${sport.toUpperCase()}

\n \n ${games\n .map((game) => {\n const clock = shiftByOffset(new Date(game.start_time), clientOffsetSeconds).toLocaleTimeString(\n \"en-US\",\n { timeZone: \"UTC\", hour: \"numeric\", minute: \"2-digit\" },\n );\n const time = `${clock} ${offsetLabel(clientOffsetSeconds)}`;\n const ch = game.channel;\n const channelText =\n ch.category === \"unknown\"\n ? \"TBD\"\n : `${ch.name}${ch.directv_channel ? ` · DirecTV ${ch.directv_channel}` : ch.note ? ` (${ch.note})` : \"\"}`;\n return ``;\n })\n .join(\"\")}\n

${game.away} @ ${game.home}

${time}

${channelText}

`,\n )\n .join(\"\");\n\n const body = bySport.length ? rows : `

No games ${dateLabel}.

`;\n\n return `

${dateLabel[0].toUpperCase()}${dateLabel.slice(1)}'s Games

${body}`;\n}\n\nexport function renderHtml(bySport: GamesBySport, dateLabel: string, clientOffsetSeconds?: number): Response {\n return new Response(htmlDocument(bySport, dateLabel, clientOffsetSeconds), {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n",[18,138],"b7b5dcab-6220-4da3-8727-8217ca8ee05f",["D",1788126433161],"// The helper's server-rendered config picker — plain HTML forms, no\n// client-side JS, the same \"template string\" shape render/html.ts already\n// uses for the games view. Every `config*Document` export here is pure and\n// is what the tests assert against; main.ts wraps each in a Response\n// (Hono's `c.html`).\n//\n// Checkboxes are generated from lib/catalog.ts's SPORTS/TEAMS — the same\n// tables lib/params.ts validates `/`'s sports[]/teams[] against. That's what\n// makes an invalid selection structurally hard to submit here, rather than\n// something a second validator has to catch on write. See\n// docs/widget-config-plan.md's \"Validation\" section for why there's\n// deliberately no rejection/echo mechanism on this page: the real safety net\n// is resolveParams, which still runs when /config/resolve's redirect lands\n// on `/`.\n//\n// ---- one page per concern, not one page for everything ----\n//\n// This used to be a single `configPageDocument` rendering the settings\n// form, the pairing-code section, and the device list all inline on\n// GET/POST /config/:id — every helper action landed back on that one\n// giant page. It's now four documents behind four routes (main.ts):\n// GET /config (configIndexDocument, every config row), GET/POST /config/:id\n// (configSettingsDocument, the sports/teams form only), GET /config/:id/devices\n// (configDevicesDocument, list + rename), and GET /config/:id/pair plus\n// POST /config/:id/code (configPairDocument, mint/show a code). The three\n// id-scoped documents share one persistent top nav (`configNav`) so a\n// helper can move between them without going back through the index.\n// GET /config/new keeps its own document (configNewDocument): there's no\n// id yet to hang a nav on, and nothing paired or codeable until the config\n// is actually saved.\n\nimport { SPORTS, TEAMS } from \"../lib/catalog.ts\";\nimport { type StoredConfig } from \"../lib/config.ts\";\nimport { titleCase } from \"../lib/text.ts\";\n\n// Deliberately not imported from lib/configStore.ts (the module that\n// actually produces these) — this file stays decoupled from the impure\n// sqlite layer the same way it's decoupled from Sleeper, matching the\n// StoredConfig-from-lib/config.ts pattern below.\nexport type PairedDeviceView = { deviceId: string; name: string | null };\n\n// What GET /config lists — one row per config, enough to tell them apart\n// without opening each one. `deviceCount` is the only field that isn't a\n// direct column read (lib/configStore.ts's listAllConfigs joins it), kept\n// here anyway since disambiguating configs is this page's entire job.\nexport type ConfigRow = {\n id: string;\n sports: string[];\n teams: string[];\n updatedAt: string;\n deviceCount: number;\n};\n\n// device names and ids both originate as free-form input from whatever\n// called POST /pair, not from the closed catalogs sports/team checkboxes\n// draw from — so, unlike most of this file, they need escaping before\n// landing in HTML. Config ids are UUIDs this val mints itself\n// (crypto.randomUUID() in lib/configStore.ts), never free text, so they're\n// interpolated as-is everywhere below, same as formAction always has been.\nfunction escapeHtml(value: string): string {\n return value.replace(/&/g, \"&\").replace(//g, \">\").replace(/\"/g, \""\");\n}\n\nfunction sportCheckboxes(selected: string[]): string {\n return SPORTS.map((sport) => {\n const checked = selected.includes(sport) ? \" checked\" : \"\";\n return ` ${sport.toUpperCase()}`;\n }).join(\" \");\n}\n\n// Grouped by sport (SPORTS order) rather than one flat ~110-entry list —\n// the same \"pick a sport, then a team\" structure widget-ios-brief.md\n// explicitly rejected for the *receiver's* seven-team picker doesn't apply\n// here: the helper is choosing from the full catalog, not a small starter\n// list, and a flat list of 110 checkboxes is the harder one to scan.\nfunction teamCheckboxesBySport(selected: string[]): string {\n return SPORTS.map((sport) => {\n const slugs = Object.entries(TEAMS)\n .filter(([, ref]) => ref.sport === sport)\n .map(([slug]) => slug);\n if (!slugs.length) return \"\";\n const boxes = slugs\n .map((slug) => {\n const checked = selected.includes(slug) ? \" checked\" : \"\";\n return ` ${titleCase(slug)}`;\n })\n .join(\" \");\n return `

${sport.toUpperCase()}${boxes}

`;\n }).join(\"\");\n}\n\n// The index's one-line summary of what a config actually resolves to —\n// same \"empty means all sports, teams beat sports\" precedence buildResolvedUrl\n// (lib/config.ts) and `/`'s resolveParams apply at request time, just\n// described in words instead of computed into a redirect.\nfunction summarizeSelection(config: StoredConfig): string {\n if (config.teams.length) return config.teams.map((slug) => titleCase(slug)).join(\", \");\n if (config.sports.length) return config.sports.map((sport) => sport.toUpperCase()).join(\", \");\n return \"All sports\";\n}\n\n// One row per paired device, each its own form so naming one doesn't\n// require re-submitting the others. Blank means never named — the\n// placeholder, not a value, so an unnamed device saves as null rather than\n// the literal placeholder text.\nfunction deviceListMarkup(devices: PairedDeviceView[], actionPath: (deviceId: string) => string): string {\n if (!devices.length) return \"

No devices paired yet.

\";\n const rows = devices\n .map((device) => {\n const safeId = escapeHtml(device.deviceId);\n const safeName = device.name ? escapeHtml(device.name) : \"\";\n return `

\n \n

`;\n })\n .join(\"\");\n return `

${rows}`;\n}\n\nconst PAGE_STYLE = `\n body { font-family: system-ui, -apple-system, sans-serif; max-width: 640px; margin: 2rem auto; padding: 0 1rem; color: #1a1a1a; line-height: 1.4; }\n h1 { font-size: 1.4rem; }\n h2 { font-size: 1.1rem; }\n fieldset { border: 1px solid #ddd; border-radius: 6px; margin: 0.75rem 0; padding: 0.5rem 1rem; }\n legend { font-weight: 600; padding: 0 0.25rem; }\n label { display: inline-block; margin: 0.3rem 0.85rem 0.3rem 0; }\n button { background: #2563eb; color: #fff; border: none; border-radius: 4px; padding: 0.5rem 1rem; font-size: 0.95rem; cursor: pointer; }\n button:hover { background: #1d4ed8; }\n section { margin-top: 2rem; padding-top: 1rem; border-top: 1px solid #eee; }\n ul.devices { list-style: none; padding: 0; }\n ul.devices li { margin: 0.4rem 0; }\n ul.devices form { display: flex; gap: 0.5rem; }\n input[type=\"text\"] { flex: 1; padding: 0.4rem 0.6rem; border: 1px solid #ccc; border-radius: 4px; font-size: 0.95rem; }\n .breadcrumb { margin: 0 0 0.75rem; }\n .breadcrumb a { color: #2563eb; text-decoration: none; font-size: 0.9rem; }\n nav.config-nav { display: flex; gap: 1.25rem; margin: 0 0 1.5rem; border-bottom: 1px solid #ddd; }\n nav.config-nav a { color: #2563eb; text-decoration: none; padding-bottom: 0.6rem; font-size: 0.95rem; }\n nav.config-nav a.active { color: #1a1a1a; font-weight: 600; border-bottom: 2px solid #2563eb; }\n table.config-index { width: 100%; border-collapse: collapse; margin-top: 1rem; }\n table.config-index th, table.config-index td { text-align: left; padding: 0.5rem 0.6rem; border-bottom: 1px solid #eee; font-size: 0.95rem; }\n table.config-index th { color: #666; font-weight: 600; font-size: 0.8rem; text-transform: uppercase; letter-spacing: 0.02em; }\n table.config-index td:first-child { font-family: ui-monospace, monospace; font-size: 0.85rem; }\n`;\n\nfunction pageShell(title: string, body: string): string {\n return `\n\n\n\n\n${title}\n\n\n\n${body}\n\n`;\n}\n\ntype ConfigNavActive = \"settings\" | \"devices\" | \"pair\";\n\n// The persistent top nav every id-scoped sub-page shares, so moving between\n// the form, the device list, and the pairing flow never routes back through\n// the index. `active` just marks which tab is current — every route is a\n// real page, not a client-side view swap, so this is plain server-rendered\n// markup with no JS involved.\nfunction configNav(id: string, active: ConfigNavActive): string {\n const tabs: { key: ConfigNavActive; href: string; label: string }[] = [\n { key: \"settings\", href: `/config/${id}`, label: \"Settings\" },\n { key: \"devices\", href: `/config/${id}/devices`, label: \"Devices\" },\n { key: \"pair\", href: `/config/${id}/pair`, label: \"Pair a device\" },\n ];\n const links = tabs\n .map((tab) => `${tab.label}`)\n .join(\"\");\n return ``;\n}\n\n// GET /config. Prototype-stage only: this lists every config's id as a live\n// link, which is exactly the \"unguessable capability URL\" every other page\n// in this file (and docs/valtown-brief.md) otherwise treats as sensitive —\n// bookmark-only, never logged, never enumerable. Explicitly requested as an\n// acceptable bypass while there's no auth story yet; do not carry this\n// page's behavior forward once /config gets real access control.\nexport function configIndexDocument(configs: ConfigRow[]): string {\n const rows = configs\n .map((row) => {\n const safeId = escapeHtml(row.id);\n return `\n ${safeId}\n ${escapeHtml(summarizeSelection(row))}\n ${row.deviceCount}\n ${escapeHtml(new Date(row.updatedAt).toLocaleString())}\n `;\n })\n .join(\"\");\n const body = `\n

All configs

+ New config

\n \n \n ${rows || ``}\n

Config	Favorites	Devices	Updated
No configs yet.

`;\n return pageShell(\"Widget favorites — All configs\", body);\n}\n\nexport type ConfigNewOptions = { formAction: string; config: StoredConfig };\n\n// GET /config/new. No id yet, so no top nav — Settings/Devices/Pair only\n// make sense once POST /config/new has actually created a row.\nexport function configNewDocument(opts: ConfigNewOptions): string {\n const { formAction, config } = opts;\n const body = `\n \n

Widget favorites

\n `;\n return pageShell(\"Widget favorites — New\", body);\n}\n\nexport type ConfigSettingsOptions = {\n id: string;\n formAction: string;\n config: StoredConfig;\n saved?: boolean;\n};\n\n// GET/POST /config/:id. Just the sports/teams form — device list and\n// pairing moved to their own routes/documents below.\nexport function configSettingsDocument(opts: ConfigSettingsOptions): string {\n const { id, formAction, config, saved } = opts;\n const body = `\n ${configNav(id, \"settings\")}\n

Widget favorites

\n ${saved ? \"

Saved.

\" : \"\"}\n `;\n return pageShell(\"Widget favorites — Settings\", body);\n}\n\nexport type ConfigDevicesOptions = {\n id: string;\n devices: PairedDeviceView[];\n deviceActionPath: (deviceId: string) => string;\n};\n\n// GET /config/:id/devices.\nexport function configDevicesDocument(opts: ConfigDevicesOptions): string {\n const { id, devices, deviceActionPath } = opts;\n const body = `\n ${configNav(id, \"devices\")}\n

Paired devices

\n ${deviceListMarkup(devices, deviceActionPath)}`;\n return pageShell(\"Widget favorites — Devices\", body);\n}\n\nexport type ConfigPairOptions = {\n id: string;\n codeActionPath: string;\n pairing?: { code: string; expiresAt: string } | null;\n};\n\n// GET /config/:id/pair (no pairing yet) and POST /config/:id/code\n// (pairing populated with the code just minted).\nexport function configPairDocument(opts: ConfigPairOptions): string {\n const { id, codeActionPath, pairing } = opts;\n const body = `\n ${configNav(id, \"pair\")}\n

Pair a device

\n \n ${\n pairing\n ? `

Code: ${pairing.code} — enter this in the app. Expires ${\n new Date(pairing.expiresAt).toLocaleString()\n }. Reusable until then, so the same code can pair more than one device.

