(value);\n return Number.isFinite(price) ? price : undefined;\n}\n\ninterface CheckResponse {\n status: string;\n message?: string;\n code?: string;\n ttlRemaining?: number;\n response?: {\n avail?: string;\n price?: string;\n regularPrice?: string;\n firstYearPromo?: string;\n premium?: string;\n minDuration?: number;\n };\n limits?: { TTL?: number; limit?: number; used?: number };\n}\n\nconst checkCache = new Map();\nconst checkInflight = new Map>();\n/** Closed until this moment to stay inside Porkbun's per-account check budget. */\nlet checkGateUntil = 0;\n\n/** Absent credentials disable the check rather than failing the request: the\n * registry answer is the product, and this only annotates it. */\nfunction credentials(): { apikey: string; secretapikey: string } | null {\n const apikey = readEnv(\"PORKBUN_API_KEY\");\n const secretapikey = readEnv(\"PORKBUN_SECRET_API_KEY\");\n return apikey && secretapikey ? { apikey, secretapikey } : null;\n}\n\nfunction readEnv(name: string): string | undefined {\n try {\n return Deno.env.get(name) || undefined;\n } catch {\n return undefined; // no env access in this runtime\n }\n}\n\n/**\n * Ask Porkbun whether it will actually sell this exact name.\n *\n * Returns undefined for every \"we don't know\" case — no credentials, gate\n * closed, timeout, error, or an `avail` we don't recognise. Undefined must stay\n * indistinguishable from \"not asked\", because the caller renders a contradiction\n * of the registry's verdict and may only do that on an explicit answer.\n */\nexport async function checkAvailability(domain: string): Promise {\n const auth = credentials();\n if (!auth) return undefined;\n\n const cached = checkCache.get(domain);\n if (cached && Date.now() - cached.checkedAt < CHECK_TTL_MS) return cached.availability;\n\n const pending = checkInflight.get(domain);\n if (pending) return pending;\n\n // One check per window across the whole account, so a name that misses the\n // cache while the gate is shut goes unanswered rather than queueing up behind\n // it. The page is holding a verdict open on this: better to hand back the\n // registry's own hedged answer now than the confirmed one ten seconds late.\n if (Date.now() < checkGateUntil) return undefined;\n checkGateUntil = Date.now() + DEFAULT_CHECK_WINDOW_MS; // shut it before awaiting\n\n const request = runCheck(domain, auth).finally(() => checkInflight.delete(domain));\n checkInflight.set(domain, request);\n return request;\n}\n\nasync function runCheck(\n domain: string,\n auth: { apikey: string; secretapikey: string },\n): Promise {\n let body: CheckResponse;\n try {\n const res = await fetch(`${CHECK_URL}${encodeURIComponent(domain)}`, {\n method: \"POST\",\n headers: { \"content-type\": \"application/json\" },\n body: JSON.stringify(auth),\n signal: AbortSignal.timeout(CHECK_TIMEOUT_MS),\n });\n // Porkbun reports a tripped rate limit as both 429 and a 200 whose status is\n // ERROR, so the body is what decides — but a 429 carries no useful body.\n if (res.status === 429) {\n checkGateUntil = Date.now() + DEFAULT_CHECK_WINDOW_MS;\n return undefined;\n }\n body = (await res.json()) as CheckResponse;\n } catch {\n return undefined;\n }\n\n // A window we were told about beats the assumed default.\n const windowMs = (body.limits?.TTL ?? body.ttlRemaining ?? 0) * 1000;\n if (windowMs > 0) checkGateUntil = Date.now() + windowMs;\n\n const avail = body.response?.avail;\n if (body.status !== \"SUCCESS\" || (avail !== \"yes\" && avail !== \"no\")) return undefined;\n\n const availability: DomainAvailability = {\n registrable: avail === \"yes\",\n premium: body.response?.premium === \"yes\",\n price: amount(body.response?.price),\n regularPrice: amount(body.response?.regularPrice),\n firstYearPromo: body.response?.firstYearPromo === \"yes\",\n minDuration: typeof body.response?.minDuration === \"number\" && body.response.minDuration > 1\n ? body.response.minDuration\n : undefined,\n checkedAt: new Date().toISOString(),\n };\n\n checkCache.set(domain, { checkedAt: Date.now(), availability });\n return availability;\n}\n\n/**\n * Ask Porkbun about one specific name. Deliberately separate from the pricing\n * lookup below: this one answers in about a second and the page waits on it\n * before it will call a name available, while the price list can take twenty\n * seconds to build and nothing waits on it.