[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_247":248,"_249":250},"routes/_app.x.$handle.$name",{"_140":139,"_38":90,"_148":130,"_33":149,"_13":14,"_150":-5,"_11":151,"_152":153,"_154":155,"_156":157,"_158":159,"_27":-5,"_160":-5,"_161":-5,"_162":31,"_163":164,"_165":31,"_166":-5,"_167":-5,"_168":169},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_88":89,"_38":90,"_44":91,"_92":-5,"_93":31,"_94":95,"_96":95,"_97":98,"_99":-5,"_18":100,"_101":-5,"_102":31,"_103":-5,"_104":-5,"_105":106,"_107":108,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":123,"_124":125,"_126":127,"_128":31},"version",2,"changes",[19,20,21,22,23,24,25,26],"aiChatInfo","userId",{"_27":84,"_29":-7,"_30":31,"_32":31,"_33":85,"_35":85},{"_27":78,"_29":-7,"_30":31,"_32":31,"_33":79,"_35":79},{"_27":72,"_29":-7,"_30":31,"_32":31,"_33":73,"_35":73},{"_27":66,"_29":-7,"_30":31,"_32":31,"_33":67,"_35":67},{"_27":60,"_29":-7,"_30":31,"_32":31,"_33":61,"_35":61},{"_27":54,"_29":-7,"_30":31,"_32":31,"_33":55,"_35":55},{"_27":49,"_29":-7,"_30":31,"_32":31,"_33":50,"_35":50},{"_27":28,"_29":-7,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous","deleted",false,"deletedHere","path","tools/sdk-check.ts","latestPath","fileId","01a07fdc-4571-76ba-9009-fc3e091cae54","name","sdk-check.ts","fileType","script","content","// Two things, both about the SDK rather than about sports:\n//\n// 1. The boundary lint. sdk/ must not import anything outside sdk/, and must\n// not mention this val's domain. That is what makes the directory liftable\n// into its own published val, and it is the kind of rule that decays\n// silently under a hurry, so it is checked rather than asked for.\n//\n// 2. A conformance suite run against a FIXTURE source defined right here —\n// no database, no network, no games. If this passes, serveSource\n// implements the protocol for any source, not just this val's.\n//\n// The fixture below doubles as the reference implementation: it is the\n// smallest thing that is a complete source, and copying it is a reasonable way\n// to start a new one.\n//\n// Touches no storage and no production data. Safe to run anywhere.\n\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { accept, type Item, reject } from \"../sdk/contract.ts\";\nimport { defineSource, type SourceDefinition } from \"../sdk/defineSource.ts\";\nimport { serveSource } from \"../sdk/serve.ts\";\n\nfunction check(value: unknown, message: string): asserts value {\n if (!value) throw new Error(message);\n}\n\n// ---------------------------------------------------------------- boundary --\n\nconst SDK_FILES = [\"/sdk/contract.ts\", \"/sdk/defineSource.ts\", \"/sdk/serve.ts\"];\n\n// Words that mean this val in particular. The SDK may not know any of them.\n// (Checked against code only — sdk/README.md uses them in its examples, which\n// is exactly where domain vocabulary belongs.)\nconst DOMAIN_WORDS = [\"sport\", \"team\", \"game\", \"sleeper\", \"fiba\", \"catalog\", \"widget\", \"channel\"];\n\nfor (const path of SDK_FILES) {\n const code = await readFile(path, import.meta.url);\n\n // Every import must be relative and stay inside sdk/. This also rules out\n // remote imports, so the published SDK has zero dependencies — including on\n // Val Town's own std, which is what lets a source run somewhere else.\n for (const [, specifier] of code.matchAll(/(?:^|\\n)\\s*(?:import|export)[^;]*?from\\s+[\"']([^\"']+)[\"']/g)) {\n check(\n specifier.startsWith(\"./\") && !specifier.includes(\"..\"),\n `${path} imports outside sdk/: ${specifier}`,\n );\n }\n\n // Strip comments before the vocabulary scan: prose may say \"a catalog, say\"\n // while explaining what `options` is for. Identifiers may not.\n const source = code.replace(/\\/\\/[^\\n]*/g, \"\").replace(/\\/\\*[\\s\\S]*?\\*\\//g, \"\").toLowerCase();\n for (const word of DOMAIN_WORDS) {\n check(!source.includes(word), `${path} names this val's domain in code: \"${word}\"`);\n }\n}\n\n// ------------------------------------------------------------- conformance --\n\nconst fixture = defineSource<{ count: number }>({\n key: \"fixture\",\n // `temporal` deliberately omitted, to prove the descriptor defaults it.\n settingsSchema: {\n type: \"object\",\n properties: { count: { type: \"integer\" } },\n required: [\"count\"],\n additionalProperties: false,\n },\n parseSettings: (raw) =>\n typeof raw.count === \"number\" && Number.isInteger(raw.count) && raw.count >= 0\n ? accept({ count: raw.count })\n : reject(\"invalid_settings\"),\n read: ({ count }, context) =>\n Promise.resolve(Array.from({ length: count }, (_, i): Item => ({\n id: `fixture-${i}`,\n mainText: `Item ${i}`,\n // Echoed so the assertions below can prove the context reached the\n // source rather than being swallowed by the protocol layer.\n subText: String(context.utcOffsetSeconds),\n caption: null,\n emphasized: false,\n timestamp: 1788739200 + i,\n }))),\n writes: {\n echo: (payload) =>\n typeof payload.value === \"string\"\n ? accept({ echoed: payload.value })\n : reject(\"invalid_value\"),\n },\n});\n\n// A source that breaks the item contract, to prove the SDK catches it rather\n// than passing it to the parent: two items with the same id.