`\n : \"\"\n }`;\n return pageShell(\"Widget favorites — Pair a device\", body);\n}\n",[18,97],"pulls","branches",50,"forks","envVars",{"_134":288,"_289":26},"connections",{"_134":41,"_287":26},"unfilledCount",17,"emptyCount",{"_34":447,"_13":369,"_83":364,"_44":-5,"_36":37,"_228":41,"_229":24,"_38":448,"_40":26,"_86":147,"_231":-5,"_88":30,"_232":-5,"_322":449,"_17":450},{"_34":440,"_13":441,"_83":442,"_44":364,"_36":37,"_228":41,"_229":24,"_38":443,"_40":26,"_86":87,"_231":444,"_88":30,"_232":-5,"_322":445,"_17":446},{"_34":433,"_13":434,"_83":435,"_44":364,"_36":37,"_228":41,"_229":24,"_38":436,"_40":26,"_86":87,"_231":437,"_88":30,"_232":-5,"_322":438,"_17":439},{"_34":426,"_13":427,"_83":428,"_44":364,"_36":37,"_228":41,"_229":24,"_38":429,"_40":26,"_86":87,"_231":430,"_88":30,"_232":-5,"_322":431,"_17":432},{"_34":419,"_13":420,"_83":421,"_44":364,"_36":37,"_228":41,"_229":24,"_38":422,"_40":26,"_86":87,"_231":423,"_88":30,"_232":-5,"_322":424,"_17":425},{"_34":412,"_13":413,"_83":414,"_44":364,"_36":37,"_228":319,"_229":24,"_38":415,"_40":41,"_86":87,"_231":416,"_88":30,"_232":-5,"_322":417,"_17":418},{"_34":405,"_13":406,"_83":407,"_44":364,"_36":37,"_228":41,"_229":24,"_38":408,"_40":26,"_86":87,"_231":409,"_88":30,"_232":-5,"_322":410,"_17":411},{"_34":398,"_13":399,"_83":400,"_44":364,"_36":37,"_228":41,"_229":24,"_38":401,"_40":26,"_86":87,"_231":402,"_88":30,"_232":-5,"_322":403,"_17":404},{"_34":391,"_13":392,"_83":393,"_44":364,"_36":37,"_228":41,"_229":24,"_38":394,"_40":26,"_86":87,"_231":395,"_88":30,"_232":-5,"_322":396,"_17":397},{"_34":384,"_13":385,"_83":386,"_44":364,"_36":37,"_228":41,"_229":24,"_38":387,"_40":26,"_86":87,"_231":388,"_88":30,"_232":-5,"_322":389,"_17":390},{"_34":377,"_13":378,"_83":379,"_44":364,"_36":37,"_228":41,"_229":24,"_38":380,"_40":26,"_86":87,"_231":381,"_88":30,"_232":-5,"_322":382,"_17":383},{"_34":370,"_13":371,"_83":372,"_44":364,"_36":37,"_228":41,"_229":24,"_38":373,"_40":26,"_86":87,"_231":374,"_88":30,"_232":-5,"_322":375,"_17":376},{"_34":361,"_13":362,"_83":363,"_44":364,"_36":37,"_228":41,"_229":24,"_38":365,"_40":26,"_86":87,"_231":366,"_88":30,"_232":-5,"_322":367,"_17":368},{"_34":227,"_13":18,"_83":146,"_44":-5,"_36":37,"_228":41,"_229":24,"_38":358,"_40":26,"_86":147,"_231":-5,"_88":30,"_232":-5,"_322":359,"_17":360},{"_34":275,"_13":97,"_83":96,"_44":146,"_36":37,"_228":141,"_229":24,"_38":355,"_40":41,"_86":87,"_231":277,"_88":30,"_232":-5,"_322":356,"_17":357},{"_34":271,"_13":138,"_83":137,"_44":146,"_36":37,"_228":41,"_229":24,"_38":352,"_40":26,"_86":87,"_231":273,"_88":30,"_232":-5,"_322":353,"_17":354},{"_34":267,"_13":133,"_83":132,"_44":146,"_36":37,"_228":41,"_229":24,"_38":349,"_40":26,"_86":87,"_231":269,"_88":30,"_232":-5,"_322":350,"_17":351},{"_34":263,"_13":127,"_83":126,"_44":146,"_36":37,"_228":41,"_229":24,"_38":346,"_40":26,"_86":87,"_231":265,"_88":30,"_232":-5,"_322":347,"_17":348},{"_34":259,"_13":121,"_83":120,"_44":146,"_36":37,"_228":41,"_229":24,"_38":343,"_40":26,"_86":87,"_231":261,"_88":30,"_232":-5,"_322":344,"_17":345},{"_34":255,"_13":115,"_83":114,"_44":146,"_36":37,"_228":41,"_229":24,"_38":340,"_40":26,"_86":87,"_231":257,"_88":30,"_232":-5,"_322":341,"_17":342},{"_34":251,"_13":109,"_83":108,"_44":146,"_36":37,"_228":41,"_229":24,"_38":337,"_40":26,"_86":87,"_231":253,"_88":30,"_232":-5,"_322":338,"_17":339},{"_34":247,"_13":103,"_83":102,"_44":146,"_36":37,"_228":41,"_229":24,"_38":334,"_40":26,"_86":87,"_231":249,"_88":30,"_232":-5,"_322":335,"_17":336},{"_34":243,"_13":85,"_83":84,"_44":146,"_36":37,"_228":41,"_229":24,"_38":331,"_40":26,"_86":87,"_231":245,"_88":30,"_232":-5,"_322":332,"_17":333},{"_34":325,"_13":326,"_83":327,"_44":-5,"_36":37,"_228":41,"_229":24,"_38":328,"_40":26,"_86":147,"_231":-5,"_88":30,"_232":-5,"_322":329,"_17":330},{"_34":315,"_13":316,"_83":317,"_44":-5,"_36":37,"_228":185,"_229":24,"_38":318,"_40":319,"_86":320,"_231":321,"_88":30,"_232":-5,"_322":323,"_17":324},"0002c14b-71ad-4567-8671-ef6280c31f26","main.ts","01a054a3-42b9-74da-9ade-5694534fd83c",["D",1788126549950],3,"http","// sports-today — val.town HTTP val (plusjade/sports-today, file main.ts)\n//\n// Live at: https://plusjade--f0eeffb89a9311f19bb61607ee4eb77e.web.val.run/\n//\n// That URL is derived from this file's val.town file id, NOT its path — so\n// this file must only ever be updated in place. Deleting and recreating\n// main.ts (or renaming it) mints a new id and a new URL, silently pointing\n// the iOS widget at a dead endpoint while the new one returns a healthy\n// 200. Verify `links.endpoint` still ends in f0eeffb8… after any deploy.\n//\n// Deploy process, and which files under lib/ and render/ ship alongside\n// this one: docs/valtown-brief.md.\n//\n// ---- module map ----\n//\n// lib/catalog.ts the static tables (sports, channels, teams)\n// lib/text.ts lib/color.ts lib/dates.ts domain-free pure helpers\n// lib/channels.ts lib/teams.ts lib/games.ts lib/params.ts\n// pure application logic over those tables\n// lib/config.ts pure: stored-config + per-request facts -> the query\n// string /config/resolve redirects to\n// lib/sleeper.ts lib/configStore.ts lib/push.ts the only outbound\n// I/O (Sleeper, this val's own std/sqlite state, and\n// APNs silent push, respectively)\n// render/theme.ts the palette\n// render/layout.ts render/metrics.ts the png fit math: how much fits in\n// the canvas, and how wide a string will draw\n// render/json.ts render/html.ts render targets (pure + a wrapper)\n// render/configHtml.ts pure: the helper's config-picker HTML\n// render/png-tree.ts pure: slate -> satori element tree\n// render/png.ts impure: wasm, fonts, satori, resvg\n//\n// Everything except lib/sleeper.ts, lib/configStore.ts, lib/push.ts and\n// render/png.ts is pure and covered by tests/ under bin/ci; those four do\n// real I/O (Sleeper, this val's own sqlite storage, APNs, and wasm/font\n// loading, respectively) and are covered by hitting the endpoint instead.\n//\n// ---- erasable TypeScript, and the one rule that bites ----\n//\n// bin/ci runs the tests under `node --experimental-strip-types`, which\n// deletes type syntax without understanding it. Keep every file to erasable\n// TypeScript (type annotations and type aliases only — no enums, namespaces\n// or parameter properties), and **import every type with the `type`\n// modifier**: `import { type Game, transformScores }`. A plain\n// `import { Game }` survives stripping as a runtime import and dies with\n// \"does not provide an export named 'Game'\" — including when the module\n// also exports real values. Deno is more forgiving, so this fails in CI\n// rather than on the val. (This file itself is never imported by a test —\n// there's no main.test.ts — so its `npm:hono` import never reaches the\n// strip-types runner. Don't let that change: if a test ever imports\n// main.ts, that specifier breaks bin/ci.)\n//\n// ---- / — the stateless data route (unchanged) ----\n//\n// Usage:\n// ?day=today|tomorrow|next (default: next; anything else is dropped into\n// `effective.rejected` on json and falls back to\n// next, same drift-echo as sports[]/teams[]/tz.\n// Alpha-stage relaxation (2026-08-26): every value\n// scans the same 3-day window — in parallel, one\n// /scores call per date, never serial — and\n// returns the earliest date in it with a\n// qualifying game. `today`/`tomorrow` only move\n// where the window starts (today = the client's\n// local today, tomorrow = +1 day; `next` starts at\n// the same place `today` does, so the two are\n// functionally identical); they no longer mean an\n// exact single date. A live-right-now favorite\n// still wins outright whenever it falls in the\n// window. No date in the window qualifies -> the\n// same empty-slate render a quiet day always had.\n// See docs/widget-next-up-plan.md for why this is\n// bounded rather than a real schedule lookup.)\n// ?format=html|json|png (default: html)\n// ?w=&h= (png only, ignored by json — default 329x155, an\n// iOS \"medium\" widget-ish size)\n// ?sports[]=nfl|wnba|mlb|nba (repeated; default: all four)\n// ?teams[]=sparks|fever|dodgers|... (repeated; see TEAMS in lib/catalog.ts)\n// ?tz=-25200 (seconds east of GMT, e.g. iOS's\n// TimeZone.current.secondsFromGMT();\n// default: Pacific's live offset. What\n// `day` resolves against and what game\n// times render in — see lib/dates.ts)\n//\n// teams[] wins: any valid team switches to team mode, where sports[] is\n// ignored and the fetch list is derived from the selected teams. Unknown\n// values are dropped, never fatal — a 4xx renders as a broken image in\n// WidgetKit — and echoed back in `effective` (json) plus a \"! ignored:\" line\n// on the png, so a typo in the iOS repo is visible instead of silent.\n//\n// format=json is the SwiftUI widget's real data contract (schemaVersion 2,\n// mirrors the Codable types at Shared/WidgetPayload.swift in the iOS repo,\n// dateDecodingStrategy = .secondsSince1970), not a debug tool. It's a *view*\n// contract: {schemaVersion, eyebrow, items[]} where the server has already\n// decided the display text (mainText/subText/caption) — no away/home/score\n// object, no raw team codes. The old sport-grouped/raw-code drift echo\n// survives as `x-effective-*` response headers instead of a body field —\n// see render/json.ts's header for why it moved out of the body.\n//\n// png shows as many games as fit legibly in the requested canvas, and\n// reports the rest as a \"+N more\" line rather than rendering them too small\n// to read (or, as it did before, overflowing the canvas and clipping them\n// away silently). Widen or heighten the canvas to see more games.\n//\n// ---- /config/* — the stateful config layer (docs/widget-config-plan.md) ----\n//\n// A helper (parent/caretaker) sets favorite teams/sports from a browser;\n// the receiver (widget) never sees a picker, only its own device id.\n//\n// GET /config/new blank picker form\n// POST /config/new creates a config from the submitted\n// sports[]/teams[], redirects to /config/:id\n// GET /config/:id view/edit that config — the URL itself is\n// the capability token; there are no\n// accounts, so \"bookmark this link\" is the\n// only way back in\n// POST /config/:id saves edited sports[]/teams[]\n// POST /config/:id/code mints a short, reusable-until-expiry\n// pairing code for that config\n// POST /config/:id/devices/:deviceId sets a human-friendly name (\"dad\",\n// \"mom\") on a device already paired to that\n// config — for the configurator's own\n// benefit telling devices apart; never read\n// by /config/resolve or the app\n// POST /pair {code, device} JSON body from the app;\n// binds device -> config\n// GET /config/resolve ?device=&d=x&tz= — looks up\n// the device's config and 302s to `/` with\n// format=json baked in (this route has no\n// format= param at all: its one consumer is\n// the native json timeline provider) and\n// w=/h= parsed from d=. cache-control:\n// no-store, since this URL is constant per\n// device while its target can change.\n//\n// Only sports[]/teams[] are stored — day/tz/w/h/format stay live per-request\n// facts, never helper preferences (see the plan doc's rationale). Submitted\n// sports/teams are filtered against lib/catalog.ts's SPORTS/TEAMS before\n// storage, but that's a defensive filter, not the real validator: the actual\n// safety net is that /config/resolve's redirect lands back on `/`, where\n// resolveParams validates exactly as it does for any other caller.\n\nimport { Hono } from \"npm:hono\";\nimport { SPORTS, TEAMS } from \"./lib/catalog.ts\";\nimport { buildResolvedUrl, type StoredConfig } from \"./lib/config.ts\";\nimport {\n createConfig,\n createPairingCode,\n getConfig,\n getDeviceStatus,\n listAllConfigs,\n listDevicesForConfig,\n pairDevice,\n renameDevice,\n resolveDevice,\n saveDeviceToken,\n updateConfig,\n} from \"./lib/configStore.ts\";\nimport { resolveClientOffsetSeconds, windowDatesFor, formatDateLabel } from \"./lib/dates.ts\";\nimport { pickNextSlate } from \"./lib/games.ts\";\nimport { resolveParams } from \"./lib/params.ts\";\nimport { notifyConfigDevices } from \"./lib/push.ts\";\nimport { fetchScores } from \"./lib/sleeper.ts\";\nimport { renderHtml } from \"./render/html.ts\";\nimport { renderJson } from \"./render/json.ts\";\nimport { renderPng } from \"./render/png.ts\";\nimport {\n configDevicesDocument,\n configIndexDocument,\n configNewDocument,\n configPairDocument,\n configSettingsDocument,\n} from \"./render/configHtml.ts\";\nimport { backgroundForHue, randomHue } from \"./render/theme.ts\";\n\nasync function gamesHandler(req: Request): Promise {\n const url = new URL(req.url);\n const dayParam = url.searchParams.get(\"day\");\n // \"next\" is the default — an omitted `day` (the common case, since it's\n // the only value that needs no explicit widget config) gets the\n // nearest-upcoming-game scan starting today. `today`/`tomorrow` are still\n // opt-in exact matches for which value gets echoed/labeled, but as of the\n // 2026-08-26 relaxation they only move where the scan starts (see\n // windowDatesFor) — anything else, including an absent param, resolves to\n // \"next\", which starts at the same place \"today\" does.