\n */\nexport async function lookupAvailability(query: string): Promise {\n const normalized = normalizeDomain(query);\n if (\"error\" in normalized) return { domain: \"\" };\n const { domain } = normalized;\n return { domain, availability: await checkAvailability(domain) };\n}\n\n/**\n * Price the name the visitor typed. Porkbun sells some ccTLDs at the second\n * level — `co.uk` is its own line item, priced apart from `uk` — so match the\n * longest suffix of the name that it actually lists.\n */\nexport async function lookupPricing(query: string): Promise {\n const normalized = normalizeDomain(query);\n if (\"error\" in normalized) return { domain: \"\" };\n const { domain } = normalized;\n\n // A price is a garnish on the registry answer. If Porkbun is down or slow,\n // the visitor still keeps the thing they came for.\n const prices = await getPrices().catch(() => null);\n return { domain, pricing: prices ? matchSuffix(domain, prices) : undefined };\n}\n\nfunction matchSuffix(domain: string, prices: Map): DomainPricing | undefined {\n const labels = domain.split(\".\");\n for (let i = 1; i < labels.length; i++) {\n const pricing = prices.get(labels.slice(i).join(\".\"));\n if (pricing) return pricing;\n }\n return undefined;\n}\n",[],[162,179],"163aa5f4-c617-4f00-bba3-c0982dde2551","files.ts","b8cc58f8-89d4-11f1-9e1f-1607ee4eb77e",8,["D",1785168215152],"import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n\n/**\n * Val Town's file helpers resolve project files through the esm.town URL of the\n * running val, which doesn't exist when the same code runs from disk. These\n * wrappers keep `deno run` working for local preview; on Val Town they hand off\n * to the standard helpers untouched.\n */\n\nconst CONTENT_TYPES: Record = {\n css: \"text/css; charset=utf-8\",\n html: \"text/html; charset=utf-8\",\n js: \"text/javascript; charset=utf-8\",\n json: \"application/json; charset=utf-8\",\n svg: \"image/svg+xml\",\n};\n\nconst isLocal = (metaUrl: string) => metaUrl.startsWith(\"file://\");\n\nexport function readProjectFile(path: string, metaUrl: string): Promise {\n if (!isLocal(metaUrl)) return readFile(path, metaUrl);\n return Deno.readTextFile(new URL(`.${path}`, metaUrl));\n}\n\nexport async function serveProjectFile(path: string, metaUrl: string): Promise {\n if (!isLocal(metaUrl)) return serveFile(path, metaUrl);\n\n const body = await Deno.readTextFile(new URL(`.${path}`, metaUrl)).catch(() => null);\n if (body === null) return new Response(\"Not found\", { status: 404 });\n\n const extension = path.split(\".\").pop() ?? \"\";\n return new Response(body, {\n headers: { \"content-type\": CONTENT_TYPES[extension] ?? \"text/plain; charset=utf-8\" },\n });\n}\n",[],[162,188],"a00dc9e7-a23e-4397-a1f9-3cf4c617a61f",["D",1785166232232],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","b8f52b40-db4b-11ef-9fdc-e7ba3d98ed08","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","c0309a09-c920-43c3-9d64-1db94f641c1a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_248":244},"org",{"_11":12,"_242":-5,"_243":244,"_205":206,"_245":246,"_247":56},"branch",{"_17":62,"_13":16,"_36":44,"_234":195,"_235":-5,"_236":-5,"_237":-5,"_238":-5,"_239":-5,"_240":14,"_241":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yczhIY1pIYWJ5ZnVPVjgxM0R2OENRWTJlTW0ifQ","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":195,"_13":14,"_49":329,"_197":-5,"_198":56,"_199":200,"_201":200,"_202":203,"_204":-5,"_205":206,"_207":91,"_208":48,"_209":-5,"_210":-5,"_211":183,"_212":213,"_214":-5,"_215":-5,"_216":-5,"_217":-5,"_218":219,"_220