\nconst brokenSource = defineSource({\n key: \"broken\",\n settingsSchema: {},\n parseSettings: () => accept(null),\n read: () =>\n Promise.resolve([0, 0].map((): Item => ({\n id: \"duplicate\",\n mainText: \"\",\n subText: \"\",\n caption: null,\n emphasized: false,\n timestamp: 1788739200,\n }))),\n});\n\nconst BASE = { protocolVersion: 1, sourceKey: \"fixture\" };\n// deno-lint-ignore no-explicit-any -- the harness drives two differently-typed\n// definitions through one helper; serveSource's own generic is what's under test.\ntype Definition = SourceDefinition;\n\nfunction call(definition: Definition, path: string, body?: unknown, rawBody?: string) {\n const init: RequestInit = body !== undefined || rawBody !== undefined\n ? { method: \"POST\", body: rawBody ?? JSON.stringify(body) }\n : {};\n return serveSource(definition, new Request(\"https://fixture.invalid\" + path, init));\n}\nasync function status(definition: Definition, path: string, body?: unknown, rawBody?: string) {\n const response = await call(definition, path, body, rawBody);\n return { code: response.status, json: await response.json() };\n}\n\n// Descriptor: derived capabilities, defaulted temporal, absent options.\nconst descriptor = await (await call(fixture, \"/v1/descriptor\")).json();\ncheck(descriptor.sourceKey === \"fixture\" && descriptor.protocolVersion === 1, \"descriptor identity\");\ncheck(descriptor.temporal === true, \"temporal did not default to true\");\ncheck(!(\"options\" in descriptor), \"options published by a source that declares none\");\ncheck(\n JSON.stringify(descriptor.capabilities) === JSON.stringify({ read: true, validateSettings: true, write: [\"echo\"], publish: false }),\n \"capabilities not derived from the definition\",\n);\ncheck((await status(fixture, \"/v1/descriptor?sourceKey=other\")).code === 404, \"wrong key reached the descriptor\");\n\n// Validation does not read, write, or leak parseSettings' internal output.\nlet readCalls = 0;\nconst validationFixture = defineSource({\n key:\"validation\",\n settingsSchema: async () => ({type:\"object\",properties:{},additionalProperties:false}),\n parseSettings: (raw) => Object.keys(raw).length === 0 ? accept({privateContext:\"secret\"}) : reject(\"invalid_settings\"),\n read: async () => { readCalls++; return []; },\n});\nconst valid = await status(validationFixture,\"/v1/validate-settings\",{\n protocolVersion:1,sourceKey:\"validation\",settings:{},\n});\ncheck(valid.code === 200 && valid.json.ok === true && !(\"privateContext\" in valid.json) &&\n Object.keys(valid.json).length === 3 && readCalls === 0, \"validation-only boundary\");\ncheck((await status(validationFixture,\"/v1/validate-settings\",{\n protocolVersion:1,sourceKey:\"validation\",settings:{unknown:true},\n})).code === 400,\"validation rejected unknown settings\");\ncheck((await status(validationFixture,\"/v1/descriptor\")).json.settingsSchema.type === \"object\",\"dynamic schema\");\n\n// Read: the happy path, and that context and settings both arrive intact.\nconst read = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: 3 },\n context: { utcOffsetSeconds: -25200 },\n});\ncheck(read.code === 200 && read.json.items.length === 3, \"read did not return the source's items\");\ncheck(read.json.items[0].subText === \"-25200\", \"context.utcOffsetSeconds did not reach the source\");\ncheck(read.json.sourceKey === \"fixture\", \"read envelope identity\");\n\nconst nullOffset = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: 1 },\n context: { utcOffsetSeconds: null },\n});\n// null must arrive AS null. Coercing it to 0 here would silently move every\n// day boundary to UTC for callers the parent couldn't resolve.\ncheck(nullOffset.json.items[0].subText === \"null\", \"null offset was coerced before the source saw it\");\n\n// Read: the ways it is refused.\nconst badSettings = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: \"x\" },\n context: { utcOffsetSeconds: 0 },\n});\ncheck(badSettings.code === 400 && badSettings.json.error === \"invalid_settings\", \"parseSettings rejection not surfaced\");\n// The offset guard runs BEFORE parseSettings, so an absent utcOffsetSeconds is\n// invalid_timezone and not the source's business. The parent always sends the\n// key (null when it has no value), so this only bites a hand-written request.\ncheck(\n (await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 }, context: {} })).json.error === \"invalid_timezone\",\n \"absent offset silently accepted\",\n);\ncheck((await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 } })).code === 400, \"missing context accepted\");\ncheck(\n (await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 }, context: { utcOffsetSeconds: 86401 } }))\n .json.error === \"invalid_timezone\",\n \"out-of-range offset accepted\",\n);\ncheck((await status(fixture, \"/v1/read\", { ...BASE, protocolVersion: 2 })).json.error === \"unsupported_protocol\", \"protocol version\");\ncheck((await status(fixture, \"/v1/read\", undefined, \"{not json\")).json.error === \"invalid_json\", \"malformed json\");\ncheck((await status(fixture, \"/v1/read\", [])).json.error === \"invalid_body\", \"array body accepted\");\ncheck((await status(fixture, \"/v1/read\", { ...BASE, sourceKey: \"other\" })).code === 404, \"foreign sourceKey\");\n\n// The output guard: a source that breaks the contract fails here, not at the\n// parent.