\n const day = dayParam === \"today\" ? \"today\" : dayParam === \"tomorrow\" ? \"tomorrow\" : \"next\";\n const format = url.searchParams.get(\"format\") ?? \"html\";\n\n // Repeated params (`?teams[]=sparks&teams[]=lakers`), matching Sleeper's\n // own convention rather than a comma-joined list.\n const resolved = resolveParams(url.searchParams.getAll(\"sports[]\"), url.searchParams.getAll(\"teams[]\"));\n\n // Same silent-coercion trap sports[]/teams[]/tz already guard against: an\n // unrecognized `day` was falling through to a default with nothing echoing\n // it. The ios-client spec names a bad `day` as *the* malformed-request\n // example, so it gets the same rejected-echo treatment as everything else.\n // An absent `day` is not an error — it's the new default — so only a\n // present-but-unrecognized value lands in `rejected`.\n if (dayParam !== null && dayParam !== \"today\" && dayParam !== \"tomorrow\" && dayParam !== \"next\") {\n resolved.rejected.push(`day:${dayParam}`);\n }\n\n // `?tz=` — seconds east of GMT, e.g. iOS's own\n // TimeZone.current.secondsFromGMT() — is what `today`/`tomorrow` resolve\n // against and what game times render in. Already has DST folded in by\n // whoever sent it, so no zone table lookup happens on this side. Defaults\n // to Pacific's live offset. An unrecognised value falls back to that\n // default and joins `rejected` rather than erroring, same drift-echo\n // `resolveParams` uses for sports[]/teams[].\n const { offsetSeconds: clientOffsetSeconds, rejected: rejectedTz } = resolveClientOffsetSeconds(\n url.searchParams.get(\"tz\"),\n );\n if (rejectedTz) resolved.rejected.push(rejectedTz);\n\n // Every `day` value scans the same 3-day window now, just anchored at a\n // different start date — see windowDatesFor for what \"today\"/\"tomorrow\"\n // mean post-relaxation.\n const dates = windowDatesFor(day, clientOffsetSeconds);\n // One /scores round trip per candidate date, all in flight at once — not\n // scanned serially, and not the undocumented full-season dumps Sleeper\n // also exposes (up to 14MB for mlb's daily slate, measured live). See\n // docs/widget-next-up-plan.md.\n const gamesByDate = await Promise.all(dates.map((d) => fetchScores(d, resolved.sports)));\n const picked = pickNextSlate(dates, gamesByDate, resolved.sports, resolved.teams);\n\n // `resolvedDate` is what the json contract echoes in `x-effective-date`;\n // `date` is what render/png and render/html use for card copy, which\n // always needs a concrete date even when nothing was found. They only\n // diverge when the window is exhausted: `resolvedDate` goes null (nothing\n // in the window qualified — an honest \"not found\", distinct from a real\n // date with zero games), while `date` falls back to the window's first\n // (start) date so the empty-state render still has something to anchor\n // its label to.\n const date = picked?.date ?? dates[0];\n const bySport = picked?.bySport ?? [];\n const resolvedDate = picked?.date ?? null;\n\n if (format === \"json\") return renderJson(bySport, day, resolved, clientOffsetSeconds, resolvedDate);\n if (format === \"png\") {\n return renderPng({\n bySport,\n dateLabel: formatDateLabel(date, day),\n width: Number(url.searchParams.get(\"w\")) || 329,\n height: Number(url.searchParams.get(\"h\")) || 155,\n // The randomness lives here, at the edge, so the tree stays pure.\n background: backgroundForHue(randomHue()),\n rejected: resolved.rejected,\n clientOffsetSeconds,\n });\n }\n return renderHtml(bySport, day, clientOffsetSeconds);\n}\n\n// Repeated checkbox values (`sports[]`/`teams[]`) survive Hono's\n// `parseBody({ all: true })` as an array; a single one comes back as a bare\n// string, and none at all comes back undefined. Normalizing here is what\n// lets the route handlers treat all three cases the same way.\nfunction asArray(value: unknown): string[] {\n if (Array.isArray(value)) return value.filter((v): v is string => typeof v === \"string\");\n if (typeof value === \"string\") return [value];\n return [];\n}\n\nfunction filterKnown(values: string[], allowed: string[]): string[] {\n return values.filter((v) => allowed.includes(v));\n}\n\nconst TEAM_SLUGS = Object.keys(TEAMS);\n\nconst app = new Hono();\n\napp.get(\"/\", (c) => gamesHandler(c.req.raw));\n\n// Prototype-stage only, no auth: every config row, linked by real id. See\n// render/configHtml.ts's configIndexDocument header for why that's an\n// accepted bypass here and not a pattern to repeat once /config needs\n// real access control.\napp.get(\"/config\", async (c) => {\n const configs = await listAllConfigs();\n return c.html(configIndexDocument(configs));\n});\n\napp.get(\"/config/new\", (c) => {\n return c.html(configNewDocument({ formAction: \"/config/new\", config: { sports: [], teams: [] } }));\n});\n\napp.post(\"/config/new\", async (c) => {\n const body = await c.req.parseBody({ all: true });\n const config = {\n sports: filterKnown(asArray(body[\"sports[]\"]), SPORTS),\n teams: filterKnown(asArray(body[\"teams[]\"]), TEAM_SLUGS),\n };\n const { id } = await createConfig(config);\n return c.redirect(`/config/${id}`);\n});\n\n// A device that's never paired (a pre-config install, or one whose pairing\n// row got wiped — see lib/configStore.ts's device_configs table) has no\n// StoredConfig at all, and buildResolvedUrl's own \"empty means all sports\"\n// rule would otherwise dump the entire slate on it. That rule is correct for\n// an actually-empty *config* (a helper who unchecked everything on purpose);\n// it's wrong as the fallback for *no config*, which this route is the only\n// place that distinguishes. Hard-coding the pre-config-era default here,\n// rather than writing a real \"default\" config row via lib/configStore.ts,\n// keeps every other layer's contract exactly as-is: getConfig/resolveDevice\n// still return null for \"nothing on file\", buildResolvedUrl still treats an\n// empty StoredConfig as \"all sports\", and a paired device with a genuinely\n// empty config still gets that. This is purely what an unpaired redirect\n// carries.\nconst LEGACY_DEFAULT_CONFIG: StoredConfig = { sports: [], teams: [\"fever\", \"sparks\"] };\n\n// Must be registered before /config/:id below — \"resolve\" would otherwise\n// match that route's :id param and 404 out of getConfig(\"resolve\"), which is\n// the widget's only data path silently going dead.\napp.get(\"/config/resolve\", async (c) => {\n const url = new URL(c.req.url);\n const deviceId = url.searchParams.get(\"device\");\n const stored = deviceId ? await resolveDevice(deviceId) : null;\n const target = buildResolvedUrl(stored ?? LEGACY_DEFAULT_CONFIG, {\n d: url.searchParams.get(\"d\"),\n tz: url.searchParams.get(\"tz\"),\n });\n // Response.redirect is broken on Val Town — a plain 302 Response with an\n // explicit Location header is the documented workaround. cache-control is\n // explicit too: unlike `/`, this URL is constant per device while its\n // target can silently change underneath it, so nothing here should be\n // cached at any layer.\n return new Response(null, { status: 302, headers: { Location: target, \"cache-control\": \"no-store\" } });\n});\n\n// Shared across every /config/:id render below — pulled out so the four\n// handlers that redraw this page can't drift from each other on how a\n// device's rename form gets its action URL.\nfunction deviceActionPath(id: string): (deviceId: string) => string {\n return (deviceId) => `/config/${id}/devices/${encodeURIComponent(deviceId)}`;\n}\n\n// The settings sub-route — just the sports/teams form. Device list and\n// pairing live at their own routes below, reached via the shared top nav\n// (render/configHtml.ts's configNav) rather than being inline here.\napp.get(\"/config/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const config = await getConfig(id);\n if (!config) return c.text(\"Not found\", 404);\n return c.html(configSettingsDocument({ id, formAction: `/config/${id}`, config }));\n});\n\napp.post(\"/config/:id\", async (c) => {\n const id = c.req.param(\"id\");\n const existing = await getConfig(id);\n if (!existing) return c.text(\"Not found\", 404);\n\n const body = await c.req.parseBody({ all: true });\n const config = {\n sports: filterKnown(asArray(body[\"sports[]\"]), SPORTS),\n teams: filterKnown(asArray(body[\"teams[]\"]), TEAM_SLUGS),\n };\n await updateConfig(id, config);\n // Best-effort: a push failure (missing APNs credentials, a dead token,\n // Apple being down) must never break saving the config itself, so this\n // is swallowed rather than awaited into the response's success path.\n await notifyConfigDevices(id).catch(() => undefined);\n return c.html(configSettingsDocument({ id, formAction: `/config/${id}`, config, saved: true }));\n});\n\napp.get(\"/config/:id/devices\", async (c) => {\n const id = c.req.param(\"id\");\n const config = await getConfig(id);\n if (!config) return c.text(\"Not found\", 404);\n const devices = await listDevicesForConfig(id);\n return c.html(configDevicesDocument({ id, devices, deviceActionPath: deviceActionPath(id) }));\n});\n\napp.get(\"/config/:id/pair\", async (c) => {\n const id = c.req.param(\"id\");\n const config = await getConfig(id);\n if (!config) return c.text(\"Not found\", 404);\n return c.html(configPairDocument({ id, codeActionPath: `/config/${id}/code` }));\n});\n\napp.post(\"/config/:id/code\", async (c) => {\n const id = c.req.param(\"id\");\n const config = await getConfig(id);\n if (!config) return c.text(\"Not found\", 404);\n\n const pairing = await createPairingCode(id);\n return c.html(configPairDocument({ id, codeActionPath: `/config/${id}/code`, pairing }));\n});\n\n// The configurator naming a device from the /config/:id/devices page —\n// \"dad\"/\"mom\"/etc, so they can tell paired devices apart. Redirects back\n// (PRG) rather than re-rendering directly so a page refresh after saving\n// doesn't re-post — back to the devices sub-route now, not the settings\n// page that used to own this section.\napp.post(\"/config/:id/devices/:deviceId\", async (c) => {\n const id = c.req.param(\"id\");\n const deviceId = c.req.param(\"deviceId\");\n const body = await c.req.parseBody({ all: true });\n const name = typeof body[\"name\"] === \"string\" ? body[\"name\"] : \"\";\n await renameDevice(deviceId, name);\n return c.redirect(`/config/${id}/devices`);\n});\n\n// The receiver's half of pairing — an ordinary JSON request from app code,\n// not the image-serving path, so a real 4xx here is fine (the \"never 4xx\"\n// rule in this file is specifically about a broken image in WidgetKit).\napp.post(\"/pair\", async (c) => {\n let body: unknown;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ ok: false }, 400);\n }\n const { code, device } = (body ?? {}) as { code?: unknown; device?: unknown };\n if (typeof code !== \"string\" || typeof device !== \"string\") return c.json({ ok: false }, 400);\n\n const result = await pairDevice(code, device);\n if (result.ok) return c.json(result, 200);\n if (result.reason === \"expired\") return c.json({ ok: false, message: \"expired\" }, 422);\n return c.json({ ok: false }, 404);\n});\n\n// AppDelegate.swift uploads its APNs token here on every\n// didRegisterForRemoteNotificationsWithDeviceToken — unconditionally, not\n// just once, since tokens rotate. Independent of /pair on purpose: see the\n// device_tokens table comment in lib/configStore.ts.\napp.post(\"/device/token\", async (c) => {\n let body: unknown;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ ok: false }, 400);\n }\n const { device, token } = (body ?? {}) as { device?: unknown; token?: unknown };\n if (typeof device !== \"string\" || typeof token !== \"string\") return c.json({ ok: false }, 400);\n\n await saveDeviceToken(device, token);\n return c.json({ ok: true });\n});\n\n// Prototype-level diagnostics for the app's paired screen — not part of the\n// receiver's real data path (that's /config/resolve). Never errors past 200:\n// an unpaired or unknown device id just gets { paired: false }, same\n// never-fail posture as the rest of this val's device-facing routes.\n//\n// KNOWN GAP (2026-08-28): this route 404s on jade.beer (the custom domain)\n// while working on the val.run URL, even after redeploy and even nested\n// under /config/* — every other route works on both, so whatever's stale is\n// on the domain side, not a Hono routing issue in this file. Whoever owns\n// jade.beer's setup needs to look at it; the iOS client hits val.run\n// directly for this one call in the meantime.\napp.get(\"/config/status/:deviceId\", async (c) => {\n const deviceId = c.req.param(\"deviceId\");\n const status = await getDeviceStatus(deviceId);\n if (!status) return c.json({ deviceId, paired: false });\n return c.json({\n deviceId,\n paired: true,\n configId: status.configId,\n name: status.name,\n sports: status.sports,\n teams: status.teams,\n });\n});\n\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;\n","children",[],[316],"9fb7aa3b-bc8e-4859-a5d9-b6176f188d53","tools","01a054a3-42b9-74da-9ade-5246b2fb7a14",["D",1788126380735],[],[326],["D",1788126380735],[],[18,85],["D",1788126380735],[],[18,103],["D",1788126380735],[],[18,109],["D",1788126380735],[],[18,115],["D",1788126380735],[],[18,121],["D",1788126380735],[],[18,127],["D",1788126380735],[],[18,133],["D",1788126380735],[],[18,138],["D",1788126433161],[],[18,97],["D",1788126380735],[304,305,306,307,308,309,310,311,312],[18],"94ba107d-6b2c-476a-9003-60a9de125cb8","text.ts","01a054a3-42b9-74da-9ade-20ccb156ec51","01a054a3-42b9-74da-9ade-2663c48d27cf",["D",1788126380735],"// Pure string helpers. Domain-free: nothing here knows about games,\n// channels or teams, which is what keeps them safe to call from anywhere\n// in lib/ without creating an import cycle.