":219,"_221":222,"_223":222,"_224":222,"_225":219,"_226":219,"_227":330,"_229":331,"_231":332,"_233":56},[284,288,292,294,295,296,297,298],"files",[284,285,286,287,288,289,290,291,292,293,294,295,296,297,298],"counts",{"_275":78,"_276":183,"_277":78,"_32":278,"_279":280},[269,270,271],{"_36":76,"_13":19,"_39":42,"_41":-5,"_43":44,"_45":64,"_47":48,"_49":77,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_18":268},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},[19],{"_36":68,"_13":69,"_39":70,"_41":42,"_43":44,"_45":71,"_47":48,"_49":72,"_17":73,"_52":24,"_53":74,"_55":56,"_57":-5,"_18":274},{"_36":59,"_13":60,"_39":61,"_41":42,"_43":44,"_45":62,"_47":48,"_49":63,"_17":64,"_52":65,"_53":66,"_55":56,"_57":-5,"_18":273},{"_36":37,"_13":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_17":51,"_52":24,"_53":54,"_55":56,"_57":-5,"_18":272},[19,38],[19,60],[19,69],"pulls","branches","forks",{"_281":73,"_283":78},"connections",{"_281":78,"_282":78},"count","unfilledCount","emptyCount",{"_36":161,"_13":162,"_39":163,"_41":-5,"_43":44,"_45":51,"_47":48,"_49":164,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":327,"_18":328},{"_36":187,"_13":188,"_39":189,"_41":163,"_43":44,"_45":190,"_47":48,"_49":191,"_17":78,"_52":65,"_53":192,"_55":56,"_57":-5,"_96":325,"_18":326},{"_36":178,"_13":179,"_39":180,"_41":163,"_43":44,"_45":181,"_47":48,"_49":182,"_17":183,"_52":65,"_53":184,"_55":56,"_57":-5,"_96":323,"_18":324},{"_36":170,"_13":171,"_39":172,"_41":163,"_43":44,"_45":173,"_47":48,"_49":174,"_17":78,"_52":65,"_53":175,"_55":56,"_57":-5,"_96":321,"_18":322},{"_36":76,"_13":19,"_39":42,"_41":-5,"_43":44,"_45":64,"_47":48,"_49":146,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":319,"_18":320},{"_36":68,"_13":69,"_39":70,"_41":42,"_43":44,"_45":71,"_47":48,"_49":158,"_17":73,"_52":24,"_53":74,"_55":56,"_57":-5,"_96":317,"_18":318},{"_36":59,"_13":60,"_39":61,"_41":42,"_43":44,"_45":62,"_47":48,"_49":155,"_17":64,"_52":65,"_53":66,"_55":56,"_57":-5,"_96":315,"_18":316},{"_36":37,"_13":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":152,"_17":51,"_52":24,"_53":54,"_55":56,"_57":-5,"_96":313,"_18":314},{"_36":131,"_13":132,"_39":133,"_41":-5,"_43":44,"_45":73,"_47":48,"_49":134,"_17":78,"_52":79,"_53":-5,"_55":56,"_57":-5,"_96":311,"_18":312},{"_36":138,"_13":139,"_39":140,"_41":133,"_43":44,"_45":141,"_47":48,"_49":142,"_17":73,"_52":65,"_53":143,"_55":56,"_57":-5,"_96":309,"_18":310},{"_36":123,"_13":124,"_39":125,"_41":-5,"_43":44,"_45":126,"_47":48,"_49":127,"_17":78,"_52":24,"_53":128,"_55":56,"_57":-5,"_96":307,"_18":308},{"_36":115,"_13":116,"_39":117,"_41":-5,"_43":44,"_45":118,"_47":48,"_49":119,"_17":78,"_52":24,"_53":120,"_55":56,"_57":-5,"_96":305,"_18":306},{"_36":107,"_13":108,"_39":109,"_41":-5,"_43":44,"_45":110,"_47":48,"_49":111,"_17":73,"_52":24,"_53":112,"_55":56,"_57":-5,"_96":303,"_18":304},{"_36":99,"_13":100,"_39":101,"_41":-5,"_43":44,"_45":102,"_47":48,"_49":103,"_17":78,"_52":24,"_53":104,"_55":56,"_57":-5,"_96":301,"_18":302},{"_36":89,"_13":90,"_39":91,"_41":-5,"_43":44,"_45":92,"_47":48,"_49":93,"_17":64,"_52":94,"_53":95,"_55":56,"_57":14,"_96":299,"_18":300},[],[90],[],[100],[],[108],[],[116],[],[124],[],[132,139],[293],[132],[],[19,38],[],[19,60],[],[19,69],[289,290,291],[19],[],[162,171],[],[162,179],[],[162,188],[285,286,287],[162],["D",1785166232232],{"_11":12,"_248":244},{"_11":12,"_242":-5,"_243":244,"_205":206,"_245":246,"_247":56},{"_17":62,"_13":16,"_36":44,"_234":195,"_235":-5,"_236":-5,"_237":-5,"_238":-5,"_239":-5,"_240":14,"_241":12},"ctx",{"_227":-5,"_265":366,"_367":368,"_369":370,"_371":56,"_372":56,"_373":56,"_374":48,"_375":-5,"_376":-7,"_377":-7,"_378":78,"_379":56,"_380":56,"_381":-5,"_382":56,"_383":56,"_384":56,"_385":-5},"ENV",{"_337":338,"_339":340,"_341":16,"_342":343,"_344":345,"_346":347,"_348":349,"_350":351,"_352":353,"_354":355,"_356":357,"_358":359,"_360":361,"_362":363,"_364":365},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]