\nconst broken = await status(\n brokenSource,\n \"/v1/read\",\n { protocolVersion: 1, sourceKey: \"broken\", settings: {}, context: { utcOffsetSeconds: 0 } },\n);\ncheck(broken.code === 502 && broken.json.error === \"invalid_source_output\", \"duplicate ids escaped the source\");\n\n// Writes.\nconst echo = await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: { value: \"hi\" } });\ncheck(echo.code === 200 && echo.json.ok === true && echo.json.result.echoed === \"hi\", \"write did not run\");\ncheck(\n (await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: { value: 1 } })).json.error === \"invalid_value\",\n \"write rejection not surfaced\",\n);\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"nope\", payload: {} })).code === 422, \"unknown operation\");\n// Object.prototype must not be reachable as an operation.\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"toString\", payload: {} })).code === 422, \"prototype method invoked as an operation\");\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: \"x\" })).json.error === \"invalid_payload\", \"non-object payload accepted\");\ncheck(\n (await status(brokenSource, \"/v1/write\", { protocolVersion: 1, sourceKey: \"broken\", operation: \"echo\", payload: {} })).code === 422,\n \"a source with no writes accepted one\",\n);\n\n// Reserved and unknown routes.\ncheck((await status(fixture, \"/v1/publish\", BASE)).code === 501, \"publish stub\");\ncheck((await status(fixture, \"/v1/nope\", BASE)).json.error === \"not_found\", \"unknown route\");\n\nconsole.log(`PASS: sdk/ imports nothing outside itself and names no domain concept; serveSource conforms for a fixture source with no storage.`);\n","createdAt",["D",1788851537264],"branchVersion","branchId","18439a77-9162-403a-ad4d-e69e4496f0d9",{"_36":51,"_38":50,"_40":52,"_42":-5,"_44":53,"_46":14,"_47":48,"_30":31},"tools","01a07fdc-4571-76ba-9009-fa3c6e2258ea","directory",["D",1788851537264],{"_36":56,"_38":57,"_40":27,"_42":58,"_44":59,"_46":14,"_47":48,"_30":31},"sdk/settings-form.md","01a07fdc-4571-76ba-9009-f7fa4b177f79","settings-form.md","# Source settings form contract\n\nThe parent renders source settings from authenticated `GET /v1/descriptor?sourceKey=...`.\nIt checks protocol/source identity, `temporal:true`, and\n`capabilities.validateSettings:true`. The live schema is authoritative for the\nform; stored registry schema snapshots are not used for editing.\n\n## Supported JSON Schema subset\n\nThe root is `{type:\"object\",properties:{...},additionalProperties:false}`.\nAn optional `required` array names declared properties. Each property has a\n`title`, optional `description`, and one of these shapes:\n\n- Boolean: `{type:\"boolean\",title:\"Show alerts\",default:false}`.\n- Multiple choices: `{type:\"array\",title:\"Locations\",default:[],uniqueItems:true,\n items:{type:\"string\",oneOf:[{const:\"west\",title:\"West\",\"x-group\":\"Regions\"}]}}`.\n\n`x-group` is the only UI extension. Choice values are stable strings;\ntitles and optional groups are display text. Declaration order determines form\norder. Defaults apply when displaying a field with no saved value. Empty\n`properties` means no settings. Field names start with a letter and contain\nonly letters, digits, and underscores; prototype-related names are rejected.\n\nUnsupported property types or constraints fail closed, with no save form.\nThis is deliberately not a general JSON Schema renderer. No nested objects,\nfree text, numbers, conditional fields, pagination, or source-supplied HTML/JS.\nAll labels are escaped by React. Legacy descriptor `options` is not consumed:\nthe choice-to-property binding is inside `settingsSchema`.\n\nA source may provide a static schema or an async `settingsSchema()` function.\nSports builds choices from its catalog in one descriptor request. Moon publishes\nthe empty object schema. No source data tables need changing.\n\n## Saving\n\nThe form includes a fingerprint of the rendered fields. The parent reloads the\ndescriptor on POST and rejects a changed fingerprint with 409; it does not\nsilently interpret an old form against new controls or choices.\n\nThe parent decodes only declared fields. Unchecked booleans become false and\nunselected arrays become []; defaults do not override an intentional clearing.\nUnknown fields, duplicate values, and unavailable choices are rejected.\nPreviously saved choices that disappear remain visible as checked unavailable\nvalues, requiring explicit removal.\n\nBefore persisting, the parent sends\n`POST /v1/validate-settings` with\n`{protocolVersion:1,sourceKey,settings}`.\nThe SDK invokes the same `parseSettings` used by reads and returns only\n`{protocolVersion:1,sourceKey,ok:true}`. It does not call `read`, perform writes,\nor expose parsed internal context. Implementers must keep `parseSettings`\nfree of mutation. Validation remains source-authoritative on every feed read,\nsince data/choices may change after a settings save.