\n\n// A blunt chop rather than a width measurement — see MAX_CHANNEL_LABEL in\n// catalog.ts for why that is all this needs to be.\nexport function chop(text: string, max: number): string {\n return text.length <= max ? text : `${text.slice(0, max - 1)}…`;\n}\n\nexport function titleCase(slug: string): string {\n return slug\n .split(\"-\")\n .map((word) => word.charAt(0).toUpperCase() + word.slice(1))\n .join(\" \");\n}\n",[],[369,362],"lib","0bd9d8a2-163d-4c66-81db-b86e2ddcb5c6","teams.ts","01a054a3-42b9-74da-9ade-1d2f5ec72927",["D",1788126380735],"// Display names for the teams catalog.ts knows about. Pure.\n\nimport { TEAMS } from \"./catalog.ts\";\nimport { titleCase } from \"./text.ts\";\n\n// ---- display names ----\n//\n// Derived from TEAMS rather than declared as a second table, and that is the\n// whole point: a parallel TEAM_NAMES would carry the same (sport, code) pairs\n// a second time, and the two would drift the first time someone corrected a\n// code in one of them. Adding a team to TEAMS now buys both the favorites\n// filter and the display name in one edit.\n//\n// Keyed on `sport:code`, never on the bare code, for the reason spelled out\n// above TEAMS: `IND` is the Fever, the Colts *and* the Pacers, so a bare-code\n// index would label a Colts game \"Fever\". The key includes the sport for the\n// same reason the favorites table stores a pair.\nconst TEAM_LABELS: Record = Object.fromEntries(\n Object.entries(TEAMS).map(([slug, ref]) => [`${ref.sport}:${ref.code}`, titleCase(slug)]),\n);\n\n// Falls back to the raw code, which is the honest thing to draw for a team\n// this table doesn't cover yet — nfl, wnba and mlb are fully mapped, but\n// nba is still deferred, so the fallback stays a live case there, and a\n// card mixes \"Lakers\" with \"PHX\". Callers get whatever TEAMS knows and\n// nothing is invented.\nexport function teamLabel(sport: string, code: string | null): string | null {\n if (!code) return code;\n return TEAM_LABELS[`${sport}:${code}`] ?? code;\n}\n\n// ---- the reverse of TEAMS: (sport, code) -> slug ----\n//\n// The widget json format sends away.id/home.id, and per docs/widget-ios-brief.md\n// those must be the exact slugs the iOS side is hardcoded to send in\n// teams[] — the slug *is* the id vocabulary, not a separate one. Derived\n// from TEAMS for the same reason TEAM_LABELS is: a hand-maintained second\n// table would drift the first time a code changed in one but not the other.\n// `Object.fromEntries` keeps the last entry on a key collision, which would\n// silently mean two slugs mapping to one id — safe here only because\n// tests/teams.test.ts's round-trip over every TEAMS entry already fails loud\n// if any (sport, code) pair is reused by two slugs.\nconst TEAM_SLUGS: Record = Object.fromEntries(\n Object.entries(TEAMS).map(([slug, ref]) => [`${ref.sport}:${ref.code}`, slug]),\n);\n\n// Falls back to the raw code for a team TEAMS doesn't cover (nba, mostly) —\n// same \"nothing invented\" rule as teamLabel. An opponent team without a slug\n// still needs *some* id; the raw code is the honest one, and it's never used\n// for teams[] filtering since only slugs are accepted there.\nexport function teamId(sport: string, code: string | null): string | null {\n if (!code) return code;\n return TEAM_SLUGS[`${sport}:${code}`] ?? code;\n}\n",[],[369,371],"6e86bbdf-d642-4401-a880-9e925cf94ea6","sleeper.ts","01a054a3-42b9-74da-9ade-19107d4a35e6",["D",1788126380735],"// The val's only outbound I/O. Everything else under lib/ is pure, which is\n// what lets tests/ run the whole slate pipeline against captured fixtures\n// with no network — this file is the seam they stop at, and the deployed\n// endpoint is what covers it (see docs/HANDOFF.md).\n\nimport { SPORTS } from \"./catalog.ts\";\nimport { type Game } from \"./games.ts\";\n\nexport async function fetchScores(date: string, sports: string[] = SPORTS): Promise {\n const url = new URL(\"https://api.sleeper.app/scores\");\n for (const sport of sports) url.searchParams.append(\"sports[]\", sport);\n url.searchParams.set(\"date\", date);\n\n const res = await fetch(url);\n if (!res.ok) throw new Error(`Sleeper /scores returned ${res.status}`);\n return (await res.json()) ?? [];\n}\n",[],[369,378],"919fb77c-7068-4bb2-bb09-22b8cdb6bf58","push.ts","01a054a3-42b9-74da-9ade-179de3e5afe2",["D",1788126380735],"// The third source of real outbound I/O in this val (Apple's APNs,\n// alongside lib/sleeper.ts's Sleeper calls and lib/configStore.ts's\n// sqlite). Not reachable from tests/ for the same reason those two aren't\n// (see main.ts's header) — this hits the live APNs endpoint directly, so\n// it's verified by pairing a real device and editing its config, not a\n// deterministic test.\n//\n// What this buys: without it, a helper editing sports/teams in the browser\n// only reaches paired widgets whenever WidgetKit's own budget next refreshes\n// them (ClarkViewWidget.swift's Provider polls hourly, on its own schedule,\n// with no guarantee of exactly when). A silent push (content-available, no\n// alert/sound/badge — never shown to the person using the device) tells the\n// app to call WidgetCenter.reloadTimelines immediately instead — see\n// AppDelegate.swift in the iOS repo. It's a latency improvement on the\n// happy path, not a delivery guarantee: iOS throttles background pushes to\n// a handful per hour and drops them entirely for a force-quit app, so the\n// polling path stays load-bearing regardless.\n//\n// Auth: a signed ES256 JWT (RFC 7519) using an APNs Auth Key — one key\n// signs pushes for every app tied to this Apple team, no per-app cert.\n// WebCrypto's ECDSA signature is already raw r||s, which is what the JWT\n// wants directly — no DER conversion needed.\n//\n// Requires four env vars this val doesn't ship with by default:\n// APNS_KEY_ID, APNS_TEAM_ID, APNS_AUTH_KEY (the .p8 file's contents,\n// PEM-armored), and optionally APNS_TOPIC (defaults to the bundle id\n// below) / APNS_ENV (\"production\" once the App Store build ships;\n// defaults to sandbox, matching aps-environment=development in\n// clark_view.entitlements). Until those are set, sendSilentPush is a no-op\n// — see the null check in authToken.\n\nimport { deleteDeviceToken, getTokensForConfig } from \"./configStore.ts\";\n\nconst APNS_KEY_ID = Deno.env.get(\"APNS_KEY_ID\");\nconst APNS_TEAM_ID = Deno.env.get(\"APNS_TEAM_ID\");\nconst APNS_AUTH_KEY = Deno.env.get(\"APNS_AUTH_KEY\");\nconst APNS_TOPIC = Deno.env.get(\"APNS_TOPIC\") ?? \"plusjade.clark-view\";\nconst APNS_HOST = Deno.env.get(\"APNS_ENV\") === \"production\" ? \"api.push.apple.com\" : \"api.sandbox.push.apple.com\";\n\nfunction base64UrlFromBytes(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nfunction base64UrlFromString(value: string): string {\n return base64UrlFromBytes(new TextEncoder().encode(value));\n}\n\n// .p8 files are PEM: base64 PKCS#8 wrapped in BEGIN/END lines. WebCrypto's\n// importKey(\"pkcs8\", ...) wants the raw DER bytes underneath, not the PEM\n// armor.\nfunction pkcs8KeyFromPem(pem: string): Promise {\n const der = pem\n .replace(/-----BEGIN PRIVATE KEY-----/, \"\")\n .replace(/-----END PRIVATE KEY-----/, \"\")\n .replace(/\\s+/g, \"\");\n const bytes = Uint8Array.from(atob(der), (c) => c.charCodeAt(0));\n return crypto.subtle.importKey(\"pkcs8\", bytes, { name: \"ECDSA\", namedCurve: \"P-256\" }, false, [\"sign\"]);\n}\n\nlet cachedToken: { jwt: string; mintedAt: number } | null = null;\n// Apple allows reusing one token for up to 60 minutes and rate-limits how\n// often a new one can be minted — refresh a bit early, not on every call.\nconst TOKEN_TTL_SECONDS = 50 * 60;\n\nasync function authToken(): Promise {\n if (!APNS_KEY_ID || !APNS_TEAM_ID || !APNS_AUTH_KEY) return null;\n const now = Math.floor(Date.now() / 1000);\n if (cachedToken && now - cachedToken.mintedAt < TOKEN_TTL_SECONDS) return cachedToken.jwt;\n\n const header = base64UrlFromString(JSON.stringify({ alg: \"ES256\", kid: APNS_KEY_ID }));\n const claims = base64UrlFromString(JSON.stringify({ iss: APNS_TEAM_ID, iat: now }));\n const signingInput = `${header}.${claims}`;\n const key = await pkcs8KeyFromPem(APNS_AUTH_KEY);\n const signature = await crypto.subtle.sign(\n { name: \"ECDSA\", hash: \"SHA-256\" },\n key,\n new TextEncoder().encode(signingInput),\n );\n const jwt = `${signingInput}.${base64UrlFromBytes(new Uint8Array(signature))}`;\n cachedToken = { jwt, mintedAt: now };\n return jwt;\n}\n\n// Returns whether the token looks permanently dead (410 Unregistered, or a\n// 400 BadDeviceToken — the aps-environment/sandbox-vs-production mismatch\n// case) so the caller can prune it instead of retrying it forever. Missing\n// credentials or a transient APNs error both come back as a quiet `ok:\n// false, deadToken: false` — never thrown, matching this val's\n// never-fail-the-caller posture on every other device-facing route.\nexport async function sendSilentPush(token: string): Promise<{ ok: boolean; deadToken: boolean }> {\n const jwt = await authToken();\n if (!jwt) return { ok: false, deadToken: false };\n\n const response = await fetch(`https://${APNS_HOST}/3/device/${token}`, {\n method: \"POST\",\n headers: {\n authorization: `bearer ${jwt}`,\n \"apns-topic\": APNS_TOPIC,\n \"apns-push-type\": \"background\",\n \"apns-priority\": \"5\",\n },\n body: JSON.stringify({ aps: { \"content-available\": 1 } }),\n });\n if (response.ok) return { ok: true, deadToken: false };\n\n const reason = await response.json().then((body) => (body as { reason?: string })?.reason).catch(() => null);\n return { ok: false, deadToken: response.status === 410 || reason === \"BadDeviceToken\" };\n}\n\n// Called after a config's sports/teams change (main.ts's POST /config/:id).\n// Pushes every device currently paired to that config, best-effort — one\n// bad token never blocks another device's push, and a push failure here\n// never fails the config save itself (see main.ts's try/catch around this\n// call).\nexport async function notifyConfigDevices(configId: string): Promise {\n const devices = await getTokensForConfig(configId);\n await Promise.all(devices.map(async ({ deviceId, token }) => {\n const { deadToken } = await sendSilentPush(token);\n if (deadToken) await deleteDeviceToken(deviceId);\n }));\n}\n",[],[369,385],"b571e098-48f0-477e-9970-137aae4a61cf","params.ts","01a054a3-42b9-74da-9ade-102ed3f4bab6",["D",1788126380735],"// The URL contract: raw `sports[]` / `teams[]` query values in, a resolved\n// fetch-and-filter plan out. Pure — no I/O — so the whole contract is\n// testable under bin/ci.\n\nimport { MAX_TEAMS, SPORTS, TEAMS, type TeamRef } from \"./catalog.ts\";\n\nexport type ResolvedParams = {\n mode: \"teams\" | \"sports\";\n sports: string[];\n teams: TeamRef[];\n rejected: string[];\n};\n\n// Two modes, not an intersection. Any valid team puts us in team mode, where\n// `sports[]` is ignored and the fetch list is derived from the selected\n// teams instead. Intersecting them lets `sports[]=nfl&teams[]=dodgers`\n// produce an empty widget that looks exactly like a quiet day.\n//\n// Nothing here throws or signals an error status: a 4xx renders as a broken\n// image in WidgetKit, which is worse than slightly wrong content. Unknown\n// values are dropped into `rejected` for the caller to echo, which is what\n// makes drift between the iOS repo and this one visible instead of silent.\nexport function resolveParams(sportsParam: string[] = [], teamsParam: string[] = []): ResolvedParams {\n const rejected: string[] = [];\n\n const clean = (values: string[]) => [\n ...new Set(values.map((v) => v.trim().toLowerCase()).filter(Boolean)),\n ];\n\n // Sports are validated even in team mode, where they're otherwise unused:\n // a typo should surface as drift rather than hide behind a team filter.\n const sports = clean(sportsParam).filter((s) => {\n if (SPORTS.includes(s)) return true;\n rejected.push(s);\n return false;\n });\n\n const teams: TeamRef[] = [];\n for (const slug of clean(teamsParam)) {\n if (!TEAMS[slug]) rejected.push(slug);\n else if (teams.length >= MAX_TEAMS) rejected.push(slug);\n else teams.push(TEAMS[slug]);\n }\n\n // Every requested team was unknown -> fall through to sports mode rather\n // than rendering an empty card. The slugs are already in `rejected`, so\n // the caller can still say something went wrong.\n if (teams.length === 0) {\n return { mode: \"sports\", sports: sports.length ? orderBySports(sports) : [...SPORTS], teams: [], rejected };\n }\n\n const derived = orderBySports([...new Set(teams.map((t) => t.sport))]);\n return { mode: \"teams\", sports: derived, teams, rejected };\n}\n\n// Keeps fetch/group order stable and independent of the order params arrived\n// in, so two widgets with the same selection produce the same card.\nfunction orderBySports(sports: string[]): string[] {\n return SPORTS.filter((s) => sports.includes(s));\n}\n",[],[369,392],"6ced7c30-c371-4d52-b27a-49a2bb5f7c24","games.ts","01a054a3-42b9-74da-9ade-0d197551a063",["D",1788126380735],"// The game slate: Sleeper's raw /scores payload in, enriched and grouped\n// games out. Pure — the fetch that produces the input lives in sleeper.ts.\n\nimport { SPORTS, type TeamRef } from \"./catalog.ts\";\nimport { channelInfo, type ChannelInfo } from \"./channels.ts\";\n\n// away_team/home_team ships as a plain string for nfl but as\n// { record, team } for wnba (and mlb) — same shape hazard the Rails view\n// papers over with `dig(...) rescue metadata[\"away_team\"]`.\n//\n// Named for what it returns: Sleeper's abbreviation (\"IND\"), not a name.\n// `teamLabel` in teams.ts is the one that turns that into \"Fever\".\nfunction teamCode(value: unknown): string | null {\n if (value && typeof value === \"object\") return (value as { team: string }).team;\n return (value as string) ?? null;\n}\n\n// Same shape hazard as teamCode, on the score instead of the code — and it's\n// two hazards deep. wnba/mlb nest it inside the away_team/home_team object,\n// nfl carries no such object at all and puts it in a sibling\n// metadata.away_score/home_score field instead (confirmed live 2026-08-20 —\n// nfl never populates a score inside away_team, in_game or not). And even\n// among the sports that do nest it, the key isn't the same: mlb calls it\n// `score`, wnba calls it `points` (confirmed live 2026-08-20 against three\n// in-progress wnba games — `score` was absent, `points` had the real total).\n// nba is assumed to share wnba's `points`, both being basketball on the same\n// provider, but that's unverified — no live nba game to check this season.\nfunction teamScore(teamValue: unknown, flatScore: unknown): number | null {\n if (teamValue && typeof teamValue === \"object\") {\n const obj = teamValue as { score?: unknown; points?: unknown };\n const nested = typeof obj.score === \"number\" ? obj.score : obj.points;\n if (typeof nested === \"number\") return nested;\n }\n return typeof flatScore === \"number\" ? flatScore : null;\n}\n\nexport type Game = {\n sport: string;\n start_time: number;\n status?: unknown;\n game_id?: unknown;\n metadata: {\n away_team?: unknown;\n home_team?: unknown;\n channel?: string | null;\n away_score?: unknown;\n home_score?: unknown;\n };\n};\n\nexport type EnrichedGame = Game & {\n away: string | null;\n home: string | null;\n channel: ChannelInfo;\n id: string | null;\n statusRaw: string | null;\n awayScore: number | null;\n homeScore: number | null;\n};\n\nexport type GamesBySport = { sport: string; games: EnrichedGame[] }[];\n\n// The three steps transformScores used to do inline, split out so\n// pickNextSlate can filter the same enriched date by one team at a time\n// instead of re-deriving away/home/channel/id/etc. per team.\nfunction enrichGames(games: Game[]): EnrichedGame[] {\n return (games ?? []).map((game) => ({\n ...game,\n away: teamCode(game.metadata?.away_team),\n home: teamCode(game.metadata?.home_team),\n channel: channelInfo(game.metadata?.channel),\n id: typeof game.game_id === \"string\" || typeof game.game_id === \"number\" ? String(game.game_id) : null,\n statusRaw: typeof game.status === \"string\" ? game.status : null,\n awayScore: teamScore(game.metadata?.away_team, game.metadata?.away_score),\n homeScore: teamScore(game.metadata?.home_team, game.metadata?.home_score),\n }));\n}\n\n// Matched on the (sport, code) pair, never the bare code — `IND` is three\n// different franchises across wnba/nfl/nba, so a code-only match makes\n// \"fever\" quietly include Colts and Pacers games.\nfunction filterByTeams(enriched: EnrichedGame[], teams: TeamRef[]): EnrichedGame[] {\n if (!teams.length) return enriched;\n return enriched.filter((game) =>\n teams.some((t) => t.sport === game.sport && (game.away === t.code || game.home === t.code)),\n );\n}\n\nfunction groupBySport(enriched: EnrichedGame[], sports: string[]): GamesBySport {\n const bySport = Object.groupBy(enriched, (g) => g.sport) as Record;\n return sports\n .filter((sport) => bySport[sport]?.length)\n .map((sport) => ({ sport, games: bySport[sport].toSorted((a, b) => a.start_time - b.start_time) }));\n}\n\n// sports: array like [\"nfl\", \"wnba\"]. games: raw Sleeper /scores payload\n// (already filtered to a single date server-side by the API call itself —\n// this function just shapes what was returned).\nexport function transformScores(games: Game[], sports: string[] = SPORTS, teams: TeamRef[] = []): GamesBySport {\n return groupBySport(filterByTeams(enrichGames(games), teams), sports);\n}\n\n// Flattens the sport groups into one chronological list, for renderers that\n// don't draw sport headings.\n//\n// The PNG is that renderer. Flattening in SPORTS order instead produced a\n// list that looked time-sorted but wasn't (a 4:30pm wnba game above a 9:35am\n// mlb one, with nothing on the card explaining the jump), and — worse — made\n// truncation sport-biased: whichever sport sorts first claims the visible\n// rows, so a medium widget showing 2 of 17 gave both slots to wnba and put\n// all 15 mlb games behind \"+15 more\". With four sports that can make a whole\n// sport structurally unreachable on the smaller canvases.\n//\n// The HTML view still groups by sport deliberately — it has headings, so the\n// grouping is legible there.\nexport function flattenByStartTime(bySport: GamesBySport): EnrichedGame[] {\n return bySport.flatMap((group) => group.games).toSorted((a, b) => a.start_time - b.start_time);\n}\n\n// The window-scan decision behind every `day=` value (today/tomorrow/next\n// all resolve through the same scan now — see lib/dates.ts's\n// windowDatesFor), kept pure and separate from the fetch that feeds it\n// (main.ts fetches every date in the window in parallel, then hands the\n// results here in calendar order).\n//\n// Sports mode (no teams[]) walks the dates in order and returns the first\n// one with any qualifying game — never the first one to resolve over the\n// network, which would make the result depend on request timing instead of\n// the calendar.\n//\n// Team mode resolves each favorite independently instead of sharing one\n// \"earliest date\" across all of them. A single shared date silently drops\n// every OTHER favorite whose own next game lands on a later date in the\n// window: `teams[]=sparks&teams[]=fever&teams[]=dodgers` with the Dodgers\n// playing today but Sparks/Fever not until day 2 used to return only the\n// Dodgers game — the scan stopped at day 0 because *a* team qualified,\n// never reaching day 2 to pick up the other two. Each team now gets its own\n// walk over the same window, and the games are unioned; `date` becomes the\n// earliest date represented across all of them (used for the card's\n// overall date label, not a claim every returned game is on that date —\n// each json item still carries its own `timestamp`). Two favorites in the\n// same game are deduped rather than shown twice.\n//\n// `null` means no date in the window qualified for ANY team/sport (a real\n// offseason, most likely, or just an unlucky 3-day window), which the\n// caller renders as the existing empty-slate state rather than an error.\nexport function pickNextSlate(\n dates: string[],\n gamesByDate: Game[][],\n sports: string[] = SPORTS,\n teams: TeamRef[] = [],\n): { date: string; bySport: GamesBySport } | null {\n const enrichedByDate = gamesByDate.map((games) => enrichGames(games));\n\n if (!teams.length) {\n for (let i = 0; i < dates.length; i++) {\n const bySport = groupBySport(enrichedByDate[i], sports);\n if (bySport.length) return { date: dates[i], bySport };\n }\n return null;\n }\n\n let earliestDate: string | null = null;\n const matched: EnrichedGame[] = [];\n for (const team of teams) {\n for (let i = 0; i < dates.length; i++) {\n const games = filterByTeams(enrichedByDate[i], [team]);\n if (games.length) {\n if (earliestDate === null || dates[i] < earliestDate) earliestDate = dates[i];\n matched.push(...games);\n break;\n }\n }\n }\n if (!matched.length) return null;\n\n const seen = new Set();\n const deduped = matched.filter((g) => {\n const key = g.id ?? `${g.sport}:${g.away}-${g.home}:${g.start_time}`;\n if (seen.has(key)) return false;\n seen.add(key);\n return true;\n });\n\n return { date: earliestDate!, bySport: groupBySport(deduped, sports) };\n}\n",[],[369,399],"49d60453-639a-4421-9fbd-9e67a215e3ab","dates.ts","01a054a3-42b9-74da-9ade-08d313bab808",["D",1788126380735],"// Pure date math for the Sleeper slate. No formatting of games, no I/O —\n// every function here takes an explicit `now` or an ISO string, which is\n// what lets tests/dates.test.ts pin behaviour without freezing the clock.\n\n// Sleeper buckets /scores by Eastern day, not UTC — same fact\n// Sleeper::Client.today_slate_date encodes. This is a server-side fact\n// about Sleeper, never client-supplied, so it stays an IANA name (DST needs\n// a real zone, not an offset) and is untouched by the client offset work\n// below.\nexport const SLEEPER_TIME_ZONE = \"America/New_York\";\n\n// The client's timezone when a request doesn't send `?tz=`, or sends one\n// resolveClientOffsetSeconds rejects. Used two ways: as the IANA name\n// resolveClientOffsetSeconds resolves to a live, DST-correct offset via\n// offsetSecondsForZone, and its offset-seconds shadow below as the default\n// for render/* function signatures, which need a plain number and are never\n// actually hit by a real request (main.ts always passes the resolved\n// value through).\nexport const DEFAULT_CLIENT_TIME_ZONE = \"America/Los_Angeles\";\n\n// PDT, i.e. only correct roughly March-November. Stale for the other four\n// months by design: this is a signature default for pure functions\n// (timeParts, rowWidth, ...) that main.ts never actually relies on, since it\n// always threads through the live value resolveClientOffsetSeconds computed.\n// The real per-request fallback — used when `?tz=` is absent or rejected —\n// is DST-correct because it re-derives from DEFAULT_CLIENT_TIME_ZONE at\n// request time instead of reading this constant. Don't wire this into\n// resolveClientOffsetSeconds's fallback path; that would silently undo that.\nexport const DEFAULT_CLIENT_OFFSET_SECONDS = -25200;\n\n// The calendar date `now` falls on in `timeZone`. en-CA gives YYYY-MM-DD\n// directly, sorted the way ISO date math wants it. IANA-only — this is\n// Sleeper's half of the pipeline (see SLEEPER_TIME_ZONE); the client's half\n// is dateAtOffset below, on purpose kept as a separate function so the two\n// can't be swapped for each other by mistake.\nexport function localDateFor(timeZone: string, now = new Date()): string {\n return now.toLocaleDateString(\"en-CA\", { timeZone });\n}\n\n// Eastern's calendar date for `now` — the bucket Sleeper's /scores keys on.\n// Anchored off real UTC \"now\", not any app-local notion of \"today\".\nexport function todaySlateDate(now = new Date()): string {\n return localDateFor(SLEEPER_TIME_ZONE, now);\n}\n\nexport function addDays(isoDate: string, days: number): string {\n const [y, m, d] = isoDate.split(\"-\").map(Number);\n const date = new Date(Date.UTC(y, m - 1, d));\n date.setUTCDate(date.getUTCDate() + days);\n return date.toISOString().slice(0, 10);\n}\n\n// The client's half of the offset arithmetic: no DST table lookup, because\n// the offset it's given has already had DST folded into it (by the iOS\n// client, or by offsetSecondsForZone's live Intl lookup for the fallback\n// case) — adding seconds is all that's left to do. Shared by dateAtOffset\n// (which calendar day) and the render layer (what wall-clock time), so both\n// answer to the same arithmetic.\nexport function shiftByOffset(instant: Date, offsetSeconds: number): Date {\n return new Date(instant.getTime() + offsetSeconds * 1000);\n}\n\n// The calendar date `now` falls on at a fixed UTC offset — the client-offset\n// counterpart to localDateFor's IANA version. Deliberately not named\n// localDateFor*: the two take different kinds of timezone value (a name vs\n// a number of seconds) and reading the wrong one as the other would fail\n// only in the three-hour window that made this whole change necessary in\n// the first place.\nexport function dateAtOffset(offsetSeconds: number, now = new Date()): string {\n return shiftByOffset(now, offsetSeconds).toISOString().slice(0, 10);\n}\n\nconst DAY_OFFSETS: Record = { today: 0, tomorrow: 1 };\n\n// The png's card-copy prefix. Mostly keyed by the same terms as\n// DAY_OFFSETS — two maps rather than one entry with both fields because they\n// answer to different callers, the offset is URL contract and the word is\n// card copy — plus \"next\", which isn't a distinct offset (see\n// windowDatesFor: an unmapped term falls to today's offset, same as\n// DAY_OFFSETS's own `?? 0`) but still wants a word ahead of whichever date\n// in the window actually had a game.\nconst DAY_WORDS: Record = { today: \"Today\", tomorrow: \"Tomorrow\", next: \"Next\" };\n\nexport type SlateDateOptions = { now?: Date; clientOffsetSeconds?: number };\n\n// `today`/`tomorrow` resolve against the *client's* calendar day, not\n// Eastern's. The old version anchored on todaySlateDate (Eastern) directly,\n// which is wrong for three hours of every real-world day: at, say, 10pm\n// Pacific, Eastern has already rolled to the next date, so a Pacific caller\n// asking for \"today\" got tomorrow's slate.