\n\nSource validation errors retain their stable error code. Unavailability returns\n502, invalid settings 422, and stale forms 409. None changes the assignment.\nSuccessful saves persist the original wire settings, then use the existing\ndevice notification path.\n\n## Scope and remaining coupling\n\nDevice settings routes and rendering have no source-kind dispatch, field-name\nknowledge, or sports catalog import. Another source supporting this profile\nneeds only a registered pointer and its descriptor/validation/read implementation.\n\nPrototype starter-feed defaults and operator ingestion/catalog/coverage adapters\nstill refer to Sports/Moon instance IDs. Removing those is separate from settings\nforms. Immutable releases, descriptor caching, schema migrations, and agent ACLs\nremain deferred.\n",["D",1788851537264],{"_36":62,"_38":63,"_40":41,"_42":64,"_44":65,"_46":14,"_47":48,"_30":31},"sdk/serve.ts","01a07fdc-4571-76ba-9009-f28dbdde6525","serve.ts","// Version 1 of the source protocol, as a function of a SourceDefinition.\n// Everything here is the same for every source, which is exactly why it is\n// here and not in the source: an implementer who writes this by hand writes\n// the envelopes, the status codes and the output guard slightly differently\n// each time, and the parent is the one that finds out.\n//\n// The routes:\n// GET /v1/descriptor what this source is, and what settings it takes\n// POST /v1/read settings + context in, items out\n// POST /v1/write a named side effect from `writes`\n// POST /v1/publish 501; reserved, no source implements it yet\n//\n// Auth is NOT here. It belongs to whatever mounts this (rpc.ts), because the\n// credential is a deployment concern and a source shouldn't have an opinion\n// about how it is fronted.\n//\n// Part of the SDK — see sdk/contract.ts's header for the import rule.\n\nimport { items, PROTOCOL_VERSION, record } from \"./contract.ts\";\nimport type { SourceDefinition } from \"./defineSource.ts\";\n\n// Every response the protocol emits carries protocolVersion, and every\n// failure carries `ok:false` plus a code. Kept as two helpers so no route can\n// invent a third envelope shape.\nfunction fail(error: string, status = 400): Response {\n return Response.json({ protocolVersion: PROTOCOL_VERSION, ok: false, error }, { status });\n}\n\nexport async function serveSource(\n definition: SourceDefinition,\n req: Request,\n): Promise {\n const url = new URL(req.url);\n\n let body: Record = {};\n if (req.method === \"POST\") {\n try {\n const raw = await req.json();\n if (!record(raw)) return fail(\"invalid_body\");\n body = raw;\n } catch {\n return fail(\"invalid_json\");\n }\n if (body.protocolVersion !== PROTOCOL_VERSION) return fail(\"unsupported_protocol\");\n }\n\n // Identity is checked before routing, so a request addressed to the wrong\n // source is a 404 on every path — including /v1/publish. A val that mounts\n // several definitions dispatches on this key.\n const key = req.method === \"GET\" ? url.searchParams.get(\"sourceKey\") ?? definition.key : body.sourceKey;\n if (key !== definition.key) return fail(\"unknown_source\", 404);\n\n if (req.method === \"GET\" && url.pathname === \"/v1/descriptor\") {\n return Response.json({\n protocolVersion: PROTOCOL_VERSION,\n sourceKey: definition.key,\n temporal: definition.temporal ?? true,\n settingsSchema: typeof definition.settingsSchema === \"function\"\n ? await definition.settingsSchema() : definition.settingsSchema,\n ...(definition.options ? { options: await definition.options() } : {}),\n // Derived, never declared: capabilities are read off the definition, so\n // a source cannot advertise a write it doesn't implement or hide one it\n // does.\n capabilities: {\n read: true,\n validateSettings: true,\n write: Object.keys(definition.writes ?? {}),\n publish: false,\n },\n });\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/validate-settings\") {\n if (!record(body.settings)) return fail(\"invalid_settings\");\n const parsed = await definition.parseSettings(body.settings);\n if (!parsed.ok) return fail(parsed.error, parsed.status ?? 400);\n // Parsed values can contain private implementation context. Never export them.\n return Response.json({ protocolVersion: PROTOCOL_VERSION, sourceKey: definition.key, ok: true },\n { headers: { \"cache-control\": \"no-store\" } });\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/read\") {\n if (!record(body.settings) || !record(body.context)) return fail(\"settings_and_context_required\");\n // The offset is protocol-level, so it is checked here rather than by each\n // source. This is the wide guard — a source's own fallback narrows it\n // further (see ReadContext).\n const tz = body.context.utcOffsetSeconds;\n if (tz !== null && (typeof tz !== \"number\" || !Number.isInteger(tz) || Math.abs(tz) > 86400)) {\n return fail(\"invalid_timezone\");\n }\n const parsed = await definition.parseSettings(body.settings);\n if (!parsed.ok) return fail(parsed.error, parsed.status ?? 400);\n\n const produced = await definition.read(parsed.value, { utcOffsetSeconds: tz as number | null });\n // Guarding the source's own output, not a remote's: a duplicate id or a\n // non-finite timestamp is rejected here rather than at the parent, where\n // the whole composition would fail without naming which source produced\n // it. 502 and not 500 — the source answered, the answer was unusable.\n if (!items(produced)) return fail(\"invalid_source_output\", 502);\n return Response.json(\n { protocolVersion: PROTOCOL_VERSION, sourceKey: definition.key, items: produced },\n { headers: { \"cache-control\": \"no-store\" } },\n );\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/write\") {\n if (!record(body.payload)) return fail(\"invalid_payload\");\n // Object.hasOwn, not a plain lookup: `writes` is an object literal, so\n // `operation: \"toString\"` would otherwise resolve to Object.prototype's\n // method and get called with the payload.\n const writes = definition.writes ?? {};\n const operation = typeof body.operation === \"string\" ? body.operation : \"\";\n if (!Object.hasOwn(writes, operation)) return fail(\"unsupported_operation\", 422);\n const handler = writes[operation];\n const outcome = await handler(body.payload);\n if (!outcome.ok) return fail(outcome.error, outcome.status ?? 400);\n return Response.json({\n protocolVersion: PROTOCOL_VERSION,\n sourceKey: definition.key,\n ok: true,\n result: outcome.value,\n });\n }\n\n // Reserved rather than absent: the parent already knows the route, and a\n // 501 tells it \"not yet\" where a 404 would say \"never\".\n if (url.pathname === \"/v1/publish\") return fail(\"not_implemented\", 501);\n return fail(\"not_found\", 404);\n}\n",["D",1788851537264],{"_36":68,"_38":69,"_40":41,"_42":70,"_44":71,"_46":14,"_47":48,"_30":31},"sdk/defineSource.ts","01a07fdc-4571-76ba-9009-ec81b7693068","defineSource.ts","// The author-facing surface: everything an implementer writes, and nothing\n// they don't. A source is one object. serveSource turns it into the protocol.\n//\n// Part of the SDK — see sdk/contract.ts's header for the import rule.\n\nimport type { Item, Result } from \"./contract.ts\";\n\n// Everything the parent forwards about the caller, which is deliberately\n// almost nothing: no device identity, no user id, no presentation. A source\n// gets a timezone offset and the settings that caller chose, and that is the\n// whole input surface.\n//\n// `utcOffsetSeconds: null` means the parent had no offset to forward. It does\n// NOT mean UTC, and treating it as UTC is a bug: it silently shifts every\n// day boundary to Greenwich for callers the parent couldn't resolve. Fall\n// back to a default the source picks.\nexport type ReadContext = { utcOffsetSeconds: number | null };\n\n// A write handler. The SDK has already checked that `payload` is a JSON\n// object; validating its contents is the operation's own job, because only it\n// knows the shape. Return `reject(\"...\")` for bad input rather than throwing.\nexport type WriteHandler = (\n payload: Record,\n) => Promise> | Result;\n\nexport type SourceDefinition = {\n // The protocol `sourceKey`. The parent addresses this source by it and the\n // SDK rejects any request naming a different one.\n key: string;\n\n // Whether items carry meaningful times. Advertised in the descriptor;\n // defaults to true, which is the only shape v1's Item can express.\n temporal?: boolean;\n\n // JSON Schema for `settings`, published in the descriptor so the parent can\n // build a settings UI without knowing what this source is. It is\n // DOCUMENTATION, not enforcement — the SDK does not validate against it.\n // parseSettings is what actually decides.\n settingsSchema: Record | (() => Promise> | Record);\n\n // The choices a caller can pick from, published alongside the schema — a\n // catalog, a list of channels, whatever this source's settings reference.\n // Called on every descriptor request, so it may hit storage. Omit it for a\n // source whose settings are free-form.\n options?: () => Promise | unknown;\n\n // Raw `settings` in, whatever `read` needs out. This is the ONLY place a\n // source validates caller input, and it must be total: reject anything not\n // recognized, including unknown keys.\n //\n // It may do I/O, and that is a feature — it is where to load a snapshot\n // that both validation and the read itself need (a catalog, say), so the\n // request pays for it once. Whatever it returns is handed to `read`\n // verbatim, so the returned type is free to be richer than the wire\n // settings.\n parseSettings: (\n raw: Record,\n ) => Promise> | Result;\n\n // The source itself. Parsed settings in, items out. Anything it returns is\n // validated against the item contract before it leaves the val, so this can\n // return its natural output and let the SDK be the gate.\n read: (settings: Settings, context: ReadContext) => Promise;\n\n // Named side effects the parent can invoke, if this source has any. The\n // keys become the protocol's `operation` values and the descriptor's\n // advertised write capabilities — declared once, so what a source says it\n // can do cannot drift from what it does.\n writes?: Record;\n};\n\n// Identity function. It exists purely so `Settings` is inferred from\n// parseSettings and checked against read's parameter at the definition site,\n// where the mismatch is legible, instead of at the serveSource call.