\n//\n// The date handed to Sleeper is the client's local date, unconverted — not\n// a further Eastern-coerced value. That's an accepted trade, not a missing\n// step: Sleeper buckets by Eastern day, so for a zone west of Eastern the\n// fetched window is the client's calendar day shifted a few hours earlier\n// (for Pacific: 9pm the previous evening through 9pm today). Games starting\n// after that cutoff fall in Eastern's next bucket and are absent from\n// \"today\" until the following request. Getting that last slice right needs\n// two Eastern buckets fetched and merged, filtered by each game's own\n// `start_time` — real work this task doesn't require, since the bug being\n// fixed here (the day boundary silently rolling 3 hours early, for everyone,\n// every single day) is the one that bites regardless of what's playing.\n// (A client zone east of Eastern — say Asia/Tokyo — is out of scope: this\n// widget has no client that far east.)\nexport function slateDateFor(term: string, opts: SlateDateOptions = {}): string {\n const { now = new Date(), clientOffsetSeconds = DEFAULT_CLIENT_OFFSET_SECONDS } = opts;\n const clientToday = dateAtOffset(clientOffsetSeconds, now);\n return addDays(clientToday, DAY_OFFSETS[term] ?? 0);\n}\n\n// The scan window behind every `day=` value. `days` ascending calendar\n// dates starting wherever `term` resolves to via slateDateFor — so\n// `today`/`tomorrow` only pick the window's *start* now, not a single exact\n// date, and `next` (or any unrecognized term) starts at the same offset\n// `today` does since neither has an entry in DAY_OFFSETS. Alpha-stage\n// relaxation (2026-08-26): `today`/`tomorrow` used to mean an exclusive\n// single date; loosened deliberately since this is a prototype, so the\n// server always scans rather than trusting the caller picked the one date\n// with a game. Sleeper has no team-schedule endpoint to answer \"when is\n// this team's next game\" directly (verified live against api.sleeper.app —\n// the only cheaper options are undocumented full-season dumps, up to 14MB\n// for mlb's daily slate), so the caller fetches one `/scores` request per\n// date in this window (in parallel — see main.ts) and picks the earliest\n// one that has a qualifying game. 3 days, not more: it comfortably covers\n// real in-season gaps (an nfl bye week, a rare mlb off-day) without the\n// window approaching the cost of an actual offseason scan, which is out of\n// scope by design — see docs/widget-next-up-plan.md.\nexport function windowDatesFor(\n term: string,\n clientOffsetSeconds: number,\n opts: { now?: Date; days?: number } = {},\n): string[] {\n const { now, days = 3 } = opts;\n const start = slateDateFor(term, { now, clientOffsetSeconds });\n return Array.from({ length: days }, (_, i) => addDays(start, i));\n}\n\n// The live GMT offset for an IANA zone at `now`, via Intl's own tables — so\n// the fallback path (an absent or rejected `?tz=`) stays DST-correct without\n// this file carrying a DST table of its own. \"longOffset\" is the\n// Intl.DateTimeFormat mode that always renders as \"GMT±HH:MM\", never a zone\n// abbreviation, which is what makes it parseable here.\nfunction offsetSecondsForZone(timeZone: string, now: Date): number {\n const part = new Intl.DateTimeFormat(\"en-US\", { timeZone, timeZoneName: \"longOffset\" })\n .formatToParts(now)\n .find((p) => p.type === \"timeZoneName\")?.value;\n const match = part && /^GMT([+-])(\\d{1,2}):(\\d{2})$/.exec(part);\n if (!match) return 0;\n const sign = match[1] === \"-\" ? -1 : 1;\n return sign * (Number(match[2]) * 3600 + Number(match[3]) * 60);\n}\n\n// Validates a `?tz=` value: iOS sends TimeZone.current.secondsFromGMT(), an\n// integer seconds-east-of-GMT that already has DST folded in, so there is no\n// DST table to consult on this side — just range-check it. Same rule as\n// sports[]/teams[] in lib/params.ts: never throw on a bad value — a 4xx\n// renders as a broken image in WidgetKit — fall back to a default and let\n// the caller echo the rejected raw value so drift is visible, not silent.\n//\n// The range [-12:00, +14:00] is every real-world UTC offset (Baker Island to\n// Kiribati); anything outside it is a malformed value, not just an unusual\n// zone. `Number.isInteger` also catches non-numeric junk (\"abc\" -> NaN,\n// which fails the check) and fractional seconds (\"3600.5\"), which a bare\n// `parseInt` would silently truncate through.\n//\n// One trade this accepts, deliberately not engineered around: a WidgetKit\n// timeline entry built before a DST transition and rendered after it still\n// carries the pre-transition offset until iOS refreshes the timeline, so a\n// card spanning the transition can show times an hour off for a window. The\n// client owns DST now; this file no longer has the information to catch it.\nexport function resolveClientOffsetSeconds(\n raw: string | null,\n now = new Date(),\n): { offsetSeconds: number; rejected: string | null } {\n const fallback = () => offsetSecondsForZone(DEFAULT_CLIENT_TIME_ZONE, now);\n if (!raw) return { offsetSeconds: fallback(), rejected: null };\n const parsed = Number(raw);\n if (!Number.isInteger(parsed) || parsed < -43200 || parsed > 50400) {\n return { offsetSeconds: fallback(), rejected: raw };\n }\n return { offsetSeconds: parsed, rejected: null };\n}\n\n// \"GMT-7\" / \"GMT+5:30\" / \"GMT\" for zero — the render layer's stand-in for a\n// zone abbreviation now that all it has is a number. No \"PDT\"-style name is\n// derivable from an offset alone (several zones share every offset), so this\n// is the honest version of that label rather than a guess at one.\nexport function offsetLabel(offsetSeconds: number): string {\n if (offsetSeconds === 0) return \"GMT\";\n const sign = offsetSeconds < 0 ? \"-\" : \"+\";\n const abs = Math.abs(offsetSeconds);\n const hours = Math.floor(abs / 3600);\n const minutes = Math.floor((abs % 3600) / 60);\n return `GMT${sign}${hours}${minutes ? \":\" + String(minutes).padStart(2, \"0\") : \"\"}`;\n}\n\n// isoDate is a plain calendar y-m-d (no timezone info), so format it as UTC\n// to avoid drifting a day off depending on the runtime's local timezone.\n//\n// `term` is the ?day= value the date was resolved from, and it leads the\n// label: \"Today · Wed Aug 19\". The date alone made the reader do the\n// lookup — a widget glanced at for two seconds should not have to answer\n// \"is Wed today?\" — and the word is the part that decides whether the card\n// is worth reading at all. Returned in title case; the png's eyebrow\n// uppercases it in CSS, the same way it already did with the bare date.\n//\n// An unrecognised term falls back to the bare date rather than interpolating\n// `undefined`, for the same reason slateDateFor takes `?? 0`: this renders\n// into a widget, where a wrong-looking card is worse than a plain one.\nexport function formatDateLabel(isoDate: string, term: string): string {\n const [y, m, d] = isoDate.split(\"-\").map(Number);\n const date = new Date(Date.UTC(y, m - 1, d));\n const weekday = date.toLocaleDateString(\"en-US\", { timeZone: \"UTC\", weekday: \"short\" });\n const monthDay = date.toLocaleDateString(\"en-US\", { timeZone: \"UTC\", month: \"short\", day: \"numeric\" });\n const label = `${weekday} ${monthDay}`;\n const word = DAY_WORDS[term];\n return word ? `${word} · ${label}` : label;\n}\n",[],[369,406],"45351325-5c04-47aa-8556-94b788e8f6e6","configStore.ts","01a054a3-42b9-74da-9ade-044a82b43f97",["D",1788126460839],"// The val's only persistent state, and its only other outbound I/O besides\n// lib/sleeper.ts's Sleeper calls — see that file's header for why pure logic\n// lives elsewhere. This one isn't reachable from tests/ either (bin/ci runs\n// under `node --experimental-strip-types`, which can't resolve the\n// `https://esm.town/...` specifier below), so it's verified by hitting the\n// deployed endpoint's /config/* routes instead, same as sleeper.ts and\n// render/png.ts. See docs/widget-config-plan.md for the schema rationale:\n// `configs` holds the helper-set favorite teams/sports (an attribute of one\n// config, stored as JSON, not a joined table); `device_configs` is the one\n// association this prototype needs (a device belongs to at most one config,\n// enforced by device_id being its primary key — re-pairing replaces, not\n// duplicates); `pairing_codes` is short-lived and reusable until it expires,\n// on purpose, so one code can pair several family devices to the same\n// config without regenerating it each time.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { type StoredConfig } from \"./config.ts\";\n\nconst CODE_ALPHABET = \"ABCDEFGHJKMNPQRSTUVWXYZ23456789\"; // no 0/O/1/I/L — read aloud over a phone call\nconst CODE_LENGTH = 6;\nconst CODE_TTL_SECONDS = 30 * 60;\n\nlet schemaReady: Promise | null = null;\n\n// Idempotent (CREATE TABLE IF NOT EXISTS), but memoized per process so a\n// warm val doesn't re-run three statements on every request — only the first\n// call after a cold start actually hits sqlite. The memo is cleared on\n// failure, not just on success: caching a rejected promise here would turn\n// one transient sqlite hiccup into every subsequent request in this process\n// failing until the val recycles.\nexport function ensureSchema(): Promise {\n if (!schemaReady) {\n schemaReady = sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS configs (\n id TEXT PRIMARY KEY,\n sports TEXT NOT NULL DEFAULT '[]',\n teams TEXT NOT NULL DEFAULT '[]',\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS pairing_codes (\n code TEXT PRIMARY KEY,\n config_id TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n created_at TEXT NOT NULL\n )`,\n args: [],\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS device_configs (\n device_id TEXT PRIMARY KEY,\n config_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n name TEXT\n )`,\n args: [],\n },\n {\n // Keyed by device_id independently of device_configs (not a FK) so\n // an APNs token can land before pairing does — AppDelegate.swift\n // uploads it on every app launch, regardless of pairing state.\n // lib/push.ts joins this against device_configs at send time to\n // find who to notify for a given config.\n sql: `CREATE TABLE IF NOT EXISTS device_tokens (\n device_id TEXT PRIMARY KEY,\n apns_token TEXT NOT NULL,\n updated_at TEXT NOT NULL\n )`,\n args: [],\n },\n ])\n .then(() => undefined)\n // A device_configs table created before the `name` column existed\n // won't pick it up from CREATE TABLE IF NOT EXISTS above — ALTER TABLE\n // is the migration path (see the sqlite-storage skill), and it's run\n // outside the batch/transaction above so its expected failure on an\n // already-migrated table (duplicate column) doesn't roll back the rest\n // of schema setup.\n .then(() => sqlite.execute(\"ALTER TABLE device_configs ADD COLUMN name TEXT\").then(() => undefined).catch(() => undefined))\n .catch((err) => {\n schemaReady = null;\n throw err;\n });\n }\n return schemaReady;\n}\n\nfunction nowIso(): string {\n return new Date().toISOString();\n}\n\n// pairing_codes.expires_at is a val-scoped (not branch-scoped) TEXT column,\n// so a branch that writes it in a different format — e.g. dev's epoch-second\n// integers, coerced to strings like \"1788040820.0\" by SQLite's TEXT affinity\n// — lands in the same table main reads. A naive string compare treats every\n// such row as permanently expired, since \"1...\" always sorts below the \"2...\"\n// ISO strings main writes. Parse defensively so a stray non-ISO row can't\n// silently break pairing for a code that hasn't actually expired.\nfunction expiresAtMs(value: string): number {\n const asFloat = Number(value);\n if (Number.isFinite(asFloat) && /^-?\\d+(\\.\\d+)?$/.test(value.trim())) {\n return asFloat * 1000;\n }\n return Date.parse(value);\n}\n\nfunction randomCode(): string {\n const bytes = new Uint8Array(CODE_LENGTH);\n crypto.getRandomValues(bytes);\n return Array.from(bytes, (b) => CODE_ALPHABET[b % CODE_ALPHABET.length]).join(\"\");\n}\n\nexport async function createConfig(config: StoredConfig = { sports: [], teams: [] }): Promise<{ id: string }> {\n await ensureSchema();\n const id = crypto.randomUUID();\n const ts = nowIso();\n await sqlite.execute({\n sql: \"INSERT INTO configs (id, sports, teams, created_at, updated_at) VALUES (?, ?, ?, ?, ?)\",\n args: [id, JSON.stringify(config.sports), JSON.stringify(config.teams), ts, ts],\n });\n return { id };\n}\n\nexport async function getConfig(id: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({ sql: \"SELECT sports, teams FROM configs WHERE id = ?\", args: [id] });\n const row = result.rows[0] as { sports: string; teams: string } | undefined;\n if (!row) return null;\n return { sports: JSON.parse(row.sports), teams: JSON.parse(row.teams) };\n}\n\n// Silently trusts its caller has already filtered sports/teams against\n// lib/catalog.ts — see render/configHtml.ts, whose checkboxes are generated\n// from that same table, which is what makes an invalid value structurally\n// hard to submit in the first place. The real safety net is downstream:\n// /config/resolve's redirect lands on `/`, where resolveParams validates\n// again regardless of what's stored here. Two independent validators would\n// only be able to drift from each other.