\nexport function defineSource(\n definition: SourceDefinition,\n): SourceDefinition {\n return definition;\n}\n",["D",1788851537264],{"_36":74,"_38":75,"_40":41,"_42":76,"_44":77,"_46":14,"_47":48,"_30":31},"sdk/contract.ts","01a07fdc-4571-76ba-9009-e9aa49b6faf9","contract.ts","// What a source is held to: version 1 of the temporal item contract.\n//\n// This directory is the SDK. It is the half of this val that knows nothing\n// about sports, and the boundary is structural, not stylistic: NOTHING under\n// sdk/ may import anything outside sdk/. tools/sdk-boundary-check.ts fails if\n// that is ever violated, which is what keeps this directory extractable into\n// its own published val without a rewrite. See sdk/README.md before editing.\n\nexport const PROTOCOL_VERSION = 1;\n\n// The one payload shape every source produces, whatever it is a source of.\n// There is no away/home, no score, no sport — a source decides what to *say*\n// and the client renders these six fields blind.\n//\n// `caption: null` is a protocol value, not an absent field: it tells the\n// client to format `timestamp` itself as a local time. A source that wants\n// no caption at all still sends null.\n//\n// `timestamp` is Unix EPOCH SECONDS, not milliseconds. This is the single\n// most common implementation mistake: sending ms decodes on the client as a\n// date ~57,000 years out, and no type-level check catches it because both are\n// numbers. `items()` below cannot catch it either — it can only reject values\n// too large to be a plausible second-precision timestamp.\nexport type Item = {\n id: string;\n mainText: string;\n subText: string;\n caption: string | null;\n emphasized: boolean;\n timestamp: number;\n};\n\nexport function record(value: unknown): value is Record {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n// The gate every source's output passes through before it leaves the val.\n// serveSource applies this automatically, so an implementer cannot ship a\n// malformed item by forgetting to check: a failing read returns 502\n// invalid_source_output from this source rather than failing composition at\n// the parent, where nothing would name which source produced the bad item.\n//\n// `id` must be unique within one response and stable across polls of the same\n// underlying thing; the parent namespaces it per source, so it only has to be\n// unique here.\nexport function items(value: unknown): value is Item[] {\n return Array.isArray(value) && value.every(v => record(v)\n && typeof v.id === \"string\" && v.id.length > 0\n && typeof v.mainText === \"string\" && typeof v.subText === \"string\"\n && (v.caption === null || typeof v.caption === \"string\")\n && typeof v.emphasized === \"boolean\" && typeof v.timestamp === \"number\"\n && Number.isFinite(v.timestamp) && Math.abs(v.timestamp) <= 8640000000000)\n && new Set(value.map(v => v.id)).size === value.length;\n}\n\n// How a source hands a rejection back to the SDK instead of throwing. One\n// type for both settings parsing and write operations, so there is a single\n// failure idiom to learn.\n//\n// `error` becomes the protocol's error code verbatim, so it should be a\n// stable snake_case token the parent can branch on (\"unknown_team\"), not a\n// sentence. `status` defaults to 400 — the codes worth overriding are 404 for\n// a thing that does not exist and 422 for a well-formed request this source\n// will not perform.\n//\n// Returning a rejection is not the same as throwing: a throw is a bug and\n// surfaces as a 500, while a rejection is this source correctly refusing.\nexport type Result =\n | { ok: true; value: T }\n | { ok: false; error: string; status?: number };\n\nexport function accept(value: T): Result {\n return { ok: true, value };\n}\n\nexport function reject(error: string, status = 400): Result {\n return { ok: false, error, status };\n}\n",["D",1788851537264],{"_36":80,"_38":81,"_40":27,"_42":82,"_44":83,"_46":14,"_47":48,"_30":31},"sdk/README.md","01a07fdc-4570-7068-b849-a4647819a677","README.md","# Source SDK (protocol v1)\n\nA **source** answers one question: *given these settings and this caller's\ntimezone, what are the next few things worth showing?* It returns a flat list\nof items. It does not know who is asking, what else is on the screen, or how\nany of it is rendered.\n\nThis directory is everything that is true of every source. It has **no\ndependencies** — not on npm, not on Val Town's `std`, not on the val around it.\nThree files:\n\n| File | What's in it |\n| --- | --- |\n| `contract.ts` | `Item`, the validator that enforces it, and `accept`/`reject` |\n| `defineSource.ts` | `SourceDefinition` — the whole author-facing surface |\n| `serve.ts` | `serveSource()` — the protocol, as a function of a definition |\n\n## Write a source\n\nFor the parent’s supported browser forms, see [the settings form contract](settings-form.md).\nThe protocol permits broader schemas; the parent deliberately rejects forms outside\nits small supported subset. The example below illustrates the broader protocol,\nnot a browser-renderable form.\n\nOne object, one mount. That is the entire API.