\nexport async function updateConfig(id: string, config: StoredConfig): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"UPDATE configs SET sports = ?, teams = ?, updated_at = ? WHERE id = ?\",\n args: [JSON.stringify(config.sports), JSON.stringify(config.teams), nowIso(), id],\n });\n return result.rowsAffected > 0;\n}\n\nexport type ConfigSummary = {\n id: string;\n sports: string[];\n teams: string[];\n createdAt: string;\n updatedAt: string;\n deviceCount: number;\n};\n\n// What GET /config (the prototype-stage index of every config — see\n// render/configHtml.ts's configIndexDocument for why that route is allowed\n// to list every id) reads. A LEFT JOIN + COUNT rather than a second\n// per-row query: the index's whole purpose is telling configs apart, and\n// device count is effectively free at this table's scale (a handful of\n// configs, not a paginated one).\nexport async function listAllConfigs(): Promise {\n await ensureSchema();\n const result = await sqlite.execute(\n `SELECT c.id, c.sports, c.teams, c.created_at, c.updated_at, COUNT(dc.device_id) AS device_count\n FROM configs c\n LEFT JOIN device_configs dc ON dc.config_id = c.id\n GROUP BY c.id\n ORDER BY c.updated_at DESC`,\n );\n return (\n result.rows as {\n id: string;\n sports: string;\n teams: string;\n created_at: string;\n updated_at: string;\n device_count: number;\n }[]\n ).map((row) => ({\n id: row.id,\n sports: JSON.parse(row.sports),\n teams: JSON.parse(row.teams),\n createdAt: row.created_at,\n updatedAt: row.updated_at,\n deviceCount: row.device_count,\n }));\n}\n\n// Reusable until it expires (not single-use) — one code lets a helper pair\n// every device in a family to the same config without regenerating it per\n// device. Collisions are astronomically unlikely at this scale and are left\n// unhandled rather than retried, matching this codebase's general posture of\n// not engineering for inputs that can't realistically occur.\nexport async function createPairingCode(configId: string): Promise<{ code: string; expiresAt: string }> {\n await ensureSchema();\n const code = randomCode();\n const now = new Date();\n const ts = now.toISOString();\n const expiresAt = new Date(now.getTime() + CODE_TTL_SECONDS * 1000).toISOString();\n await sqlite.execute({\n sql: \"INSERT INTO pairing_codes (code, config_id, expires_at, created_at) VALUES (?, ?, ?, ?)\",\n args: [code, configId, expiresAt, ts],\n });\n return { code, expiresAt };\n}\n\n// The receiver's half of pairing: it already has its own device id (client-\n// generated, per docs/widget-config-plan.md) and types in the code the\n// helper's browser is showing. The upsert on device_id (the pivot table's\n// primary key) is what makes re-pairing replace an existing binding rather\n// than duplicate it.\nexport async function pairDevice(\n code: string,\n deviceId: string,\n): Promise<{ ok: true; configId: string } | { ok: false; reason: \"not_found\" | \"expired\" }> {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT config_id, expires_at FROM pairing_codes WHERE code = ?\",\n args: [code.trim().toUpperCase()],\n });\n const row = result.rows[0] as { config_id: string; expires_at: string } | undefined;\n if (!row) return { ok: false, reason: \"not_found\" };\n if (expiresAtMs(row.expires_at) < Date.now()) return { ok: false, reason: \"expired\" };\n\n // Upsert rather than INSERT OR REPLACE: REPLACE deletes and reinserts the\n // whole row, which would wipe out a name the configurator already set on\n // this device the moment it re-pairs to a different config. ON CONFLICT\n // DO UPDATE only touches config_id/created_at, leaving name untouched.\n await sqlite.execute({\n sql: `INSERT INTO device_configs (device_id, config_id, created_at, name) VALUES (?, ?, ?, NULL)\n ON CONFLICT(device_id) DO UPDATE SET config_id = excluded.config_id, created_at = excluded.created_at`,\n args: [deviceId, row.config_id, nowIso()],\n });\n return { ok: true, configId: row.config_id };\n}\n\n// The configurator's side of naming: they're the one looking at a list of\n// paired devices trying to tell \"dad\" from \"mom\", so naming happens on the\n// /config/:id page, not at pairing time. Empty string is treated the same\n// as null (an unnamed device), not stored as a zero-length name.\nexport async function renameDevice(deviceId: string, name: string | null): Promise {\n await ensureSchema();\n const trimmed = name?.trim() || null;\n const result = await sqlite.execute({\n sql: \"UPDATE device_configs SET name = ? WHERE device_id = ?\",\n args: [trimmed, deviceId],\n });\n return result.rowsAffected > 0;\n}\n\nexport type PairedDevice = { deviceId: string; name: string | null; createdAt: string };\n\n// What /config/:id lists so the configurator can see and name each device\n// paired to that config.\nexport async function listDevicesForConfig(configId: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: \"SELECT device_id, name, created_at FROM device_configs WHERE config_id = ? ORDER BY created_at\",\n args: [configId],\n });\n return (result.rows as { device_id: string; name: string | null; created_at: string }[]).map((row) => ({\n deviceId: row.device_id,\n name: row.name,\n createdAt: row.created_at,\n }));\n}\n\nexport type DeviceStatus = { configId: string; name: string | null; sports: string[]; teams: string[] };\n\n// What the app's diagnostics screen reads (GET /device/:deviceId) — this\n// device's full pairing status, not just the sports/teams resolveDevice()\n// below returns for the redirect path. Kept separate so that route's\n// never-null-error contract doesn't grow fields it doesn't need.\nexport async function getDeviceStatus(deviceId: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: `SELECT dc.config_id, dc.name, c.sports, c.teams FROM device_configs dc\n JOIN configs c ON c.id = dc.config_id\n WHERE dc.device_id = ?`,\n args: [deviceId],\n });\n const row = result.rows[0] as { config_id: string; name: string | null; sports: string; teams: string } | undefined;\n if (!row) return null;\n return { configId: row.config_id, name: row.name, sports: JSON.parse(row.sports), teams: JSON.parse(row.teams) };\n}\n\n// What /config/resolve calls. Returns null for an unknown or never-paired\n// device — not an error, just \"nothing to apply\" — which is what lets that\n// route fall back to the existing all-sports default instead of failing.\nexport async function resolveDevice(deviceId: string): Promise {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: `SELECT c.sports, c.teams FROM device_configs dc\n JOIN configs c ON c.id = dc.config_id\n WHERE dc.device_id = ?`,\n args: [deviceId],\n });\n const row = result.rows[0] as { sports: string; teams: string } | undefined;\n if (!row) return null;\n return { sports: JSON.parse(row.sports), teams: JSON.parse(row.teams) };\n}\n\n// The receiver's half of push registration (POST /device/token,\n// AppDelegate.swift's didRegisterForRemoteNotificationsWithDeviceToken) —\n// upsert, not insert, since tokens rotate and re-registering is expected,\n// not an error. Independent of device_configs on purpose: see the\n// device_tokens table comment above ensureSchema.\nexport async function saveDeviceToken(deviceId: string, token: string): Promise {\n await ensureSchema();\n await sqlite.execute({\n sql: `INSERT INTO device_tokens (device_id, apns_token, updated_at) VALUES (?, ?, ?)\n ON CONFLICT(device_id) DO UPDATE SET apns_token = excluded.apns_token, updated_at = excluded.updated_at`,\n args: [deviceId, token, nowIso()],\n });\n}\n\nexport async function deleteDeviceToken(deviceId: string): Promise {\n await ensureSchema();\n await sqlite.execute({ sql: \"DELETE FROM device_tokens WHERE device_id = ?\", args: [deviceId] });\n}\n\n// What lib/push.ts's notifyConfigDevices calls: every APNs token currently\n// belonging to a device paired to this config. A device paired but never\n// registered for push (or one whose token upload hasn't landed yet) simply\n// doesn't appear here — same \"nothing to do\" posture as resolveDevice.\nexport async function getTokensForConfig(configId: string): Promise<{ deviceId: string; token: string }[]> {\n await ensureSchema();\n const result = await sqlite.execute({\n sql: `SELECT dt.device_id, dt.apns_token FROM device_tokens dt\n JOIN device_configs dc ON dc.device_id = dt.device_id\n WHERE dc.config_id = ?`,\n args: [configId],\n });\n return (result.rows as { device_id: string; apns_token: string }[]).map((row) => ({\n deviceId: row.device_id,\n token: row.apns_token,\n }));\n}\n",[],[369,413],"27be4bd1-e0a9-4fb7-8c07-35f342ebf791","config.ts","01a054a3-42b9-74da-9ade-0352927677a9",["D",1788126380735],"// The /config/resolve -> / redirect: pure translation from a stored config\n// (favorite teams/sports) plus a receiver's per-request facts (canvas size,\n// client timezone) into the query string the existing stateless `/` route\n// already accepts. No I/O here — the sqlite lookup that produces a\n// StoredConfig lives in lib/configStore.ts instead, which is the impure half\n// bin/ci can't reach (see that file's header).\n//\n// `format` is never a param this file reads: /config/resolve exists only to\n// feed the native SwiftUI timeline provider, so `format=json` is baked into\n// every redirect it builds. See docs/widget-config-plan.md's 2026-08-27\n// amendment for why, and for why `w`/`h` collapse into one\n// `d=x` param here instead of staying separate the way `/`\n// itself still takes them — that part of `/`'s contract is unchanged.\n\nconst DEFAULT_WIDTH = 329;\nconst DEFAULT_HEIGHT = 155;\n\nexport type StoredConfig = { sports: string[]; teams: string[] };\nexport type ResolvePassthrough = { d?: string | null; tz?: string | null };\n\n// `d=1100x1146` -> {width, height}. Malformed or absent falls back to the\n// same defaults main.ts's own `w=`/`h=` parsing already uses (329x155) —\n// never-error, same posture as every other param this val accepts. A caller\n// sending `d=0x100` or `d=100x0` gets the default too: a zero-sized canvas\n// isn't a smaller-but-valid request, it's malformed the same way a negative\n// or missing one is.\nexport function parseDimensions(raw: string | null | undefined): { width: number; height: number } {\n const match = raw ? /^(\\d+)x(\\d+)$/.exec(raw.trim()) : null;\n if (match) {\n const width = Number(match[1]);\n const height = Number(match[2]);\n if (width > 0 && height > 0) return { width, height };\n }\n return { width: DEFAULT_WIDTH, height: DEFAULT_HEIGHT };\n}\n\n// Builds the path+query `/config/resolve` redirects to. Repeated `teams[]`/\n// `sports[]` params, matching the shape lib/params.ts's resolveParams already\n// validates on arrival at `/` — that validation is the real safety net, so\n// this function doesn't re-check slugs, it just carries whatever the stored\n// config has. An empty config (no teams, no sports) produces a URL with\n// neither param, which `/` already treats as \"all four sports\" today.\nexport function buildResolvedUrl(config: StoredConfig, passthrough: ResolvePassthrough = {}): string {\n const { width, height } = parseDimensions(passthrough.d);\n const params = new URLSearchParams();\n params.set(\"format\", \"json\");\n params.set(\"w\", String(width));\n params.set(\"h\", String(height));\n if (passthrough.tz) params.set(\"tz\", passthrough.tz);\n for (const sport of config.sports) params.append(\"sports[]\", sport);\n for (const team of config.teams) params.append(\"teams[]\", team);\n return `/?${params.toString()}`;\n}\n",[],[369,420],"db3687d5-c05e-4030-aaf2-b6b74b8c759c","color.ts","01a054a3-42b9-74da-9add-fed30f88cf89",["D",1788126380735],"// Pure color math — HSL conversion and WCAG contrast. Domain-free: this\n// file knows nothing about the widget's palette, only how to convert and\n// measure. The palette itself lives in render/theme.ts, which is what makes\n// the 360-hue contrast assertions in tests/theme.test.ts possible without\n// pulling in a renderer.\n\n// Returns 0-255 channels. Standard HSL->RGB; h in degrees, s and l in 0..1.\nexport function hslToRgb(h: number, s: number, l: number): [number, number, number] {\n const c = (1 - Math.abs(2 * l - 1)) * s;\n const hp = (((h % 360) + 360) % 360) / 60;\n const x = c * (1 - Math.abs((hp % 2) - 1));\n const [r1, g1, b1] =\n hp < 1 ? [c, x, 0]\n : hp < 2 ? [x, c, 0]\n : hp < 3 ? [0, c, x]\n : hp < 4 ? [0, x, c]\n : hp < 5 ? [x, 0, c]\n : [c, 0, x];\n const m = l - c / 2;\n return [r1 + m, g1 + m, b1 + m].map((v) => Math.round(v * 255)) as [number, number, number];\n}\n\n// WCAG relative luminance. Channels in 0-255.\nexport function relativeLuminance([r, g, b]: [number, number, number]): number {\n const channel = (v: number) => {\n const s = v / 255;\n return s <= 0.03928 ? s / 12.92 : Math.pow((s + 0.055) / 1.055, 2.4);\n };\n return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b);\n}\n\n// WCAG contrast ratio between two relative luminances.