\n\n```ts\nimport { accept, reject } from \"./sdk/contract.ts\";\nimport { defineSource } from \"./sdk/defineSource.ts\";\n\nexport default defineSource<{ city: string }>({\n key: \"weather\",\n\n settingsSchema: {\n type: \"object\",\n properties: { city: { type: \"string\" } },\n required: [\"city\"],\n additionalProperties: false,\n },\n\n // Optional legacy metadata. The parent does not render this; browser choices\n // must be bound to properties in settingsSchema (see settings-form.md).\n options: () => listCities(),\n\n // The only place caller input is validated. Must be total — reject anything\n // you don't recognize, unknown keys included. May do I/O.\n parseSettings: (raw) =>\n typeof raw.city === \"string\" && known(raw.city)\n ? accept({ city: raw.city })\n : reject(\"unknown_city\"),\n\n // The source itself. Timestamps are Unix SECONDS.\n read: async ({ city }, { utcOffsetSeconds }) => [{\n id: `weather:${city}:tomorrow`,\n mainText: \"Rain expected\",\n subText: \"Portland\",\n caption: null,\n emphasized: false,\n timestamp: 1788739200,\n }],\n\n // Optional: named side effects. The keys become the protocol's `operation`\n // values and the descriptor's advertised capabilities.\n writes: {\n \"cache.put\": async (payload) =>\n typeof payload.dateKey === \"string\"\n ? accept(await store(payload))\n : reject(\"invalid_cache_payload\"),\n },\n});\n```\n\nThen mount it behind whatever auth the deployment wants:\n\n```ts\n// rpc.ts — an HTTP val\nexport default (req: Request) =>\n authorized(req) ? serveSource(mySource, req) : unauthorized();\n```\n\n`tools/sdk-check.ts` in this val defines a complete fixture source in ~30\nlines and asserts the protocol against it. It is the shortest working example;\ncopying it is a reasonable way to start.\n\n## What the SDK does, so you don't\n\n- Routes `/v1/descriptor`, `/v1/validate-settings`, `/v1/read`, `/v1/write`, `/v1/publish`.\n- Validation-only requests call `parseSettings` without calling `read` or returning\n the parsed internal value. Keep `parseSettings` free of mutations.\n- `settingsSchema` may be an object or an async function returning one.\n- Parses and shape-checks the request body; rejects a wrong `protocolVersion`\n or a `sourceKey` that isn't yours.\n- Validates `context.utcOffsetSeconds` before your code sees it.\n- **Validates your output.** Items that break the contract — a duplicate `id`,\n a non-finite timestamp — never leave the val; the request fails 502\n `invalid_source_output` instead of failing composition at the parent, where\n nothing would say which source produced the bad item.\n- Derives `capabilities` from the definition, so what a source advertises\n cannot drift from what it implements.\n- Writes every response envelope, so no route can invent a new one.\n\n## What is yours\n\n- **Validating settings.** `settingsSchema` is published for the parent's UI;\n the SDK does not enforce it. The parent checks its supported form subset and\n posted values, then asks `parseSettings` to decide before saving. Reads also\n call `parseSettings` independently.\n- **Being total.** Reject unknown keys. A setting you silently ignore is a\n setting a caller thinks is working.\n- **Failing by returning, not throwing.** `reject(\"code\")` is this source\n correctly refusing, and the code reaches the parent verbatim — make it a\n stable snake_case token it can branch on, not a sentence. A throw is a bug\n and surfaces as a 500.\n- **Deciding what `null` means.** `utcOffsetSeconds: null` means the parent had\n no offset to forward. It does **not** mean UTC. Fall back to a zone you pick;\n treating it as 0 quietly moves every day boundary to Greenwich.\n\n## What is nobody's job here\n\nThese belong to the parent, and a source that does them will conflict with it:\n\n- Composition across sources, and namespacing ids (the parent prefixes yours).\n- Presentation: envelopes, eyebrows, section headers, empty-state copy.\n- Device or user identity — a source never learns who is asking.\n- Auth. That is the mount's business, not the source's.\n\n## Three things that go wrong\n\n1. **Milliseconds in `timestamp`.** It is Unix *seconds*. Sending ms decodes on\n the client as a date ~57,000 years out, and nothing catches it: both are\n numbers, and the contract validator can only reject values too large to be a\n plausible timestamp — a real ms value is not. Pin it in a test.\n2. **An `id` that isn't stable.** It must be the same across polls of the same\n underlying thing, and unique within one response. An id containing \"now\"\n makes every poll look like new content.\n3. **Re-reading storage in `read`.** `parseSettings` may do I/O and hands its\n return value to `read` verbatim — load the snapshot there once, and pass it\n along. As a bonus the request is then resolved against one consistent\n snapshot rather than two.\n\n## The one structural rule\n\n**Nothing under `sdk/` may import anything outside `sdk/`.**\n\nThat is what makes this directory liftable into its own published val without a\nrewrite, and it is the kind of rule that decays quietly, so it is enforced\nrather than asked for: `tools/sdk-check.ts` fails if an import escapes the\ndirectory, or if SDK *code* so much as names one of the host val's domain\nconcepts. Run it after touching anything in here.\n\nDomain vocabulary belongs on the other side of the seam — in this val, that is\n`sportsSource.ts` (the definition) and `lib/` (how it gets its data).\n",["D",1788851537264],{"_36":86,"_38":85,"_40":52,"_42":-5,"_44":87,"_46":14,"_47":48,"_30":31},"sdk","01a07fdc-4570-7068-b849-a2f0d645edd4",["D",1788851537264],"id","eb040b9b-c2e1-4e49-ab5b-059a85d1d61b","source-sdk",["D",1788851529508],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Shared temporal source protocol and authoring SDK","imageUrl","b0a8da26-58e7-4d19-8b5c-eedf487df9a9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","5a10edca-919b-4a78-babb-71908f69af93","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_140":139,"_147":143},"org",{"_140":139,"_141":-5,"_142":143,"_18":100,"_144":145,"_146":31},"branch",{"_13":129,"_38":130,"_88":48,"_131":89,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":90,"_138":139},"isOwned",16,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","plusjade","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yVHpab25kTlBTM3M3WmpCa3NMSTd5akVwWksuanBlZyJ9","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_88":89,"_38":90,"_44":243,"_92":-5,"_93":31,"_94":95,"_96":95,"_97":98,"_99":-5,"_18":100,"_101":-5,"_102":31,"_103":-5,"_104":-5,"_105":106,"_107":108,"_109":-5,"_110":-5,"_111":-5,"_112":-5,"_113":114,"_115":114,"_116":117,"_118":117,"_119":117,"_120":114,"_121":114,"_122":244,"_124":245,"_126":246,"_128":31},"tree",[200,206,208],"files",[200,201,202,203,204,205,206,207,208],"counts",{"_190":106,"_191":14,"_192":106,"_193":194,"_195":196},"contents",[170,171,172],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_88":187,"_38":85,"_36":86,"_176":-5,"_47":48,"_46":14,"_178":184,"_44":188,"_13":106,"_40":52,"_42":-5,"_30":31,"_181":-5,"_33":189},{"_88":183,"_38":50,"_36":51,"_176":-5,"_47":48,"_46":14,"_178":184,"_44":185,"_13":106,"_40":52,"_42":-5,"_30":31,"_181":-5,"_33":186},{"_88":173,"_38":174,"_36":175,"_176":-5,"_47":48,"_46":177,"_178":31,"_44":179,"_13":106,"_40":41,"_42":180,"_30":31,"_181":-5,"_33":182},"ca8d26f5-914c-447b-81a4-a160b742176e","mod.ts","9b489f52-ab54-11f1-89a4-1607ee4eb77e","parentId",1,"latest",["D",1788851529568],"// Public source-author API. Implementation lives in sdk/.\nexport { accept, reject, record, items, PROTOCOL_VERSION, type Item, type Result } from \"./sdk/contract.ts\";\nexport { defineSource, type SourceDefinition, type ReadContext, type WriteHandler } from \"./sdk/defineSource.ts\";\nexport { serveSource } from \"./sdk/serve.ts\";\n","label",[174],"839c9b46-fd78-49cd-94d9-5e41ff804734",true,["D",1788851537264],[50],"7bed7229-c5ed-4109-972f-478ea07da481",["D",1788851537264],[85],"pulls","branches","forks","envVars",{"_197":106,"_199":106},"connections",{"_197":106,"_198":106},"count","unfilledCount","emptyCount",{"_88":187,"_38":85,"_36":86,"_176":-5,"_47":48,"_46":14,"_178":184,"_44":240,"_13":106,"_40":52,"_42":-5,"_30":31,"_181":-5,"_210":241,"_33":242},{"_88":236,"_38":81,"_36":80,"_176":86,"_47":48,"_46":14,"_178":31,"_44":237,"_13":106,"_40":27,"_42":82,"_30":31,"_181":-5,"_210":238,"_33":239},{"_88":232,"_38":75,"_36":74,"_176":86,"_47":48,"_46":14,"_178":31,"_44":233,"_13":106,"_40":41,"_42":76,"_30":31,"_181":-5,"_210":234,"_33":235},{"_88":228,"_38":69,"_36":68,"_176":86,"_47":48,"_46":14,"_178":31,"_44":229,"_13":106,"_40":41,"_42":70,"_30":31,"_181":-5,"_210":230,"_33":231},{"_88":224,"_38":63,"_36":62,"_176":86,"_47":48,"_46":14,"_178":31,"_44":225,"_13":106,"_40":41,"_42":64,"_30":31,"_181":-5,"_210":226,"_33":227},{"_88":220,"_38":57,"_36":56,"_176":86,"_47":48,"_46":14,"_178":184,"_44":221,"_13":106,"_40":27,"_42":58,"_30":31,"_181":-5,"_210":222,"_33":223},{"_88":183,"_38":50,"_36":51,"_176":-5,"_47":48,"_46":14,"_178":184,"_44":217,"_13":106,"_40":52,"_42":-5,"_30":31,"_181":-5,"_210":218,"_33":219},{"_88":213,"_38":39,"_36":37,"_176":51,"_47":48,"_46":14,"_178":31,"_44":214,"_13":106,"_40":41,"_42":43,"_30":31,"_181":-5,"_210":215,"_33":216},{"_88":173,"_38":174,"_36":175,"_176":-5,"_47":48,"_46":177,"_178":31,"_44":209,"_13":106,"_40":41,"_42":180,"_30":31,"_181":-5,"_210":211,"_33":212},["D",1788851529568],"children",[],[174],"a5a76515-4ddd-4482-9bb7-ed027c7eacc5",["D",1788851537264],[],[50,39],["D",1788851537264],[207],[50],"ce5b4d7f-0773-43be-9819-6d6a902870c7",["D",1788851537264],[],[85,57],"ff2296fb-1f78-49fe-a788-912dee4ce922",["D",1788851537264],[],[85,63],"ac74e7a9-a59b-4494-8386-0c67b86dd4a7",["D",1788851537264],[],[85,69],"2464e0b6-6467-4c16-bb87-9ad6229c67eb",["D",1788851537264],[],[85,75],"44a538a0-ac7a-43f7-8d69-467985e47a9f",["D",1788851537264],[],[85,81],["D",1788851537264],[201,202,203,204,205],[85],["D",1788851529508],{"_140":139,"_147":143},{"_140":139,"_141":-5,"_142":143,"_18":100,"_144":145,"_146":31},{"_13":129,"_38":130,"_88":48,"_131":89,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":90,"_138":139},"ctx",{"_122":-5,"_167":280,"_281":282,"_283":284,"_285":31,"_286":31,"_287":31,"_288":184,"_289":-5,"_290":-7,"_291":-7,"_292":106,"_293":31,"_294":31,"_295":-5,"_296":31,"_297":31,"_298":31,"_299":-5},"ENV",{"_251":252,"_253":254,"_255":130,"_256":257,"_258":259,"_260":261,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2