\nexport function contrastRatio(a: number, b: number): number {\n const [hi, lo] = a > b ? [a, b] : [b, a];\n return (hi + 0.05) / (lo + 0.05);\n}\n",[],[369,427],"797f6467-b9a4-4f65-9346-58faabdf9001","channels.ts","01a054a3-42b9-74da-9add-f924247bf434",["D",1788126380735],"// Turns Sleeper's raw channel string into the shape every render target\n// reads. Pure — the dictionaries it consults live in catalog.ts.\n\nimport { MAX_CHANNEL_LABEL, NATIONAL_CHANNELS, STREAMING_CHANNELS } from \"./catalog.ts\";\nimport { chop } from \"./text.ts\";\n\n// `name` stays the raw string Sleeper sent — it is the drift-detection\n// value, and the json format has to keep reporting what actually arrived.\n// `label` is the display form: dictionary-mapped where there is a mapping,\n// chopped raw text where there isn't.\nexport type ChannelInfo = {\n category: string;\n name: string | null;\n label: string | null;\n directv_channel: number | null;\n note: string | null;\n};\n\nfunction channelMatches(rawChannel: string, key: string) {\n return new RegExp(`\\\\b${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\b`, \"i\").test(rawChannel);\n}\n\nexport function channelInfo(rawChannel: string | null | undefined): ChannelInfo {\n if (!rawChannel) return { category: \"unknown\", name: null, label: null, directv_channel: null, note: null };\n\n const nationalKey = Object.keys(NATIONAL_CHANNELS).find((key) => channelMatches(rawChannel, key));\n if (nationalKey) return { category: \"national\", name: rawChannel, ...NATIONAL_CHANNELS[nationalKey] };\n\n const streamingKey = Object.keys(STREAMING_CHANNELS).find((key) => channelMatches(rawChannel, key));\n if (streamingKey) {\n return { category: \"streaming\", name: rawChannel, directv_channel: null, ...STREAMING_CHANNELS[streamingKey] };\n }\n\n return {\n category: \"regional\",\n name: rawChannel,\n label: chop(rawChannel, MAX_CHANNEL_LABEL),\n directv_channel: null,\n note: null,\n };\n}\n",[],[369,434],"1cfc62c5-5779-4837-9d74-c500294a5cb4","catalog.ts","01a054a3-42b9-74da-9add-f4f78396b5aa",["D",1788126380735],"// The static tables the rest of the val reads: what sports exist, how\n// channels map to display forms and DirecTV numbers, and which team slugs\n// the URL accepts. Data only — no functions, no I/O — so every other module\n// can import it without dragging behaviour along.\n//\n// Ported from app/controllers/games_controller.rb.\n\n// Doubles as the fetch list, the allowlist for the `sports[]` param, and\n// the group order in the rendered output. Order is display order, not\n// significance — nfl first because it's the one with a hard weekly cadence.\n//\n// Growing this from nfl+wnba to four sports makes an unfiltered slate large\n// (mlb+wnba alone returned 19 games on 2026-08-18), which is the whole\n// reason the `teams[]` filter exists — see docs/widget-param-contract.md.\nexport const SPORTS = [\"nfl\", \"wnba\", \"mlb\", \"nba\"];\n\n// Per-sport decoration for the widget's mainText template\n// (render/templates.ts's DEFAULT_WIDGET_TEMPLATE), at explicit request.\n// wnba and nba share the basketball emoji — same sport, same ball, just two\n// separate SPORTS entries (see the nba-deferred note on TEAMS above) — nfl\n// gets football, mlb gets baseball. Keyed on the same sport string as\n// SPORTS/TEAMS, not a separate vocabulary. `Partial` because a sport added\n// to SPORTS later has no entry until one is deliberately added here — a\n// plain `Record` would claim every sport already does.\nexport const SPORT_EMOJI: Partial> = {\n nfl: \"🏈\",\n wnba: \"🏀\",\n mlb: \"⚾\",\n nba: \"🏀\",\n};\n\n// Ported from GamesController::NATIONAL_CHANNELS /\n// GamesController::STREAMING_CHANNELS. See that file for the reasoning\n// behind word-boundary matching (plain substring mislabels \"NBCS-PH\" as an\n// NBC affiliate) and the amzn/amazon dual-key (Sleeper sends the long form\n// for mlb/wnba).\n//\n// `label` is this file's own addition, not in the Rails port: the short form\n// the png draws. It exists because Sleeper's raw strings are not sized for a\n// widget — \"Amazon Prime Video\" is 18 characters and ran off the side of a\n// large card. The values are a small bounded set, so they get a mapping\n// rather than a measuring algorithm. AMZN is Sleeper's own abbreviation for\n// that channel (it sends both forms, hence the dual key below), so this\n// shortens to something the source already uses rather than inventing one.\nexport const NATIONAL_CHANNELS: Record = {\n abc: { label: \"ABC\", directv_channel: 4, note: null },\n cbs: { label: \"CBS\", directv_channel: 2, note: null },\n espn: { label: \"ESPN\", directv_channel: 206, note: null },\n ion: { label: \"ION\", directv_channel: 305, note: null },\n nbatv: { label: \"NBATV\", directv_channel: 216, note: null },\n nbc: { label: \"NBC\", directv_channel: 4, note: null },\n tbs: { label: \"TBS\", directv_channel: 247, note: null },\n usa: { label: \"USA\", directv_channel: 242, note: null },\n sportsnet: { label: \"SportsNet\", directv_channel: 691, note: null },\n};\n\nexport const STREAMING_CHANNELS: Record = {\n amzn: { label: \"AMZN\", note: \"computer only\" },\n amazon: { label: \"AMZN\", note: \"computer only\" },\n peacock: { label: \"Peacock\", note: \"computer only\" },\n};\n\n// The backstop for the one category that has no mapping: a regional channel\n// is whatever free text Sleeper sent, so it cannot be bounded by a\n// dictionary the way the two above are. Real values are already short\n// (SNY, MARQ, NESN, MASN, NBCS-PH), so this only fires on something\n// unusual — a blunt chop rather than a width measurement, which is all a\n// backstop needs to be.\nexport const MAX_CHANNEL_LABEL = 10;\n\n// ---- favorite teams ----\n//\n// Slug -> (sport, Sleeper code). The pair matters: Sleeper's abbreviations\n// are NOT unique across sports. `IND` is the Fever (wnba), the Colts (nfl)\n// and the Pacers (nba) — all three confirmed in live data and captured in\n// test/fixtures/files/sleeper/. Matching a bare code would make \"fever\" pull\n// in Colts and Pacers games. `WAS` (nfl + wnba, while mlb uses `WSH`) plus\n// ATL/MIN/CHI/DET/HOU/TOR/BOS/TB/SEA/PHI/PIT are the same trap, now realized\n// as nfl, wnba and mlb have all grown into it — every one of those codes now\n// names a different franchise depending on sport, which is exactly why the\n// pair (not the bare code) is what's stored.\n//\n// A second, separate collision shows up on the *slug* side, not the code\n// side: two mascots can share a name across sports even when their codes\n// don't collide. `cardinals` (nfl Arizona, code ARI) and `giants` (nfl New\n// York, code NYG) were claimed first, so their mlb namesakes (St. Louis,\n// code STL; San Francisco, code SF) get a city-prefixed slug instead —\n// `st-louis-cardinals`, `san-francisco-giants`. Spelled out rather than\n// abbreviated (`stl-`, `sf-`) because titleCase() only capitalizes each\n// hyphen-split word's first letter — `sf-giants` would render as \"Sf\n// Giants\", not \"SF Giants\". Every other mlb slug is unprefixed.\n//\n// The URL carries slugs, not codes, and this table is the only place the\n// mapping lives. That's deliberate: the iOS app ships a picker, and every\n// app-side change costs a build-number bump on both the app and the widget\n// extension plus an upload. Adding a team here is a val deploy instead. See\n// docs/widget-ios-brief.md.\n//\n// Every code here is asserted against a real captured fixture for its sport\n// — but a fixture only proves the code was valid on its capture date, not\n// that Sleeper still uses it. The runtime echo (rejected/unmatched surfaced\n// to the caller) is the actual drift detector.\nexport type TeamRef = { sport: string; code: string };\n\nexport const TEAMS: Record = {\n // wnba — all 15 teams for the 2026 season (includes the Valkyries,\n // Tempo, and Fire expansions), codes confirmed against live\n // api.sleeper.app/scores responses.\n dream: { sport: \"wnba\", code: \"ATL\" },\n sky: { sport: \"wnba\", code: \"CHI\" },\n sun: { sport: \"wnba\", code: \"CON\" },\n wings: { sport: \"wnba\", code: \"DAL\" },\n valkyries: { sport: \"wnba\", code: \"GSV\" },\n fever: { sport: \"wnba\", code: \"IND\" },\n sparks: { sport: \"wnba\", code: \"LAS\" },\n aces: { sport: \"wnba\", code: \"LVA\" },\n lynx: { sport: \"wnba\", code: \"MIN\" },\n liberty: { sport: \"wnba\", code: \"NYL\" },\n fire: { sport: \"wnba\", code: \"PDX\" },\n mercury: { sport: \"wnba\", code: \"PHO\" },\n storm: { sport: \"wnba\", code: \"SEA\" },\n tempo: { sport: \"wnba\", code: \"TOR\" },\n mystics: { sport: \"wnba\", code: \"WAS\" },\n\n // nfl — all 32 teams, codes confirmed against live\n // api.sleeper.app/scores responses.\n cardinals: { sport: \"nfl\", code: \"ARI\" },\n falcons: { sport: \"nfl\", code: \"ATL\" },\n ravens: { sport: \"nfl\", code: \"BAL\" },\n bills: { sport: \"nfl\", code: \"BUF\" },\n panthers: { sport: \"nfl\", code: \"CAR\" },\n bears: { sport: \"nfl\", code: \"CHI\" },\n bengals: { sport: \"nfl\", code: \"CIN\" },\n browns: { sport: \"nfl\", code: \"CLE\" },\n cowboys: { sport: \"nfl\", code: \"DAL\" },\n broncos: { sport: \"nfl\", code: \"DEN\" },\n lions: { sport: \"nfl\", code: \"DET\" },\n packers: { sport: \"nfl\", code: \"GB\" },\n texans: { sport: \"nfl\", code: \"HOU\" },\n colts: { sport: \"nfl\", code: \"IND\" },\n jaguars: { sport: \"nfl\", code: \"JAX\" },\n chiefs: { sport: \"nfl\", code: \"KC\" },\n chargers: { sport: \"nfl\", code: \"LAC\" },\n rams: { sport: \"nfl\", code: \"LAR\" },\n raiders: { sport: \"nfl\", code: \"LV\" },\n dolphins: { sport: \"nfl\", code: \"MIA\" },\n vikings: { sport: \"nfl\", code: \"MIN\" },\n patriots: { sport: \"nfl\", code: \"NE\" },\n saints: { sport: \"nfl\", code: \"NO\" },\n giants: { sport: \"nfl\", code: \"NYG\" },\n jets: { sport: \"nfl\", code: \"NYJ\" },\n eagles: { sport: \"nfl\", code: \"PHI\" },\n steelers: { sport: \"nfl\", code: \"PIT\" },\n seahawks: { sport: \"nfl\", code: \"SEA\" },\n \"49ers\": { sport: \"nfl\", code: \"SF\" },\n buccaneers: { sport: \"nfl\", code: \"TB\" },\n titans: { sport: \"nfl\", code: \"TEN\" },\n commanders: { sport: \"nfl\", code: \"WAS\" },\n\n // mlb — all 30 teams, codes confirmed against live\n // api.sleeper.app/scores responses. Two mascot names collide with an nfl\n // slug already in this table (Cardinals, Giants) — those two get a city\n // prefix; every other mlb slug is unprefixed.\n athletics: { sport: \"mlb\", code: \"ATH\" },\n braves: { sport: \"mlb\", code: \"ATL\" },\n diamondbacks: { sport: \"mlb\", code: \"AZ\" },\n orioles: { sport: \"mlb\", code: \"BAL\" },\n \"red-sox\": { sport: \"mlb\", code: \"BOS\" },\n cubs: { sport: \"mlb\", code: \"CHC\" },\n reds: { sport: \"mlb\", code: \"CIN\" },\n guardians: { sport: \"mlb\", code: \"CLE\" },\n rockies: { sport: \"mlb\", code: \"COL\" },\n \"white-sox\": { sport: \"mlb\", code: \"CWS\" },\n tigers: { sport: \"mlb\", code: \"DET\" },\n astros: { sport: \"mlb\", code: \"HOU\" },\n royals: { sport: \"mlb\", code: \"KC\" },\n angels: { sport: \"mlb\", code: \"LAA\" },\n dodgers: { sport: \"mlb\", code: \"LAD\" },\n marlins: { sport: \"mlb\", code: \"MIA\" },\n brewers: { sport: \"mlb\", code: \"MIL\" },\n twins: { sport: \"mlb\", code: \"MIN\" },\n mets: { sport: \"mlb\", code: \"NYM\" },\n yankees: { sport: \"mlb\", code: \"NYY\" },\n phillies: { sport: \"mlb\", code: \"PHI\" },\n pirates: { sport: \"mlb\", code: \"PIT\" },\n padres: { sport: \"mlb\", code: \"SD\" },\n mariners: { sport: \"mlb\", code: \"SEA\" },\n \"san-francisco-giants\": { sport: \"mlb\", code: \"SF\" },\n \"st-louis-cardinals\": { sport: \"mlb\", code: \"STL\" },\n rays: { sport: \"mlb\", code: \"TB\" },\n rangers: { sport: \"mlb\", code: \"TEX\" },\n \"blue-jays\": { sport: \"mlb\", code: \"TOR\" },\n nationals: { sport: \"mlb\", code: \"WSH\" },\n\n // nba — left as-is for now, deferred until later.\n lakers: { sport: \"nba\", code: \"LAL\" },\n warriors: { sport: \"nba\", code: \"GSW\" },\n};\n\n// This exists to bound a malformed URL, not to express a preference — it\n// must sit above any realistic favorites selection. 12 was fine when the\n// table only had 7 slugs total, but now that wnba (15), nfl (32) and mlb\n// (30) are fully mapped, a user favoriting a whole league — or several —\n// is normal input, not a malformed URL, and a lower cap would reject them\n// with a drift marker for doing nothing wrong. Set with headroom above the\n// eventual four-sport table (nfl+wnba+mlb+nba is ~110 teams) so adding nba\n// later doesn't require raising this again.\nexport const MAX_TEAMS = 120;\n",[],[369,441],"64e24bfb-c048-4382-bed5-a598cd5cd278",["D",1788126380735],[291,292,293,294,295,296,297,298,299,300,301,302],[369],["D",1787009561780],["D",1789532458193],{"_11":12,"_199":91},{"_11":12,"_195":-5,"_90":91,"_31":89,"_196":197,"_198":30},{"_40":185,"_13":16,"_34":37,"_186":149,"_187":79,"_188":189,"_190":153,"_191":149,"_192":43,"_193":14,"_194":12},"ctx",{"_55":-5,"_219":489,"_490":491,"_492":493,"_494":30,"_495":30,"_496":30,"_497":24,"_498":-5,"_499":-7,"_500":-7,"_501":26,"_502":30,"_503":30,"_504":-5,"_505":30,"_506":30,"_507":30,"_508":-5},"ENV",{"_460":461,"_462":463,"_464":80,"_465":466,"_467":468,"_469":470,"_471":472,"_473":474,"_475":476,"_477":478,"_479":480,"_481":482,"_483":484,"_485":486,"_487":488},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · render