[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_339":340,"_341":342},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":58,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",35,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","tools/ingest.ts","latestPath","fileId","bc76235e-aaf8-11f1-bcc6-1607ee4eb77e","name","ingest.ts","fileType","script","content","// The external ingest process, in one file.\n//\n// DO NOT RUN THIS IN VAL TOWN. It is the one tool here that cannot work on\n// platform: ESPN answers Val Town's shared egress with 403 Access Denied\n// regardless of headers. Run it from a normal network:\n//\n// deno run --allow-net --allow-env tools/ingest.ts\n//\n// with SOURCE_WFIBA_V1_TOKEN set. It fetches each tournament date's scoreboard\n// and posts it to /v1/write, where the val turns it into rows. This side stays\n// a dumb pipe: it knows the ESPN URL and nothing about the schema.\n//\n// Re-run it to pick up knockout fixtures. ESPN publishes the bracket late — as\n// of 2026-09-07 only the four group-stage dates (09-04..09-07, 24 games) exist\n// and 09-08 onward return zero events — so the tournament is NOT fully\n// ingested until this has been run again nearer the end. Each date's ingest is\n// authoritative and idempotent, so running it repeatedly is safe and is the\n// intended way to refresh live statuses.\n\nconst ENDPOINT = \"https://plusjade--01a07d730d02703fbe7309449008031e.web.val.run\";\nconst TOKEN = Deno.env.get(\"SOURCE_WFIBA_V1_TOKEN\");\nif (!TOKEN) throw new Error(\"SOURCE_WFIBA_V1_TOKEN is required\");\n\n// The 2026 Women's World Cup runs 2026-09-04 to 2026-09-14 (ESPN's own season\n// bounds for league 53). Dates outside it have nothing to ingest.\nconst START = \"2026-09-04\";\nconst END = \"2026-09-14\";\n\nfunction* dateRange(from: string, to: string): Generator {\n for (\n let day = new Date(`${from}T00:00:00Z`);\n day <= new Date(`${to}T00:00:00Z`);\n day.setUTCDate(day.getUTCDate() + 1)\n ) yield day.toISOString().slice(0, 10);\n}\n\nlet seen = 0;\nlet written = 0;\nfor (const dateKey of dateRange(START, END)) {\n const espn = await fetch(\n `https://site.api.espn.com/apis/site/v2/sports/basketball/fiba/scoreboard?dates=${dateKey.replaceAll(\"-\", \"\")}`,\n );\n if (!espn.ok) throw new Error(`ESPN ${espn.status} for ${dateKey}`);\n const payload = await espn.json();\n const events: { id: string; date: string }[] = payload.events ?? [];\n\n // Cross-check the val's own date filter. It keeps only events whose UTC date\n // equals the requested key; if ESPN ever files a game under a bucket that\n // does not match its own date, and no other bucket carries it, that game\n // would be silently dropped by every ingest. Reported rather than assumed\n // away — it has not happened for this tournament, but it is the failure that\n // would be invisible.\n const offBucket = events.filter((event) => event.date.slice(0, 10) !== dateKey).map((event) => event.id);\n\n const res = await fetch(`${ENDPOINT}/v1/write`, {\n method: \"POST\",\n headers: { authorization: `Bearer ${TOKEN}`, \"content-type\": \"application/json\" },\n body: JSON.stringify({\n protocolVersion: 1,\n sourceKey: \"wfiba\",\n operation: \"games.ingest\",\n payload: { dateKey, payload },\n }),\n });\n const body = await res.json();\n if (!res.ok) throw new Error(`write failed for ${dateKey}: ${JSON.stringify(body)}`);\n\n seen += events.length;\n written += body.result.games;\n console.log(\n `${dateKey} espn=${String(events.length).padStart(2)} written=${String(body.result.games).padStart(2)}` +\n (offBucket.length ? ` OFF-BUCKET ${offBucket.join(\",\")}` : \"\"),\n );\n}\n\nconsole.log(`\\ntotal: ${seen} ESPN events seen, ${written} games written`);\n","createdAt",["D",1788812071543],"branchVersion","branchId","20967dcf-9eb1-4cbf-a721-cf05b71b776a","id","8cd67c66-1c13-4d59-a550-efcd693c834b","source-wfiba",["D",1788811087002],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Women's FIBA World Cup source val","imageUrl","b0a8da26-58e7-4d19-8b5c-eedf487df9a9","pinnedFileId","01a07d73-0d02-703f-be73-09449008031e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","5a10edca-919b-4a78-babb-71908f69af93","tursoName","8cd67c661c134d59a550efcd693c834b","tursoHostname","8cd67c661c134d59a550efcd693c834b-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509043237],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",53,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","plusjade","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yVHpab25kTlBTM3M3WmpCa3NMSTd5akVwWksuanBlZyJ9","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":334,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":335,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":336,"_83":337,"_85":338,"_87":24},"tree",[180,188,194,199,200],"files",[180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200],"counts",{"_168":62,"_169":170,"_171":62,"_172":173,"_174":175},"contents",[129,130,131,132,133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":163,"_31":164,"_29":165,"_137":-5,"_40":41,"_39":148,"_139":58,"_37":166,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_26":167},{"_42":158,"_31":159,"_29":160,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":161,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_26":162},{"_42":152,"_31":153,"_29":154,"_137":-5,"_40":41,"_39":148,"_139":58,"_37":155,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_26":157},{"_42":144,"_31":145,"_29":56,"_137":-5,"_40":41,"_39":146,"_139":24,"_37":147,"_13":148,"_33":149,"_35":150,"_23":24,"_142":-5,"_26":151},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":140,"_13":62,"_33":34,"_35":141,"_23":24,"_142":-5,"_26":143},"78cb7c31-167e-473b-8dca-a425e2444f78","wfibaSource.ts","af43d89e-aaf7-11f1-b912-1607ee4eb77e","parentId",22,"latest",["D",1788811619910],"// What makes this val a Women's FIBA World Cup source, and nothing else.\n// Everything the protocol does with this object lives in sdk/ and is the same\n// for every source; everything this object does lives in lib/.\n//\n// This file is the seam between them, and it should stay short enough to read\n// in one screen. If it grows a Response, a status code or a protocol field, it\n// has taken on work that belongs to sdk/serve.ts.\n\nimport { gamesFromScoreboard, scoreboard } from \"./lib/espn.ts\";\nimport { feedItems } from \"./lib/feed.ts\";\nimport { readTeams, replaceDate, type Team } from \"./lib/store.ts\";\nimport { accept, reject } from \"./sdk/contract.ts\";\nimport { defineSource } from \"./sdk/defineSource.ts\";\n\n// parseSettings' output, not the wire shape. It carries the roster snapshot it\n// validated against so the read doesn't go back to SQLite for a second copy —\n// and so selection resolves against exactly the roster the request was checked\n// against, even if someone relabels a team mid-request.\ntype WfibaRead = {\n teams: string[];\n intradayFilter: boolean;\n roster: Team[];\n};\n\n// The settings contract the parent's generic form renders, in the supported\n// subset documented at docs/source-settings-contract.md in the iOS repo: a\n// closed object whose properties are booleans and arrays of string choices,\n// with `x-group` as the only UI extension. Nothing outside that subset — no\n// nested objects, free text, numbers or conditional fields — because the\n// parent fails closed on anything it does not recognize, showing no save form\n// at all.\n//\n// Built from the roster table on every descriptor request rather than\n// hard-coded, so relabelling a team in SQLite changes the form without a\n// deploy.\nasync function settingsSchema() {\n const roster = await readTeams();\n return {\n type: \"object\",\n properties: {\n teams: {\n type: \"array\",\n title: \"Teams\",\n default: [],\n uniqueItems: true,\n description: \"Choose national teams to follow. No selection produces an empty feed.\",\n items: {\n type: \"string\",\n oneOf: roster.map((team) => ({\n const: team.slug,\n title: team.displayName,\n \"x-group\": \"FIBA Women's World Cup\",\n })),\n },\n },\n intradayFilter: {\n type: \"boolean\",\n title: \"Hide a game as soon as it ends\",\n default: false,\n description: \"When unchecked, keep showing ended games for the rest of the day.\",\n },\n },\n required: [\"teams\"],\n additionalProperties: false,\n };\n}\n\nconst SETTING_KEYS = [\"teams\", \"intradayFilter\"];\n\nexport default defineSource({\n key: \"wfiba\",\n temporal: true,\n settingsSchema,\n\n // Hand-written rather than driven off settingsSchema above: the schema is\n // published for the parent's UI, and running a JSON Schema validator here to\n // re-derive checks this function states in four lines would add a dependency\n // to save nothing. They are two audiences, not one mechanism — if they ever\n // drift, this one is the one that decides.\n //\n // `unknown_team` is a distinct code from `invalid_settings` on purpose: the\n // parent can tell \"this caller's saved selection names a team we dropped\n // from the roster\" from \"this request is malformed\".\n parseSettings: async (raw) => {\n if (\n !Array.isArray(raw.teams) || !raw.teams.every((t) => typeof t === \"string\")\n || new Set(raw.teams).size !== raw.teams.length\n || (raw.intradayFilter !== undefined && typeof raw.intradayFilter !== \"boolean\")\n || Object.keys(raw).some((k) => !SETTING_KEYS.includes(k))\n ) return reject(\"invalid_settings\");\n\n const roster = await readTeams();\n const teams = raw.teams as string[];\n if (teams.some((slug) => !roster.some((team) => team.slug === slug))) {\n return reject(\"unknown_team\");\n }\n\n return accept({ teams, intradayFilter: raw.intradayFilter === true, roster });\n },\n\n read: ({ teams, intradayFilter, roster }, { utcOffsetSeconds }) =>\n feedItems({ teams, intradayFilter }, utcOffsetSeconds, roster),\n\n writes: {\n // The whole ingest surface. ESPN answers Val Town's egress with 403, so an\n // external process on an unblocked network fetches one date's scoreboard\n // and posts it here; this val does the ESPN-shape-to-rows translation, so\n // that process stays a dumb pipe with no schema knowledge.\n //\n // Authoritative per date: the payload replaces that date's rows rather\n // than merging into them, so a cancelled or rescheduled game disappears\n // instead of lingering on someone's widget forever.\n \"games.ingest\": async (payload) => {\n if (\n typeof payload.dateKey !== \"string\" || !/^\\d{4}-\\d{2}-\\d{2}$/.test(payload.dateKey)\n || !scoreboard(payload.payload)\n ) return reject(\"invalid_ingest_payload\");\n\n const games = gamesFromScoreboard(payload.payload, payload.dateKey);\n await replaceDate(payload.dateKey, games);\n return accept({ dateKey: payload.dateKey, games: games.length });\n },\n },\n});\n","label",[135],"c285647a-d188-49f9-9ce5-fd5305f5598b","rpc.ts",26,["D",1788811650169],1,"http","// Public val with authenticated Women's FIBA World Cup source operations.\n//\n// The mount point, and the only file that knows both halves: the SDK serves\n// the protocol (sdk/serve.ts), wfibaSource.ts is what it serves, and the\n// bearer check below is this deployment's own business — deliberately outside\n// the SDK, since a source shouldn't have an opinion about how it is fronted.\n//\n// The routes under /v1/ are the contract. /health and /coverage are this val's\n// operational surface: /coverage answers \"how far does the ingested schedule\n// actually reach\", which for a tournament whose knockout fixtures ESPN\n// publishes late is the question an operator actually has.\nimport { serveSource } from \"./sdk/serve.ts\";\nimport wfibaSource from \"./wfibaSource.ts\";\nimport { coverage } from \"./lib/store.ts\";\n\nexport default async function handler(req: Request): Promise {\n const expected = Deno.env.get(\"SOURCE_WFIBA_V1_TOKEN\");\n if (!expected) return Response.json({ error: \"RPC token not configured\" }, { status: 503 });\n if (req.headers.get(\"authorization\") !== `Bearer ${expected}`) {\n return Response.json({ error: \"unauthorized\" }, { status: 401 });\n }\n\n const url = new URL(req.url);\n if (url.pathname.startsWith(\"/v1/\")) return serveSource(wfibaSource, req);\n if (req.method === \"GET\" && url.pathname === \"/health\") return Response.json({ ok: true });\n if (req.method === \"GET\" && url.pathname === \"/coverage\") return Response.json(await coverage());\n return new Response(\"Not found\", { status: 404 });\n}\n",[145],"84870638-3c4a-4a7e-9a04-c18e15640bb4","tools","01a07d73-0d02-703f-be73-04aa080ac006",["D",1788811087002],"directory",[153],"c160be52-4215-44ff-9047-6073036102bc","sdk","01a07d73-0d02-703f-be72-f58a8508ba6a",["D",1788811087002],[159],"45a775c3-2e6a-4f66-8d72-d23a6624c336","lib","01a07d73-0d02-703f-be72-dcc2eeee9850",["D",1788811087002],[164],"pulls","branches",5,"forks","envVars",{"_176":178,"_179":62},"connections",{"_176":62,"_177":62},"count","unfilledCount",4,"emptyCount",{"_42":163,"_31":164,"_29":165,"_137":-5,"_40":41,"_39":148,"_139":58,"_37":331,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_202":332,"_26":333},{"_42":324,"_31":325,"_29":326,"_137":165,"_40":41,"_39":148,"_139":58,"_37":327,"_13":62,"_33":34,"_35":328,"_23":24,"_142":-5,"_202":329,"_26":330},{"_42":316,"_31":317,"_29":318,"_137":165,"_40":41,"_39":319,"_139":24,"_37":320,"_13":148,"_33":34,"_35":321,"_23":24,"_142":-5,"_202":322,"_26":323},{"_42":308,"_31":309,"_29":310,"_137":165,"_40":41,"_39":311,"_139":58,"_37":312,"_13":62,"_33":34,"_35":313,"_23":24,"_142":-5,"_202":314,"_26":315},{"_42":300,"_31":301,"_29":302,"_137":165,"_40":41,"_39":303,"_139":24,"_37":304,"_13":148,"_33":34,"_35":305,"_23":24,"_142":-5,"_202":306,"_26":307},{"_42":292,"_31":293,"_29":294,"_137":165,"_40":41,"_39":295,"_139":24,"_37":296,"_13":62,"_33":34,"_35":297,"_23":24,"_142":-5,"_202":298,"_26":299},{"_42":284,"_31":285,"_29":286,"_137":165,"_40":41,"_39":287,"_139":58,"_37":288,"_13":62,"_33":20,"_35":289,"_23":24,"_142":-5,"_202":290,"_26":291},{"_42":276,"_31":277,"_29":278,"_137":165,"_40":41,"_39":279,"_139":24,"_37":280,"_13":62,"_33":34,"_35":281,"_23":24,"_142":-5,"_202":282,"_26":283},{"_42":158,"_31":159,"_29":160,"_137":-5,"_40":41,"_39":148,"_139":24,"_37":273,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_202":274,"_26":275},{"_42":266,"_31":267,"_29":268,"_137":160,"_40":41,"_39":148,"_139":24,"_37":269,"_13":62,"_33":20,"_35":270,"_23":24,"_142":-5,"_202":271,"_26":272},{"_42":259,"_31":260,"_29":261,"_137":160,"_40":41,"_39":148,"_139":24,"_37":262,"_13":62,"_33":34,"_35":263,"_23":24,"_142":-5,"_202":264,"_26":265},{"_42":252,"_31":253,"_29":254,"_137":160,"_40":41,"_39":148,"_139":24,"_37":255,"_13":62,"_33":34,"_35":256,"_23":24,"_142":-5,"_202":257,"_26":258},{"_42":245,"_31":246,"_29":247,"_137":160,"_40":41,"_39":148,"_139":24,"_37":248,"_13":62,"_33":34,"_35":249,"_23":24,"_142":-5,"_202":250,"_26":251},{"_42":238,"_31":239,"_29":240,"_137":160,"_40":41,"_39":148,"_139":24,"_37":241,"_13":62,"_33":20,"_35":242,"_23":24,"_142":-5,"_202":243,"_26":244},{"_42":152,"_31":153,"_29":154,"_137":-5,"_40":41,"_39":148,"_139":58,"_37":235,"_13":62,"_33":156,"_35":-5,"_23":24,"_142":-5,"_202":236,"_26":237},{"_42":227,"_31":228,"_29":229,"_137":154,"_40":41,"_39":230,"_139":58,"_37":231,"_13":148,"_33":34,"_35":232,"_23":24,"_142":-5,"_202":233,"_26":234},{"_42":223,"_31":32,"_29":30,"_137":154,"_40":41,"_39":14,"_139":58,"_37":224,"_13":62,"_33":34,"_35":36,"_23":24,"_142":-5,"_202":225,"_26":226},{"_42":216,"_31":217,"_29":218,"_137":154,"_40":41,"_39":148,"_139":24,"_37":219,"_13":62,"_33":34,"_35":220,"_23":24,"_142":-5,"_202":221,"_26":222},{"_42":208,"_31":209,"_29":210,"_137":154,"_40":41,"_39":211,"_139":24,"_37":212,"_13":148,"_33":34,"_35":213,"_23":24,"_142":-5,"_202":214,"_26":215},{"_42":144,"_31":145,"_29":56,"_137":-5,"_40":41,"_39":146,"_139":24,"_37":205,"_13":148,"_33":149,"_35":150,"_23":24,"_142":-5,"_202":206,"_26":207},{"_42":134,"_31":135,"_29":136,"_137":-5,"_40":41,"_39":138,"_139":24,"_37":201,"_13":62,"_33":34,"_35":141,"_23":24,"_142":-5,"_202":203,"_26":204},["D",1788811619910],"children",[],[135],["D",1788811650169],[],[145],"a6dc3e3f-3c27-44aa-8583-9c7b0b196df8","source-contract-check.ts","01a07d73-0d02-703f-be73-038945c8ba0f",34,["D",1788812028420],"// Contract check for this val's whole HTTP surface. Reads production data and\n// exercises one disposable game row on a date the tournament cannot occupy,\n// which it always removes.\n\nimport handler from \"../rpc.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { items } from \"../sdk/contract.ts\";\nimport { gamesFromScoreboard } from \"../lib/espn.ts\";\nimport { nextPerTeam } from \"../lib/feed.ts\";\nimport { buildItems } from \"../lib/items.ts\";\nimport { clientOffsetSeconds, dayStartMsAtOffset } from \"../lib/dates.ts\";\n\nfunction assert(ok: unknown, msg: string) {\n if (!ok) throw new Error(msg);\n}\n\nconst token = Deno.env.get(\"SOURCE_WFIBA_V1_TOKEN\");\nfunction call(path: string, body?: unknown, auth = true) {\n return handler(new Request(\"https://source.invalid\" + path, {\n method: body ? \"POST\" : \"GET\",\n headers: auth ? { authorization: `Bearer ${token}` } : {},\n body: body ? JSON.stringify(body) : undefined,\n }));\n}\n\nlet checks = 0;\nconst ok = async (condition: unknown, msg: string) => {\n assert(await condition, msg);\n checks++;\n};\n\n// ------------------------------------------------------------------- auth --\nawait ok((await call(\"/v1/descriptor\", undefined, false)).status === 401, \"unauthenticated descriptor\");\n\n// ------------------------------------------------------------- descriptor --\nconst descriptor = await (await call(\"/v1/descriptor\")).json();\nawait ok(descriptor.sourceKey === \"wfiba\" && descriptor.protocolVersion === 1, \"descriptor identity\");\nawait ok(descriptor.temporal === true, \"temporal\");\nawait ok(descriptor.capabilities.publish === false && descriptor.capabilities.validateSettings === true,\n \"advertised capabilities\");\nawait ok(JSON.stringify(descriptor.capabilities.write) === JSON.stringify([\"games.ingest\"]),\n \"advertised writes\");\n\n// The settings contract the parent's generic form consumes. These assertions\n// are the supported subset itself, not incidental shape: a closed object,\n// declared choices carrying const/title, and the boolean.\nconst schema = descriptor.settingsSchema;\nawait ok(schema.type === \"object\" && schema.additionalProperties === false, \"closed settings object\");\nawait ok(schema.required[0] === \"teams\", \"teams required\");\nawait ok(schema.properties.teams.items.oneOf.length === 16, \"sixteen national teams\");\nawait ok(schema.properties.teams.items.oneOf.every((c: Record) =>\n typeof c.const === \"string\" && typeof c.title === \"string\" && typeof c[\"x-group\"] === \"string\"),\n \"choice shape\");\nawait ok(schema.properties.intradayFilter.type === \"boolean\", \"intradayFilter is a checkbox\");\n\n// --------------------------------------------------------- validate-settings --\nconst validated = await call(\"/v1/validate-settings\", {\n protocolVersion: 1, sourceKey: \"wfiba\", settings: { teams: [\"spain\"], intradayFilter: true },\n});\nconst validatedBody = await validated.json();\nawait ok(validated.ok && validatedBody.ok === true, \"validate-settings accepts a good selection\");\n// parseSettings' output carries a roster snapshot; it must never be exported.\nawait ok(!(\"roster\" in validatedBody) && Object.keys(validatedBody).length === 3,\n \"validate-settings leaks no internal context\");\nawait ok((await call(\"/v1/validate-settings\", {\n protocolVersion: 1, sourceKey: \"wfiba\", settings: { teams: [\"not-a-team\"] },\n})).status === 400, \"validate-settings rejects an unknown team\");\n\n// -------------------------------------------------------------------- read --\nconst base = {\n protocolVersion: 1,\n sourceKey: \"wfiba\",\n settings: { teams: [\"united-states\"], intradayFilter: false },\n context: { utcOffsetSeconds: -25200 },\n};\nconst read = await call(\"/v1/read\", base);\nconst body = await read.json();\nawait ok(read.ok && items(body.items), \"read satisfies the item contract\");\n\n// A null offset is the documented \"parent had nothing to forward\" case: it\n// must resolve to this source's own default zone, not fail and not shift to UTC.\nawait ok((await call(\"/v1/read\", { ...base, context: { utcOffsetSeconds: null } })).ok, \"null offset\");\n\n// An empty selection is a valid request producing an empty feed, never the\n// whole tournament.\nconst empty = await call(\"/v1/read\", { ...base, settings: { teams: [], intradayFilter: false } });\nawait ok(empty.ok && (await empty.json()).items.length === 0, \"empty selection yields empty feed\");\n\nawait ok((await call(\"/v1/read\", { ...base, settings: { teams: [\"not-a-team\"] } })).status === 400, \"unknown team\");\nawait ok((await call(\"/v1/read\", { ...base, settings: { teams: [\"spain\", \"spain\"] } })).status === 400, \"duplicate team\");\nawait ok((await call(\"/v1/read\", { ...base, settings: { teams: [], unexpected: 1 } })).status === 400, \"unknown setting\");\nawait ok((await call(\"/v1/read\", { ...base, sourceKey: \"sports\" })).status === 404, \"foreign source key\");\nawait ok((await call(\"/v1/read\", { ...base, protocolVersion: 2 })).status === 400, \"protocol version\");\n\n// ------------------------------------------------------------------ writes --\nawait ok((await call(\"/v1/publish\", base)).status === 501, \"publish stub\");\nawait ok((await call(\"/v1/write\", { ...base, operation: \"sql\", payload: {} })).status === 422, \"unsupported write\");\nawait ok((await call(\"/v1/write\", { ...base, operation: \"cache.put\", payload: {} })).status === 422,\n \"the sports val's write name is not implemented here\");\nawait ok((await call(\"/v1/write\", {\n ...base, operation: \"games.ingest\", payload: { dateKey: \"not-a-date\", payload: {} },\n})).status === 400, \"malformed ingest date\");\nawait ok((await call(\"/v1/write\", {\n ...base, operation: \"games.ingest\", payload: { dateKey: \"2026-09-05\", payload: [] },\n})).status === 400, \"non-object scoreboard\");\n\n// ------------------------------------------------------------------- pure --\n// The rules most worth pinning, checked directly rather than through HTTP.\n//\n// Unix SECONDS. A pinned integer is the only thing that catches a milliseconds\n// regression — both are numbers, so no type check and no live-data test would.\nconst fixture = [{\n gameId: \"g1\", startTimeMs: 1788806700000, awayCode: \"USA\", homeCode: \"CZE\",\n status: \"post\", channel: \"TNT\",\n}];\nconst built = buildItems(fixture, [{ slug: \"united-states\", displayName: \"USA\", espnCode: \"USA\" }]);\nawait ok(built[0].timestamp === 1788806700, \"timestamp is Unix seconds\");\nawait ok(built[0].mainText === \"🏀 USA @ CZE\", \"unrostered opponent keeps its ESPN code\");\nawait ok(built[0].caption === \"END\" && built[0].emphasized === false, \"final caption\");\nawait ok(buildItems(fixture, [], true).length === 0, \"intradayFilter drops a final game\");\n\n// Each favorite's own next game, unioned — not one shared earliest, which\n// would silently drop every other favorite playing later.\nconst a = { gameId: \"a\", startTimeMs: 1000, awayCode: \"ESP\", homeCode: \"FRA\", status: null, channel: null };\nconst b = { gameId: \"b\", startTimeMs: 2000, awayCode: \"USA\", homeCode: \"CHN\", status: null, channel: null };\nawait ok(nextPerTeam([a, b], [\"ESP\", \"USA\"]).length === 2, \"each favorite resolves independently\");\nawait ok(nextPerTeam([a], [\"ESP\", \"FRA\"]).length === 1, \"two favorites in one game dedupe\");\n\n// The ingest's date filter drops an event ESPN files under the wrong bucket.\nconst scoreboardFixture = {\n events: [\n { id: \"in\", date: \"2026-09-05T09:30Z\", competitions: [{ competitors: [] }] },\n { id: \"out\", date: \"2026-09-06T09:30Z\", competitions: [{ competitors: [] }] },\n ],\n};\nconst mapped = gamesFromScoreboard(scoreboardFixture, \"2026-09-05\");\nawait ok(mapped.length === 1 && mapped[0].gameId === \"in\", \"ingest keeps only the requested date\");\n\n// A far-east client must still see a game that falls inside their local today\n// but carries the previous UTC date. This is the case source-sports gets wrong:\n// it derives a cache-scan floor from the local date while its payloads are\n// bucketed by UTC date, so it drops the game entirely. Filtering on the\n// absolute instant, as here, is what makes that unrepresentable.\nconst fromMs = dayStartMsAtOffset(clientOffsetSeconds(50400), new Date(\"2026-09-07T20:15:00Z\"));\nawait ok(fromMs <= Date.parse(\"2026-09-07T18:45:00Z\"), \"UTC+14 lower bound still admits today's UTC games\");\n\n// ---------------------------------------------------------------- storage --\n// A date the tournament cannot occupy, so a leaked fixture is obvious.\nconst dateKey = \"1900-01-01\";\nconst before = await sqlite.execute({\n sql: \"SELECT count(*) AS n FROM wfiba_games WHERE date_key = ?\", args: [dateKey],\n});\nassert(Number(before.rows[0].n) === 0, \"fixture date already occupied\");\n\ntry {\n const write = await call(\"/v1/write\", {\n protocolVersion: 1, sourceKey: \"wfiba\", operation: \"games.ingest\",\n payload: {\n dateKey,\n payload: {\n events: [{\n id: \"contract-fixture\",\n date: \"1900-01-01T00:00Z\",\n competitions: [{\n competitors: [\n { homeAway: \"home\", team: { abbreviation: \"ESP\" } },\n { homeAway: \"away\", team: { abbreviation: \"USA\" } },\n ],\n status: { type: { state: \"pre\" } },\n broadcasts: [{ names: [\"TNT\"] }],\n }],\n }],\n },\n },\n });\n await ok(write.ok, \"ingest write accepted\");\n\n const stored = await sqlite.execute({\n sql: \"SELECT away_code, home_code, status, channel FROM wfiba_games WHERE date_key = ?\", args: [dateKey],\n });\n await ok(stored.rows.length === 1, \"one row written\");\n // The redesign's whole point: the teams landed in queryable columns.\n await ok(stored.rows[0].away_code === \"USA\" && stored.rows[0].home_code === \"ESP\",\n \"team codes stored as columns\");\n await ok(stored.rows[0].status === \"pre\" && stored.rows[0].channel === \"TNT\", \"status and channel stored\");\n\n // Re-ingesting the same date with an empty slate must remove it, not merge.\n await call(\"/v1/write\", {\n protocolVersion: 1, sourceKey: \"wfiba\", operation: \"games.ingest\",\n payload: { dateKey, payload: { events: [] } },\n });\n const after = await sqlite.execute({\n sql: \"SELECT count(*) AS n FROM wfiba_games WHERE date_key = ?\", args: [dateKey],\n });\n await ok(Number(after.rows[0].n) === 0, \"re-ingest replaces a date rather than merging into it\");\n\n console.log(JSON.stringify({ ok: true, checks, items: body.items.length, fixtureDate: dateKey }));\n} finally {\n await sqlite.execute({ sql: \"DELETE FROM wfiba_games WHERE date_key = ?\", args: [dateKey] });\n}\n",[],[153,209],"e7df3fbc-0b36-4eff-b915-183e31994450","sdk-check.ts","01a07d73-0d02-703f-be72-fd329a3d0647",["D",1788811087002],"// Two things, both about the SDK rather than about sports:\n//\n// 1. The boundary lint. sdk/ must not import anything outside sdk/, and must\n// not mention this val's domain. That is what makes the directory liftable\n// into its own published val, and it is the kind of rule that decays\n// silently under a hurry, so it is checked rather than asked for.\n//\n// 2. A conformance suite run against a FIXTURE source defined right here —\n// no database, no network, no games. If this passes, serveSource\n// implements the protocol for any source, not just this val's.\n//\n// The fixture below doubles as the reference implementation: it is the\n// smallest thing that is a complete source, and copying it is a reasonable way\n// to start a new one.\n//\n// Touches no storage and no production data. Safe to run anywhere.\n\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { accept, type Item, reject } from \"../sdk/contract.ts\";\nimport { defineSource, type SourceDefinition } from \"../sdk/defineSource.ts\";\nimport { serveSource } from \"../sdk/serve.ts\";\n\nfunction check(value: unknown, message: string): asserts value {\n if (!value) throw new Error(message);\n}\n\n// ---------------------------------------------------------------- boundary --\n\nconst SDK_FILES = [\"/sdk/contract.ts\", \"/sdk/defineSource.ts\", \"/sdk/serve.ts\"];\n\n// Words that mean this val in particular. The SDK may not know any of them.\n// (Checked against code only — sdk/README.md uses them in its examples, which\n// is exactly where domain vocabulary belongs.)\nconst DOMAIN_WORDS = [\"sport\", \"team\", \"game\", \"sleeper\", \"fiba\", \"catalog\", \"widget\", \"channel\"];\n\nfor (const path of SDK_FILES) {\n const code = await readFile(path, import.meta.url);\n\n // Every import must be relative and stay inside sdk/. This also rules out\n // remote imports, so the published SDK has zero dependencies — including on\n // Val Town's own std, which is what lets a source run somewhere else.\n for (const [, specifier] of code.matchAll(/(?:^|\\n)\\s*(?:import|export)[^;]*?from\\s+[\"']([^\"']+)[\"']/g)) {\n check(\n specifier.startsWith(\"./\") && !specifier.includes(\"..\"),\n `${path} imports outside sdk/: ${specifier}`,\n );\n }\n\n // Strip comments before the vocabulary scan: prose may say \"a catalog, say\"\n // while explaining what `options` is for. Identifiers may not.\n const source = code.replace(/\\/\\/[^\\n]*/g, \"\").replace(/\\/\\*[\\s\\S]*?\\*\\//g, \"\").toLowerCase();\n for (const word of DOMAIN_WORDS) {\n check(!source.includes(word), `${path} names this val's domain in code: \"${word}\"`);\n }\n}\n\n// ------------------------------------------------------------- conformance --\n\nconst fixture = defineSource<{ count: number }>({\n key: \"fixture\",\n // `temporal` deliberately omitted, to prove the descriptor defaults it.\n settingsSchema: {\n type: \"object\",\n properties: { count: { type: \"integer\" } },\n required: [\"count\"],\n additionalProperties: false,\n },\n parseSettings: (raw) =>\n typeof raw.count === \"number\" && Number.isInteger(raw.count) && raw.count >= 0\n ? accept({ count: raw.count })\n : reject(\"invalid_settings\"),\n read: ({ count }, context) =>\n Promise.resolve(Array.from({ length: count }, (_, i): Item => ({\n id: `fixture-${i}`,\n mainText: `Item ${i}`,\n // Echoed so the assertions below can prove the context reached the\n // source rather than being swallowed by the protocol layer.\n subText: String(context.utcOffsetSeconds),\n caption: null,\n emphasized: false,\n timestamp: 1788739200 + i,\n }))),\n writes: {\n echo: (payload) =>\n typeof payload.value === \"string\"\n ? accept({ echoed: payload.value })\n : reject(\"invalid_value\"),\n },\n});\n\n// A source that breaks the item contract, to prove the SDK catches it rather\n// than passing it to the parent: two items with the same id.\nconst brokenSource = defineSource({\n key: \"broken\",\n settingsSchema: {},\n parseSettings: () => accept(null),\n read: () =>\n Promise.resolve([0, 0].map((): Item => ({\n id: \"duplicate\",\n mainText: \"\",\n subText: \"\",\n caption: null,\n emphasized: false,\n timestamp: 1788739200,\n }))),\n});\n\nconst BASE = { protocolVersion: 1, sourceKey: \"fixture\" };\n// deno-lint-ignore no-explicit-any -- the harness drives two differently-typed\n// definitions through one helper; serveSource's own generic is what's under test.\ntype Definition = SourceDefinition;\n\nfunction call(definition: Definition, path: string, body?: unknown, rawBody?: string) {\n const init: RequestInit = body !== undefined || rawBody !== undefined\n ? { method: \"POST\", body: rawBody ?? JSON.stringify(body) }\n : {};\n return serveSource(definition, new Request(\"https://fixture.invalid\" + path, init));\n}\nasync function status(definition: Definition, path: string, body?: unknown, rawBody?: string) {\n const response = await call(definition, path, body, rawBody);\n return { code: response.status, json: await response.json() };\n}\n\n// Descriptor: derived capabilities, defaulted temporal, absent options.\nconst descriptor = await (await call(fixture, \"/v1/descriptor\")).json();\ncheck(descriptor.sourceKey === \"fixture\" && descriptor.protocolVersion === 1, \"descriptor identity\");\ncheck(descriptor.temporal === true, \"temporal did not default to true\");\ncheck(!(\"options\" in descriptor), \"options published by a source that declares none\");\ncheck(\n JSON.stringify(descriptor.capabilities) === JSON.stringify({ read: true, validateSettings: true, write: [\"echo\"], publish: false }),\n \"capabilities not derived from the definition\",\n);\ncheck((await status(fixture, \"/v1/descriptor?sourceKey=other\")).code === 404, \"wrong key reached the descriptor\");\n\n// Validation does not read, write, or leak parseSettings' internal output.\nlet readCalls = 0;\nconst validationFixture = defineSource({\n key:\"validation\",\n settingsSchema: async () => ({type:\"object\",properties:{},additionalProperties:false}),\n parseSettings: (raw) => Object.keys(raw).length === 0 ? accept({privateContext:\"secret\"}) : reject(\"invalid_settings\"),\n read: async () => { readCalls++; return []; },\n});\nconst valid = await status(validationFixture,\"/v1/validate-settings\",{\n protocolVersion:1,sourceKey:\"validation\",settings:{},\n});\ncheck(valid.code === 200 && valid.json.ok === true && !(\"privateContext\" in valid.json) &&\n Object.keys(valid.json).length === 3 && readCalls === 0, \"validation-only boundary\");\ncheck((await status(validationFixture,\"/v1/validate-settings\",{\n protocolVersion:1,sourceKey:\"validation\",settings:{unknown:true},\n})).code === 400,\"validation rejected unknown settings\");\ncheck((await status(validationFixture,\"/v1/descriptor\")).json.settingsSchema.type === \"object\",\"dynamic schema\");\n\n// Read: the happy path, and that context and settings both arrive intact.\nconst read = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: 3 },\n context: { utcOffsetSeconds: -25200 },\n});\ncheck(read.code === 200 && read.json.items.length === 3, \"read did not return the source's items\");\ncheck(read.json.items[0].subText === \"-25200\", \"context.utcOffsetSeconds did not reach the source\");\ncheck(read.json.sourceKey === \"fixture\", \"read envelope identity\");\n\nconst nullOffset = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: 1 },\n context: { utcOffsetSeconds: null },\n});\n// null must arrive AS null. Coercing it to 0 here would silently move every\n// day boundary to UTC for callers the parent couldn't resolve.\ncheck(nullOffset.json.items[0].subText === \"null\", \"null offset was coerced before the source saw it\");\n\n// Read: the ways it is refused.\nconst badSettings = await status(fixture, \"/v1/read\", {\n ...BASE,\n settings: { count: \"x\" },\n context: { utcOffsetSeconds: 0 },\n});\ncheck(badSettings.code === 400 && badSettings.json.error === \"invalid_settings\", \"parseSettings rejection not surfaced\");\n// The offset guard runs BEFORE parseSettings, so an absent utcOffsetSeconds is\n// invalid_timezone and not the source's business. The parent always sends the\n// key (null when it has no value), so this only bites a hand-written request.\ncheck(\n (await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 }, context: {} })).json.error === \"invalid_timezone\",\n \"absent offset silently accepted\",\n);\ncheck((await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 } })).code === 400, \"missing context accepted\");\ncheck(\n (await status(fixture, \"/v1/read\", { ...BASE, settings: { count: 1 }, context: { utcOffsetSeconds: 86401 } }))\n .json.error === \"invalid_timezone\",\n \"out-of-range offset accepted\",\n);\ncheck((await status(fixture, \"/v1/read\", { ...BASE, protocolVersion: 2 })).json.error === \"unsupported_protocol\", \"protocol version\");\ncheck((await status(fixture, \"/v1/read\", undefined, \"{not json\")).json.error === \"invalid_json\", \"malformed json\");\ncheck((await status(fixture, \"/v1/read\", [])).json.error === \"invalid_body\", \"array body accepted\");\ncheck((await status(fixture, \"/v1/read\", { ...BASE, sourceKey: \"other\" })).code === 404, \"foreign sourceKey\");\n\n// The output guard: a source that breaks the contract fails here, not at the\n// parent.\nconst broken = await status(\n brokenSource,\n \"/v1/read\",\n { protocolVersion: 1, sourceKey: \"broken\", settings: {}, context: { utcOffsetSeconds: 0 } },\n);\ncheck(broken.code === 502 && broken.json.error === \"invalid_source_output\", \"duplicate ids escaped the source\");\n\n// Writes.\nconst echo = await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: { value: \"hi\" } });\ncheck(echo.code === 200 && echo.json.ok === true && echo.json.result.echoed === \"hi\", \"write did not run\");\ncheck(\n (await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: { value: 1 } })).json.error === \"invalid_value\",\n \"write rejection not surfaced\",\n);\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"nope\", payload: {} })).code === 422, \"unknown operation\");\n// Object.prototype must not be reachable as an operation.\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"toString\", payload: {} })).code === 422, \"prototype method invoked as an operation\");\ncheck((await status(fixture, \"/v1/write\", { ...BASE, operation: \"echo\", payload: \"x\" })).json.error === \"invalid_payload\", \"non-object payload accepted\");\ncheck(\n (await status(brokenSource, \"/v1/write\", { protocolVersion: 1, sourceKey: \"broken\", operation: \"echo\", payload: {} })).code === 422,\n \"a source with no writes accepted one\",\n);\n\n// Reserved and unknown routes.\ncheck((await status(fixture, \"/v1/publish\", BASE)).code === 501, \"publish stub\");\ncheck((await status(fixture, \"/v1/nope\", BASE)).json.error === \"not_found\", \"unknown route\");\n\nconsole.log(`PASS: sdk/ imports nothing outside itself and names no domain concept; serveSource conforms for a fixture source with no storage.`);\n",[],[153,217],"80b7da8f-8caf-4e05-9cde-41327cc6fd28",["D",1788812071543],[],[153,32],"6fd00b4f-f6b7-40cd-8b4f-f4dc83ec7381","deploy-schema.ts","c915f464-aaf7-11f1-96a6-1607ee4eb77e",28,["D",1788811699090],"// Applies lib/schema.sql. Run this once at deployment, and again after any\n// schema change — request paths never provision, so this is the only thing\n// that creates a table here.\n//\n// Re-runnable: every statement is IF NOT EXISTS or INSERT OR IGNORE. Rerunning\n// restores a deleted seed row but never overwrites an operator's relabelling,\n// which makes it a bootstrap/migration tool rather than request-time setup.\n\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst sql = await readFile(\"/lib/schema.sql\", import.meta.url);\n\n// sqlite.execute takes one statement at a time, so the file is split on `;`.\n// Comments are stripped FIRST, and that is not cosmetic: a prose semicolon\n// inside a `--` comment would otherwise split a CREATE TABLE in half, which is\n// exactly how this failed the first time. Safe here because lib/schema.sql has\n// no `--` inside a string literal.\nconst statements = sql\n .replace(/--[^\\n]*/g, \"\")\n .split(\";\")\n .map((statement) => statement.trim())\n .filter(Boolean);\n\nfor (const statement of statements) await sqlite.execute(statement);\n\nconst counts = await sqlite.execute(\n \"SELECT (SELECT count(*) FROM wfiba_teams) AS teams, (SELECT count(*) FROM wfiba_games) AS games\",\n);\nconsole.log(JSON.stringify({ ok: true, statements: statements.length, ...counts.rows[0] }));\n",[],[153,228],["D",1788811087002],[195,196,197,198],[153],"c6af8893-cf6e-45fa-b1a0-e0d95d0d6fca","settings-form.md","01a07d73-0d02-703f-be72-f37ada841e12",["D",1788811087002],"# Source settings form contract\n\nThe parent renders source settings from authenticated `GET /v1/descriptor?sourceKey=...`.\nIt checks protocol/source identity, `temporal:true`, and\n`capabilities.validateSettings:true`. The live schema is authoritative for the\nform; stored registry schema snapshots are not used for editing.\n\n## Supported JSON Schema subset\n\nThe root is `{type:\"object\",properties:{...},additionalProperties:false}`.\nAn optional `required` array names declared properties. Each property has a\n`title`, optional `description`, and one of these shapes:\n\n- Boolean: `{type:\"boolean\",title:\"Show alerts\",default:false}`.\n- Multiple choices: `{type:\"array\",title:\"Locations\",default:[],uniqueItems:true,\n items:{type:\"string\",oneOf:[{const:\"west\",title:\"West\",\"x-group\":\"Regions\"}]}}`.\n\n`x-group` is the only UI extension. Choice values are stable strings;\ntitles and optional groups are display text. Declaration order determines form\norder. Defaults apply when displaying a field with no saved value. Empty\n`properties` means no settings. Field names start with a letter and contain\nonly letters, digits, and underscores; prototype-related names are rejected.\n\nUnsupported property types or constraints fail closed, with no save form.\nThis is deliberately not a general JSON Schema renderer. No nested objects,\nfree text, numbers, conditional fields, pagination, or source-supplied HTML/JS.\nAll labels are escaped by React. Legacy descriptor `options` is not consumed:\nthe choice-to-property binding is inside `settingsSchema`.\n\nA source may provide a static schema or an async `settingsSchema()` function.\nSports builds choices from its catalog in one descriptor request. Moon publishes\nthe empty object schema. No source data tables need changing.\n\n## Saving\n\nThe form includes a fingerprint of the rendered fields. The parent reloads the\ndescriptor on POST and rejects a changed fingerprint with 409; it does not\nsilently interpret an old form against new controls or choices.\n\nThe parent decodes only declared fields. Unchecked booleans become false and\nunselected arrays become []; defaults do not override an intentional clearing.\nUnknown fields, duplicate values, and unavailable choices are rejected.\nPreviously saved choices that disappear remain visible as checked unavailable\nvalues, requiring explicit removal.\n\nBefore persisting, the parent sends\n`POST /v1/validate-settings` with\n`{protocolVersion:1,sourceKey,settings}`.\nThe SDK invokes the same `parseSettings` used by reads and returns only\n`{protocolVersion:1,sourceKey,ok:true}`. It does not call `read`, perform writes,\nor expose parsed internal context. Implementers must keep `parseSettings`\nfree of mutation. Validation remains source-authoritative on every feed read,\nsince data/choices may change after a settings save.\n\nSource validation errors retain their stable error code. Unavailability returns\n502, invalid settings 422, and stale forms 409. None changes the assignment.\nSuccessful saves persist the original wire settings, then use the existing\ndevice notification path.\n\n## Scope and remaining coupling\n\nDevice settings routes and rendering have no source-kind dispatch, field-name\nknowledge, or sports catalog import. Another source supporting this profile\nneeds only a registered pointer and its descriptor/validation/read implementation.\n\nPrototype starter-feed defaults and operator ingestion/catalog/coverage adapters\nstill refer to Sports/Moon instance IDs. Removing those is separate from settings\nforms. Immutable releases, descriptor caching, schema migrations, and agent ACLs\nremain deferred.\n",[],[159,239],"0b664426-5a69-487e-89ae-927838c9e55d","serve.ts","01a07d73-0d02-703f-be72-ed2fce78ab35",["D",1788811087002],"// Version 1 of the source protocol, as a function of a SourceDefinition.\n// Everything here is the same for every source, which is exactly why it is\n// here and not in the source: an implementer who writes this by hand writes\n// the envelopes, the status codes and the output guard slightly differently\n// each time, and the parent is the one that finds out.\n//\n// The routes:\n// GET /v1/descriptor what this source is, and what settings it takes\n// POST /v1/read settings + context in, items out\n// POST /v1/write a named side effect from `writes`\n// POST /v1/publish 501; reserved, no source implements it yet\n//\n// Auth is NOT here. It belongs to whatever mounts this (rpc.ts), because the\n// credential is a deployment concern and a source shouldn't have an opinion\n// about how it is fronted.\n//\n// Part of the SDK — see sdk/contract.ts's header for the import rule.\n\nimport { items, PROTOCOL_VERSION, record } from \"./contract.ts\";\nimport type { SourceDefinition } from \"./defineSource.ts\";\n\n// Every response the protocol emits carries protocolVersion, and every\n// failure carries `ok:false` plus a code. Kept as two helpers so no route can\n// invent a third envelope shape.\nfunction fail(error: string, status = 400): Response {\n return Response.json({ protocolVersion: PROTOCOL_VERSION, ok: false, error }, { status });\n}\n\nexport async function serveSource(\n definition: SourceDefinition,\n req: Request,\n): Promise {\n const url = new URL(req.url);\n\n let body: Record = {};\n if (req.method === \"POST\") {\n try {\n const raw = await req.json();\n if (!record(raw)) return fail(\"invalid_body\");\n body = raw;\n } catch {\n return fail(\"invalid_json\");\n }\n if (body.protocolVersion !== PROTOCOL_VERSION) return fail(\"unsupported_protocol\");\n }\n\n // Identity is checked before routing, so a request addressed to the wrong\n // source is a 404 on every path — including /v1/publish. A val that mounts\n // several definitions dispatches on this key.\n const key = req.method === \"GET\" ? url.searchParams.get(\"sourceKey\") ?? definition.key : body.sourceKey;\n if (key !== definition.key) return fail(\"unknown_source\", 404);\n\n if (req.method === \"GET\" && url.pathname === \"/v1/descriptor\") {\n return Response.json({\n protocolVersion: PROTOCOL_VERSION,\n sourceKey: definition.key,\n temporal: definition.temporal ?? true,\n settingsSchema: typeof definition.settingsSchema === \"function\"\n ? await definition.settingsSchema() : definition.settingsSchema,\n ...(definition.options ? { options: await definition.options() } : {}),\n // Derived, never declared: capabilities are read off the definition, so\n // a source cannot advertise a write it doesn't implement or hide one it\n // does.\n capabilities: {\n read: true,\n validateSettings: true,\n write: Object.keys(definition.writes ?? {}),\n publish: false,\n },\n });\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/validate-settings\") {\n if (!record(body.settings)) return fail(\"invalid_settings\");\n const parsed = await definition.parseSettings(body.settings);\n if (!parsed.ok) return fail(parsed.error, parsed.status ?? 400);\n // Parsed values can contain private implementation context. Never export them.\n return Response.json({ protocolVersion: PROTOCOL_VERSION, sourceKey: definition.key, ok: true },\n { headers: { \"cache-control\": \"no-store\" } });\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/read\") {\n if (!record(body.settings) || !record(body.context)) return fail(\"settings_and_context_required\");\n // The offset is protocol-level, so it is checked here rather than by each\n // source. This is the wide guard — a source's own fallback narrows it\n // further (see ReadContext).\n const tz = body.context.utcOffsetSeconds;\n if (tz !== null && (typeof tz !== \"number\" || !Number.isInteger(tz) || Math.abs(tz) > 86400)) {\n return fail(\"invalid_timezone\");\n }\n const parsed = await definition.parseSettings(body.settings);\n if (!parsed.ok) return fail(parsed.error, parsed.status ?? 400);\n\n const produced = await definition.read(parsed.value, { utcOffsetSeconds: tz as number | null });\n // Guarding the source's own output, not a remote's: a duplicate id or a\n // non-finite timestamp is rejected here rather than at the parent, where\n // the whole composition would fail without naming which source produced\n // it. 502 and not 500 — the source answered, the answer was unusable.\n if (!items(produced)) return fail(\"invalid_source_output\", 502);\n return Response.json(\n { protocolVersion: PROTOCOL_VERSION, sourceKey: definition.key, items: produced },\n { headers: { \"cache-control\": \"no-store\" } },\n );\n }\n\n if (req.method === \"POST\" && url.pathname === \"/v1/write\") {\n if (!record(body.payload)) return fail(\"invalid_payload\");\n // Object.hasOwn, not a plain lookup: `writes` is an object literal, so\n // `operation: \"toString\"` would otherwise resolve to Object.prototype's\n // method and get called with the payload.\n const writes = definition.writes ?? {};\n const operation = typeof body.operation === \"string\" ? body.operation : \"\";\n if (!Object.hasOwn(writes, operation)) return fail(\"unsupported_operation\", 422);\n const handler = writes[operation];\n const outcome = await handler(body.payload);\n if (!outcome.ok) return fail(outcome.error, outcome.status ?? 400);\n return Response.json({\n protocolVersion: PROTOCOL_VERSION,\n sourceKey: definition.key,\n ok: true,\n result: outcome.value,\n });\n }\n\n // Reserved rather than absent: the parent already knows the route, and a\n // 501 tells it \"not yet\" where a 404 would say \"never\".\n if (url.pathname === \"/v1/publish\") return fail(\"not_implemented\", 501);\n return fail(\"not_found\", 404);\n}\n",[],[159,246],"4095f45e-b529-4dea-b4be-9eef7b0e1469","defineSource.ts","01a07d73-0d02-703f-be72-e85ee4c5bb06",["D",1788811087002],"// The author-facing surface: everything an implementer writes, and nothing\n// they don't. A source is one object. serveSource turns it into the protocol.\n//\n// Part of the SDK — see sdk/contract.ts's header for the import rule.\n\nimport type { Item, Result } from \"./contract.ts\";\n\n// Everything the parent forwards about the caller, which is deliberately\n// almost nothing: no device identity, no user id, no presentation. A source\n// gets a timezone offset and the settings that caller chose, and that is the\n// whole input surface.\n//\n// `utcOffsetSeconds: null` means the parent had no offset to forward. It does\n// NOT mean UTC, and treating it as UTC is a bug: it silently shifts every\n// day boundary to Greenwich for callers the parent couldn't resolve. Fall\n// back to a default the source picks.\nexport type ReadContext = { utcOffsetSeconds: number | null };\n\n// A write handler. The SDK has already checked that `payload` is a JSON\n// object; validating its contents is the operation's own job, because only it\n// knows the shape. Return `reject(\"...\")` for bad input rather than throwing.\nexport type WriteHandler = (\n payload: Record,\n) => Promise> | Result;\n\nexport type SourceDefinition = {\n // The protocol `sourceKey`. The parent addresses this source by it and the\n // SDK rejects any request naming a different one.\n key: string;\n\n // Whether items carry meaningful times. Advertised in the descriptor;\n // defaults to true, which is the only shape v1's Item can express.\n temporal?: boolean;\n\n // JSON Schema for `settings`, published in the descriptor so the parent can\n // build a settings UI without knowing what this source is. It is\n // DOCUMENTATION, not enforcement — the SDK does not validate against it.\n // parseSettings is what actually decides.\n settingsSchema: Record | (() => Promise> | Record);\n\n // The choices a caller can pick from, published alongside the schema — a\n // catalog, a list of channels, whatever this source's settings reference.\n // Called on every descriptor request, so it may hit storage. Omit it for a\n // source whose settings are free-form.\n options?: () => Promise | unknown;\n\n // Raw `settings` in, whatever `read` needs out. This is the ONLY place a\n // source validates caller input, and it must be total: reject anything not\n // recognized, including unknown keys.\n //\n // It may do I/O, and that is a feature — it is where to load a snapshot\n // that both validation and the read itself need (a catalog, say), so the\n // request pays for it once. Whatever it returns is handed to `read`\n // verbatim, so the returned type is free to be richer than the wire\n // settings.\n parseSettings: (\n raw: Record,\n ) => Promise> | Result;\n\n // The source itself. Parsed settings in, items out. Anything it returns is\n // validated against the item contract before it leaves the val, so this can\n // return its natural output and let the SDK be the gate.\n read: (settings: Settings, context: ReadContext) => Promise;\n\n // Named side effects the parent can invoke, if this source has any. The\n // keys become the protocol's `operation` values and the descriptor's\n // advertised write capabilities — declared once, so what a source says it\n // can do cannot drift from what it does.\n writes?: Record;\n};\n\n// Identity function. It exists purely so `Settings` is inferred from\n// parseSettings and checked against read's parameter at the definition site,\n// where the mismatch is legible, instead of at the serveSource call.\nexport function defineSource(\n definition: SourceDefinition,\n): SourceDefinition {\n return definition;\n}\n",[],[159,253],"c1b52ebd-03e9-42fb-a8f7-5c0862124831","contract.ts","01a07d73-0d02-703f-be72-e4b5574cb596",["D",1788811087002],"// What a source is held to: version 1 of the temporal item contract.\n//\n// This directory is the SDK. It is the half of this val that knows nothing\n// about sports, and the boundary is structural, not stylistic: NOTHING under\n// sdk/ may import anything outside sdk/. tools/sdk-boundary-check.ts fails if\n// that is ever violated, which is what keeps this directory extractable into\n// its own published val without a rewrite. See sdk/README.md before editing.\n\nexport const PROTOCOL_VERSION = 1;\n\n// The one payload shape every source produces, whatever it is a source of.\n// There is no away/home, no score, no sport — a source decides what to *say*\n// and the client renders these six fields blind.\n//\n// `caption: null` is a protocol value, not an absent field: it tells the\n// client to format `timestamp` itself as a local time. A source that wants\n// no caption at all still sends null.\n//\n// `timestamp` is Unix EPOCH SECONDS, not milliseconds. This is the single\n// most common implementation mistake: sending ms decodes on the client as a\n// date ~57,000 years out, and no type-level check catches it because both are\n// numbers. `items()` below cannot catch it either — it can only reject values\n// too large to be a plausible second-precision timestamp.\nexport type Item = {\n id: string;\n mainText: string;\n subText: string;\n caption: string | null;\n emphasized: boolean;\n timestamp: number;\n};\n\nexport function record(value: unknown): value is Record {\n return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\n// The gate every source's output passes through before it leaves the val.\n// serveSource applies this automatically, so an implementer cannot ship a\n// malformed item by forgetting to check: a failing read returns 502\n// invalid_source_output from this source rather than failing composition at\n// the parent, where nothing would name which source produced the bad item.\n//\n// `id` must be unique within one response and stable across polls of the same\n// underlying thing; the parent namespaces it per source, so it only has to be\n// unique here.\nexport function items(value: unknown): value is Item[] {\n return Array.isArray(value) && value.every(v => record(v)\n && typeof v.id === \"string\" && v.id.length > 0\n && typeof v.mainText === \"string\" && typeof v.subText === \"string\"\n && (v.caption === null || typeof v.caption === \"string\")\n && typeof v.emphasized === \"boolean\" && typeof v.timestamp === \"number\"\n && Number.isFinite(v.timestamp) && Math.abs(v.timestamp) <= 8640000000000)\n && new Set(value.map(v => v.id)).size === value.length;\n}\n\n// How a source hands a rejection back to the SDK instead of throwing. One\n// type for both settings parsing and write operations, so there is a single\n// failure idiom to learn.\n//\n// `error` becomes the protocol's error code verbatim, so it should be a\n// stable snake_case token the parent can branch on (\"unknown_team\"), not a\n// sentence. `status` defaults to 400 — the codes worth overriding are 404 for\n// a thing that does not exist and 422 for a well-formed request this source\n// will not perform.\n//\n// Returning a rejection is not the same as throwing: a throw is a bug and\n// surfaces as a 500, while a rejection is this source correctly refusing.\nexport type Result =\n | { ok: true; value: T }\n | { ok: false; error: string; status?: number };\n\nexport function accept(value: T): Result {\n return { ok: true, value };\n}\n\nexport function reject(error: string, status = 400): Result {\n return { ok: false, error, status };\n}\n",[],[159,260],"e9d99da0-b99c-4cb1-bcff-dd9727a4e43d","README.md","01a07d73-0d02-703f-be72-e0e1032733f8",["D",1788811087002],"# Source SDK (protocol v1)\n\nA **source** answers one question: *given these settings and this caller's\ntimezone, what are the next few things worth showing?* It returns a flat list\nof items. It does not know who is asking, what else is on the screen, or how\nany of it is rendered.\n\nThis directory is everything that is true of every source. It has **no\ndependencies** — not on npm, not on Val Town's `std`, not on the val around it.\nThree files:\n\n| File | What's in it |\n| --- | --- |\n| `contract.ts` | `Item`, the validator that enforces it, and `accept`/`reject` |\n| `defineSource.ts` | `SourceDefinition` — the whole author-facing surface |\n| `serve.ts` | `serveSource()` — the protocol, as a function of a definition |\n\n## Write a source\n\nFor the parent’s supported browser forms, see [the settings form contract](settings-form.md).\nThe protocol permits broader schemas; the parent deliberately rejects forms outside\nits small supported subset. The example below illustrates the broader protocol,\nnot a browser-renderable form.\n\nOne object, one mount. That is the entire API.\n\n```ts\nimport { accept, reject } from \"./sdk/contract.ts\";\nimport { defineSource } from \"./sdk/defineSource.ts\";\n\nexport default defineSource<{ city: string }>({\n key: \"weather\",\n\n settingsSchema: {\n type: \"object\",\n properties: { city: { type: \"string\" } },\n required: [\"city\"],\n additionalProperties: false,\n },\n\n // Optional legacy metadata. The parent does not render this; browser choices\n // must be bound to properties in settingsSchema (see settings-form.md).\n options: () => listCities(),\n\n // The only place caller input is validated. Must be total — reject anything\n // you don't recognize, unknown keys included. May do I/O.\n parseSettings: (raw) =>\n typeof raw.city === \"string\" && known(raw.city)\n ? accept({ city: raw.city })\n : reject(\"unknown_city\"),\n\n // The source itself. Timestamps are Unix SECONDS.\n read: async ({ city }, { utcOffsetSeconds }) => [{\n id: `weather:${city}:tomorrow`,\n mainText: \"Rain expected\",\n subText: \"Portland\",\n caption: null,\n emphasized: false,\n timestamp: 1788739200,\n }],\n\n // Optional: named side effects. The keys become the protocol's `operation`\n // values and the descriptor's advertised capabilities.\n writes: {\n \"cache.put\": async (payload) =>\n typeof payload.dateKey === \"string\"\n ? accept(await store(payload))\n : reject(\"invalid_cache_payload\"),\n },\n});\n```\n\nThen mount it behind whatever auth the deployment wants:\n\n```ts\n// rpc.ts — an HTTP val\nexport default (req: Request) =>\n authorized(req) ? serveSource(mySource, req) : unauthorized();\n```\n\n`tools/sdk-check.ts` in this val defines a complete fixture source in ~30\nlines and asserts the protocol against it. It is the shortest working example;\ncopying it is a reasonable way to start.\n\n## What the SDK does, so you don't\n\n- Routes `/v1/descriptor`, `/v1/validate-settings`, `/v1/read`, `/v1/write`, `/v1/publish`.\n- Validation-only requests call `parseSettings` without calling `read` or returning\n the parsed internal value. Keep `parseSettings` free of mutations.\n- `settingsSchema` may be an object or an async function returning one.\n- Parses and shape-checks the request body; rejects a wrong `protocolVersion`\n or a `sourceKey` that isn't yours.\n- Validates `context.utcOffsetSeconds` before your code sees it.\n- **Validates your output.** Items that break the contract — a duplicate `id`,\n a non-finite timestamp — never leave the val; the request fails 502\n `invalid_source_output` instead of failing composition at the parent, where\n nothing would say which source produced the bad item.\n- Derives `capabilities` from the definition, so what a source advertises\n cannot drift from what it implements.\n- Writes every response envelope, so no route can invent a new one.\n\n## What is yours\n\n- **Validating settings.** `settingsSchema` is published for the parent's UI;\n the SDK does not enforce it. The parent checks its supported form subset and\n posted values, then asks `parseSettings` to decide before saving. Reads also\n call `parseSettings` independently.\n- **Being total.** Reject unknown keys. A setting you silently ignore is a\n setting a caller thinks is working.\n- **Failing by returning, not throwing.** `reject(\"code\")` is this source\n correctly refusing, and the code reaches the parent verbatim — make it a\n stable snake_case token it can branch on, not a sentence. A throw is a bug\n and surfaces as a 500.\n- **Deciding what `null` means.** `utcOffsetSeconds: null` means the parent had\n no offset to forward. It does **not** mean UTC. Fall back to a zone you pick;\n treating it as 0 quietly moves every day boundary to Greenwich.\n\n## What is nobody's job here\n\nThese belong to the parent, and a source that does them will conflict with it:\n\n- Composition across sources, and namespacing ids (the parent prefixes yours).\n- Presentation: envelopes, eyebrows, section headers, empty-state copy.\n- Device or user identity — a source never learns who is asking.\n- Auth. That is the mount's business, not the source's.\n\n## Three things that go wrong\n\n1. **Milliseconds in `timestamp`.** It is Unix *seconds*. Sending ms decodes on\n the client as a date ~57,000 years out, and nothing catches it: both are\n numbers, and the contract validator can only reject values too large to be a\n plausible timestamp — a real ms value is not. Pin it in a test.\n2. **An `id` that isn't stable.** It must be the same across polls of the same\n underlying thing, and unique within one response. An id containing \"now\"\n makes every poll look like new content.\n3. **Re-reading storage in `read`.** `parseSettings` may do I/O and hands its\n return value to `read` verbatim — load the snapshot there once, and pass it\n along. As a bonus the request is then resolved against one consistent\n snapshot rather than two.\n\n## The one structural rule\n\n**Nothing under `sdk/` may import anything outside `sdk/`.**\n\nThat is what makes this directory liftable into its own published val without a\nrewrite, and it is the kind of rule that decays quietly, so it is enforced\nrather than asked for: `tools/sdk-check.ts` fails if an import escapes the\ndirectory, or if SDK *code* so much as names one of the host val's domain\nconcepts. Run it after touching anything in here.\n\nDomain vocabulary belongs on the other side of the seam — in this val, that is\n`sportsSource.ts` (the definition) and `lib/` (how it gets its data).\n",[],[159,267],["D",1788811087002],[189,190,191,192,193],[159],"e53da56f-3385-4def-a6b8-76382adc2dd6","store.ts","4edb298a-aaf7-11f1-9770-1607ee4eb77e",16,["D",1788811458159],"// The only module that talks to SQLite. Schema lives in lib/schema.sql and is\n// applied at deployment by tools/deploy-schema.ts — nothing here creates a\n// table, so a read is exactly the query it looks like.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type Team = { slug: string; displayName: string; espnCode: string };\n\n// One game, already flat. There is no JSON to parse on the read path: the\n// ingest did that once, at write time.\nexport type Game = {\n gameId: string;\n startTimeMs: number;\n awayCode: string | null;\n homeCode: string | null;\n status: string | null;\n channel: string | null;\n};\n\nexport async function readTeams(): Promise {\n const result = await sqlite.execute(\n \"SELECT slug, display_name, espn_code FROM wfiba_teams ORDER BY display_order, slug\",\n );\n return (result.rows as { slug: string; display_name: string; espn_code: string }[])\n .map((row) => ({ slug: row.slug, displayName: row.display_name, espnCode: row.espn_code }));\n}\n\n// The point of the row-per-game redesign: the team filter is a WHERE clause.\n//\n// `codes` is expanded into placeholders rather than interpolated — these are\n// catalog-resolved values, but building SQL by concatenation is how the one\n// case that isn't gets through later.\n//\n// Returns every candidate, not one per team: which game answers for which\n// favorite is a selection rule (lib/feed.ts), and doing it here would need\n// one query per team to express the same thing.\nexport async function gamesForCodes(codes: string[], fromMs: number): Promise {\n if (!codes.length) return [];\n const placeholders = codes.map(() => \"?\").join(\",\");\n const result = await sqlite.execute({\n sql: `SELECT game_id, start_time_ms, away_code, home_code, status, channel\n FROM wfiba_games\n WHERE start_time_ms >= ?\n AND (away_code IN (${placeholders}) OR home_code IN (${placeholders}))\n ORDER BY start_time_ms, game_id`,\n args: [fromMs, ...codes, ...codes],\n });\n return (result.rows as Record[]).map((row) => ({\n gameId: String(row.game_id),\n startTimeMs: Number(row.start_time_ms),\n awayCode: row.away_code === null ? null : String(row.away_code),\n homeCode: row.home_code === null ? null : String(row.home_code),\n status: row.status === null ? null : String(row.status),\n channel: row.channel === null ? null : String(row.channel),\n }));\n}\n\n// Replace-by-date, not upsert-by-game: one ESPN scoreboard request is the\n// authoritative answer for one date, so a game that has disappeared from it\n// (rescheduled to another day, or a knockout placeholder that got resolved)\n// must disappear here too. An upsert alone would leave that row behind\n// forever, and it would keep showing on someone's widget.\n//\n// Both statements go in one batch so a date is never briefly empty.\nexport async function replaceDate(dateKey: string, games: Game[]): Promise {\n const now = new Date().toISOString();\n await sqlite.batch([\n { sql: \"DELETE FROM wfiba_games WHERE date_key = ?\", args: [dateKey] },\n ...games.map((game) => ({\n sql: `INSERT INTO wfiba_games\n (game_id, date_key, start_time_ms, away_code, home_code, status, channel, ingested_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [game.gameId, dateKey, game.startTimeMs, game.awayCode, game.homeCode, game.status, game.channel, now],\n })),\n ], \"write\");\n return games.length;\n}\n\n// Operational visibility for /coverage: what this source actually holds.\n// `null` bounds mean an empty table, which is a real and reportable state —\n// it is what an un-ingested deployment looks like.\nexport async function coverage(): Promise<{\n games: number;\n dates: number;\n firstDate: string | null;\n lastDate: string | null;\n lastIngestedAt: string | null;\n}> {\n const result = await sqlite.execute(\n `SELECT count(*) AS games, count(DISTINCT date_key) AS dates,\n min(date_key) AS first_date, max(date_key) AS last_date,\n max(ingested_at) AS last_ingested_at\n FROM wfiba_games`,\n );\n const row = result.rows[0] as Record;\n return {\n games: Number(row.games),\n dates: Number(row.dates),\n firstDate: (row.first_date as string | null) ?? null,\n lastDate: (row.last_date as string | null) ?? null,\n lastIngestedAt: (row.last_ingested_at as string | null) ?? null,\n };\n}\n",[],[164,277],"0129f95d-a78f-43c8-83f6-6d077097ff0f","schema.sql","3ecd1698-aaf7-11f1-a051-1607ee4eb77e",15,["D",1788811431235],"-- Complete schema for source-wfiba. Applied by tools/deploy-schema.ts, never\n-- by a request: a read is one indexed SELECT, not a CREATE TABLE followed by\n-- one. Re-runnable — every statement is IF NOT EXISTS and the roster seed\n-- preserves operator edits to display_name.\n\n-- One row per game. This replaces the date-keyed JSON blob the sports val\n-- stores in source_cache: there, \"which games involve Spain\" meant loading and\n-- parsing every day's whole ESPN scoreboard, so the team filter could only run\n-- in TypeScript after the fact. Here it is a WHERE clause.\nCREATE TABLE IF NOT EXISTS wfiba_games (\n -- ESPN's event id. It is also the Item.id the widget sees, so it must be\n -- stable across re-ingests of the same game — it is.\n game_id TEXT PRIMARY KEY NOT NULL,\n -- ESPN's own UTC calendar bucket for the game, kept as the ingest unit: one\n -- scoreboard request covers one date_key, and re-ingesting a date replaces\n -- exactly that date's rows. Not used for feed selection, which is an\n -- absolute-instant comparison against start_time_ms.\n date_key TEXT NOT NULL CHECK (date_key GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]'),\n start_time_ms INTEGER NOT NULL CHECK (typeof(start_time_ms) = 'integer'),\n -- ESPN team abbreviations (\"ESP\", \"USA\"). Nullable because a knockout\n -- fixture appears on the schedule before its participants are decided;\n -- that game is real and belongs on the slate, it just matches no filter yet.\n away_code TEXT,\n home_code TEXT,\n -- ESPN's status.type.state: exactly \"pre\" | \"in\" | \"post\".\n status TEXT,\n -- Best-effort broadcaster string, verbatim from ESPN. Often absent.\n channel TEXT,\n ingested_at TEXT NOT NULL\n);\n\n-- The feed's access path: \"games at or after this instant involving any of\n-- these teams\", which is one index scan per team column.\nCREATE INDEX IF NOT EXISTS wfiba_games_start ON wfiba_games (start_time_ms);\nCREATE INDEX IF NOT EXISTS wfiba_games_away ON wfiba_games (away_code, start_time_ms);\nCREATE INDEX IF NOT EXISTS wfiba_games_home ON wfiba_games (home_code, start_time_ms);\nCREATE INDEX IF NOT EXISTS wfiba_games_date ON wfiba_games (date_key);\n\n-- The selectable roster, and the only reason it is a table rather than a\n-- SELECT DISTINCT over wfiba_games: the settings form's choices must not\n-- depend on ingest state. Deriving them from played games would hide a team\n-- whose fixtures are not ingested yet, and would offer ESPN's \"USA\" where the\n-- product says \"USA\" only because someone chose that label.\n--\n-- One competition, so no competition table and no adapter column: this val is\n-- the 2026 FIBA Women's World Cup and nothing else.\nCREATE TABLE IF NOT EXISTS wfiba_teams (\n -- The stable assignment identifier stored in the parent's device settings.\n -- Deliberately the same slugs the sports val's catalog uses, so an existing\n -- selection means the same thing here.\n slug TEXT PRIMARY KEY NOT NULL CHECK (\n length(slug) > 0 AND slug = lower(slug) AND slug NOT GLOB '*[^a-z0-9-]*'\n ),\n display_name TEXT NOT NULL CHECK (length(trim(display_name)) > 0),\n espn_code TEXT NOT NULL UNIQUE CHECK (length(trim(espn_code)) > 0),\n display_order INTEGER NOT NULL CHECK (typeof(display_order) = 'integer' AND display_order >= 0)\n);\n\n-- The 16-nation field, carried over verbatim from the sports val's catalog_teams\n-- (slug, label and ESPN code all preserved). INSERT OR IGNORE, so re-running\n-- this file restores a deleted row but never overwrites a relabelled one.\nINSERT OR IGNORE INTO wfiba_teams (slug, display_name, espn_code, display_order) VALUES\n ('australia', 'Australia', 'AUS', 0),\n ('belgium', 'Belgium', 'BEL', 1),\n ('china', 'China', 'CHN', 2),\n ('czechia', 'Czechia', 'CZE', 3),\n ('spain', 'Spain', 'ESP', 4),\n ('france', 'France', 'FRA', 5),\n ('germany', 'Germany', 'GER', 6),\n ('hungary', 'Hungary', 'HUN', 7),\n ('italy', 'Italy', 'ITA', 8),\n ('japan', 'Japan', 'JPN', 9),\n ('south-korea', 'South Korea', 'KOR', 10),\n ('mali', 'Mali', 'MLI', 11),\n ('nigeria', 'Nigeria', 'NGR', 12),\n ('puerto-rico', 'Puerto Rico', 'PUR', 13),\n ('turkey', 'Turkey', 'TUR', 14),\n ('united-states', 'USA', 'USA', 15);\n",[],[164,285],"9a8c21c1-ba68-49e9-b437-8c3046a14050","items.ts","8bd3475a-aaf7-11f1-96e8-1607ee4eb77e",19,["D",1788811560428],"// The game -> temporal-item boundary: a stored row in, the widget's view shape\n// out. Every field here is a VIEW decision — the server decides exactly what\n// text to show and the client is a dumb template with no knowledge of \"teams\"\n// or \"games\". There is deliberately no away/home object and no score field.\n//\n// The wire keys (`id`, `mainText`, `subText`, `caption`, `emphasized`,\n// Unix-second `timestamp`) are mirrored by the Codable types at\n// Shared/WidgetPayload.swift in the iOS repo. Only add fields, never remove or\n// repurpose one, without a coordinated schemaVersion bump.\n//\n// Pure: no I/O. The team labels arrive as a snapshot the caller already read.\n\nimport { channelInfo, type ChannelInfo } from \"./channels.ts\";\nimport type { Game, Team } from \"./store.ts\";\nimport type { Item } from \"../sdk/contract.ts\";\n\n// The one competition this val serves, so a constant rather than a lookup —\n// the sports val reads this per game off its catalog because it has five.\nconst EMOJI = \"🏀\";\n\ntype Status = \"scheduled\" | \"live\" | \"final\";\n\n// ESPN's status.type.state is already exactly this 3-value vocabulary, so this\n// is a rename rather than the guesswork Sleeper's inconsistent vocabulary\n// needs. Anything unrecognized falls back to \"scheduled\", which is never\n// fatal — an item the client can't parse is worse than one guessed wrong.\nconst STATUS_MAP: Record = {\n pre: \"scheduled\",\n in: \"live\",\n post: \"final\",\n};\n\n// `caption: null` is a protocol value, not just \"no status\" — it tells the\n// client to format `timestamp` itself as a local start time, which is right\n// for a game that hasn't started. Only live is emphasized; final gets the dim\n// treatment.\nfunction captionFor(status: Status): { caption: string | null; emphasized: boolean } {\n if (status === \"live\") return { caption: \"LIVE\", emphasized: true };\n if (status === \"final\") return { caption: \"END\", emphasized: false };\n return { caption: null, emphasized: false };\n}\n\n// subText's channel metadata, built from exactly what channelInfo gives —\n// nothing invented for this format. \"TBD\" is the fallback for the one case\n// channelInfo can't fill in at all: no channel string stored.\nfunction channelText(channel: ChannelInfo): string {\n if (!channel.label) return \"TBD\";\n if (channel.directv_channel) return `${channel.label} · ${channel.directv_channel}`;\n if (channel.note) return `${channel.label} · ${channel.note}`;\n return channel.label;\n}\n\n// An opponent outside the roster keeps its ESPN code rather than having a name\n// invented for it. There is one competition here, so unlike the sports val's\n// teamLabel this needs no (sport, code) pair to disambiguate — no two entries\n// can share a code.\nfunction label(code: string | null, teams: Team[]): string {\n if (!code) return \"\";\n return teams.find((team) => team.espnCode === code)?.displayName ?? code;\n}\n\nfunction toItem(game: Game, teams: Team[]): { item: Item; status: Status } {\n const status = (game.status && STATUS_MAP[game.status]) || \"scheduled\";\n return {\n item: {\n // ESPN's event id, stable across re-ingests of the same game. The parent\n // namespaces it with its own source id before it reaches the widget.\n id: game.gameId,\n mainText: `${EMOJI} ${label(game.awayCode, teams)} @ ${label(game.homeCode, teams)}`,\n subText: channelText(channelInfo(game.channel)),\n ...captionFor(status),\n // Unix epoch SECONDS, UTC. Getting this wrong (sending ms) decodes on\n // the client as a timestamp ~57,000 years out; nothing in a passing\n // TypeScript-side test would catch that, only a pinned integer does.\n timestamp: Math.floor(game.startTimeMs / 1000),\n },\n status,\n };\n}\n\n// `hideCompleted` is the assignment's `intradayFilter` setting. It filters on\n// the status computed above, not on caption text: \"END\" is a display string\n// while `status` is the actual classification.\nexport function buildItems(games: Game[], teams: Team[], hideCompleted = false): Item[] {\n const built = games\n .toSorted((a, b) => a.startTimeMs - b.startTimeMs)\n .map((game) => toItem(game, teams));\n return (hideCompleted ? built.filter((b) => b.status !== \"final\") : built).map((b) => b.item);\n}\n",[],[164,293],"26dc6b9a-2370-4a41-b666-4cbb111521cd","feed.ts","97176894-aaf7-11f1-9c93-1607ee4eb77e",21,["D",1788811594142],"// The pipeline: selected team slugs and a client offset in, temporal widget\n// items out. The one place storage, date math and rendering meet.\n\nimport { clientOffsetSeconds, dayStartMsAtOffset } from \"./dates.ts\";\nimport { buildItems } from \"./items.ts\";\nimport { gamesForCodes, type Game, type Team } from \"./store.ts\";\nimport type { Item } from \"../sdk/contract.ts\";\n\n// Each favorite's own next game, unioned and deduped.\n//\n// Resolving each team independently is the load-bearing part. One shared\n// \"earliest\" across the set silently drops every OTHER favorite whose next\n// game lands later: with Spain playing tonight and USA not until Sunday,\n// selecting both must return both, not just Spain. Two favorites meeting each\n// other produce one game, not two rows of it.\n//\n// `candidates` is expected to be pre-filtered to games at or after the\n// caller's lower bound and sorted by start time — gamesForCodes does both.\n// This function picks the earliest of what it is handed and has no notion of\n// \"now\".\nexport function nextPerTeam(candidates: Game[], codes: string[]): Game[] {\n const picked = new Map();\n for (const code of codes) {\n const next = candidates.find((game) => game.awayCode === code || game.homeCode === code);\n if (next) picked.set(next.gameId, next);\n }\n return [...picked.values()];\n}\n\n// `utcOffsetSeconds: null` means the parent had no client offset to pass on,\n// not \"UTC\" — clientOffsetSeconds falls back to this source's own default zone\n// rather than silently shifting the day boundary to Greenwich.\n//\n// An empty or fully-unresolved selection produces an empty feed rather than\n// widening to the whole tournament. An empty card is the honest answer to\n// \"show me nothing in particular\", and a whole-league slate is exactly the\n// laundry list the team filter exists to avoid.\nexport async function feedItems(\n settings: { teams: string[]; intradayFilter: boolean },\n utcOffsetSeconds: number | null,\n teams: Team[],\n): Promise {\n // Deduped, and in the roster's display order rather than the order the\n // caller happened to save them in, so the feed is a function of the\n // selection set and not of its spelling.\n const selected = new Set(settings.teams);\n const codes = teams.filter((team) => selected.has(team.slug)).map((team) => team.espnCode);\n if (!codes.length) return [];\n\n const fromMs = dayStartMsAtOffset(clientOffsetSeconds(utcOffsetSeconds));\n const candidates = await gamesForCodes(codes, fromMs);\n return buildItems(nextPerTeam(candidates, codes), teams, settings.intradayFilter);\n}\n",[],[164,301],"715d0715-f68b-4b1d-8335-762e385a720a","espn.ts","619af0be-aaf7-11f1-a235-1607ee4eb77e",17,["D",1788811489624],"// ESPN's scoreboard payload -> this val's rows. Pure: the fetch that produces\n// the input does NOT happen here, and cannot — ESPN answers Val Town's shared\n// egress with 403 Access Denied regardless of headers (re-verified 2026-09-07).\n// An external process on an unblocked network fetches the scoreboard and POSTs\n// it to /v1/write; this module is what turns it into games.\n//\n// The relevant upstream is\n// site.api.espn.com/apis/site/v2/sports/basketball/fiba/scoreboard?dates=YYYYMMDD\n// which for the 2026 cycle is league 53, \"FIBA World Cup\" — the Women's World\n// Cup, 2026-09-04 to 2026-09-14. That bucket is reused across cycles and can\n// change tournament and gender between them, so revalidate it before trusting\n// this val with a later event rather than assuming the slug still means this.\n//\n// Every field is a progressive enhancement: a missing team code or broadcast\n// yields null and renders as the same \"TBD\"/blank a partial game already\n// shows, rather than failing the whole ingest.\n\nimport type { Game } from \"./store.ts\";\n\ntype EspnTeam = { abbreviation?: string };\ntype EspnCompetitor = { homeAway?: string; team?: EspnTeam };\ntype EspnBroadcast = { names?: string[] };\ntype EspnCompetition = {\n competitors?: EspnCompetitor[];\n status?: { type?: { state?: string } };\n broadcasts?: EspnBroadcast[];\n};\ntype EspnEvent = { id?: string; date?: string; competitions?: EspnCompetition[] };\n\nexport type EspnScoreboard = { events?: EspnEvent[] };\n\nexport function scoreboard(value: unknown): value is EspnScoreboard {\n if (typeof value !== \"object\" || value === null || Array.isArray(value)) return false;\n const events = (value as EspnScoreboard).events;\n // An absent `events` is how ESPN reports a date with no games — a valid\n // payload meaning \"this date is empty\", not a malformed one. An `events`\n // that is present but not an array is malformed.\n return events === undefined || Array.isArray(events);\n}\n\n// A game with no id can't have a stable Item.id, which is the one field the\n// item contract cannot fake — so it is dropped rather than given a synthetic\n// one that changes between polls. Real captures always carry it.\nfunction toGame(event: EspnEvent): Game | null {\n if (typeof event.id !== \"string\" || !event.id) return null;\n const startTimeMs = event.date ? Date.parse(event.date) : NaN;\n if (!Number.isFinite(startTimeMs)) return null;\n\n const competition = event.competitions?.[0];\n const competitors = competition?.competitors ?? [];\n const side = (which: string) =>\n competitors.find((competitor) => competitor.homeAway === which)?.team?.abbreviation ?? null;\n\n return {\n gameId: event.id,\n startTimeMs,\n awayCode: side(\"away\"),\n homeCode: side(\"home\"),\n // ESPN's status.type.state is already the 3-value vocabulary\n // (\"pre\"/\"in\"/\"post\") that lib/items.ts maps directly, unlike its noisier\n // status.type.name (\"STATUS_SCHEDULED\").\n status: competition?.status?.type?.state ?? null,\n channel: competition?.broadcasts?.[0]?.names?.[0] ?? null,\n };\n}\n\n// Only games whose own UTC date matches the requested key. ESPN's scoreboard\n// for a date occasionally carries an adjacent day's game; without this, two\n// date ingests would each claim it and the second replaceDate would delete\n// what the first wrote.\nexport function gamesFromScoreboard(payload: EspnScoreboard, dateKey: string): Game[] {\n return (payload.events ?? [])\n .map(toGame)\n .filter((game): game is Game =>\n game !== null && new Date(game.startTimeMs).toISOString().slice(0, 10) === dateKey\n );\n}\n",[],[164,309],"ce89b7e7-cedd-464f-a0fe-2a2560984f52","dates.ts","01a07d73-0d02-703f-be72-bb1a6d27dcfe",18,["D",1788811535782],"// Pure date math for the feed. No I/O, and `now` is always explicit, which is\n// what lets a check pin behaviour without freezing the clock.\n//\n// Only the client-facing half of the sports val's dates.ts survives here.\n// Its Sleeper half (todaySlateDate/addDays, keyed on an IANA zone because\n// Sleeper buckets by Eastern day) went with the Sleeper adapter: this source\n// has one upstream and it speaks UTC.\n\n// The client's timezone when the parent has no offset to pass on. Resolved to\n// a live, DST-correct offset rather than stored as a constant number of\n// seconds, so it does not go stale twice a year.\nconst DEFAULT_CLIENT_TIME_ZONE = \"America/Los_Angeles\";\n\n// The calendar date `now` falls on at a fixed UTC offset. No DST table lookup,\n// because the offset has already had DST folded into it — by the iOS client,\n// or by offsetSecondsForZone's live Intl lookup for the fallback case.\nexport function dateAtOffset(offsetSeconds: number, now = new Date()): string {\n return new Date(now.getTime() + offsetSeconds * 1000).toISOString().slice(0, 10);\n}\n\n// The lower bound on candidate games, as an absolute instant: the start of the\n// client's current calendar day.\n//\n// The day's START, not `now`, and that is deliberate — it is what keeps a\n// finished game on the card for the rest of the day. `intradayFilter` is the\n// opt-out.\nexport function dayStartMsAtOffset(offsetSeconds: number, now = new Date()): number {\n return Date.parse(`${dateAtOffset(offsetSeconds, now)}T00:00:00.000Z`) - offsetSeconds * 1000;\n}\n\n// The live GMT offset for an IANA zone at `now`, via Intl's own tables, so the\n// fallback path stays DST-correct without a DST table here. \"longOffset\" is\n// the Intl mode that always renders \"GMT±HH:MM\" rather than a zone\n// abbreviation, which is what makes it parseable.\nfunction offsetSecondsForZone(timeZone: string, now: Date): number {\n const part = new Intl.DateTimeFormat(\"en-US\", { timeZone, timeZoneName: \"longOffset\" })\n .formatToParts(now)\n .find((p) => p.type === \"timeZoneName\")?.value;\n const match = part && /^GMT([+-])(\\d{1,2}):(\\d{2})$/.exec(part);\n if (!match) return 0;\n return (match[1] === \"-\" ? -1 : 1) * (Number(match[2]) * 3600 + Number(match[3]) * 60);\n}\n\n// The protocol's `context.utcOffsetSeconds`, resolved to a usable offset. iOS\n// sends TimeZone.current.secondsFromGMT(), seconds east of GMT with DST\n// already folded in, so there is nothing to look up here — just range-check it.\n//\n// `null` means the parent had no client offset to forward, NOT \"UTC\": it falls\n// back to DEFAULT_CLIENT_TIME_ZONE's live offset. An out-of-range value takes\n// the same fallback rather than throwing — a failed source fails the whole\n// composition, which is worse than a slightly-off day boundary. The range\n// [-12:00, +14:00] is every real-world UTC offset (Baker Island to Kiribati);\n// the protocol's own guard is wider, so this is the narrower of the two checks\n// and the one that decides.\nexport function clientOffsetSeconds(raw: number | null, now = new Date()): number {\n return raw !== null && Number.isInteger(raw) && raw >= -43200 && raw <= 50400\n ? raw\n : offsetSecondsForZone(DEFAULT_CLIENT_TIME_ZONE, now);\n}\n",[],[164,317],"08f71cb6-2169-423c-94b2-13ea8c99c328","channels.ts","01a07d73-0d02-703f-be72-b6e5a71c80ba",["D",1788811087002],"// Turns Sleeper's raw channel string into the shape the item builder reads.\n// Pure; broadcaster display rules are independent of the team catalog.\n\n// Existing broadcaster presentation rules; these are outside the selection catalog.\n// A blunt chop rather than a width measurement: this is a fallback label for a\n// regional broadcaster nobody has mapped, not a layout decision.\nconst MAX_CHANNEL_LABEL = 10;\nfunction chop(text: string, max: number): string {\n return text.length <= max ? text : `${text.slice(0, max - 1)}…`;\n}\nconst NATIONAL_CHANNELS: Record = {\n \"abc\": {\n \"label\": \"ABC\",\n \"directv_channel\": 4,\n \"note\": null\n },\n \"cbs\": {\n \"label\": \"CBS\",\n \"directv_channel\": 2,\n \"note\": null\n },\n \"espn\": {\n \"label\": \"ESPN\",\n \"directv_channel\": 206,\n \"note\": null\n },\n \"ion\": {\n \"label\": \"ION\",\n \"directv_channel\": 305,\n \"note\": null\n },\n \"nbatv\": {\n \"label\": \"NBATV\",\n \"directv_channel\": 216,\n \"note\": null\n },\n \"nbc\": {\n \"label\": \"NBC\",\n \"directv_channel\": 4,\n \"note\": null\n },\n \"tbs\": {\n \"label\": \"TBS\",\n \"directv_channel\": 247,\n \"note\": null\n },\n \"usa\": {\n \"label\": \"USA\",\n \"directv_channel\": 242,\n \"note\": null\n },\n \"sportsnet\": {\n \"label\": \"SportsNet\",\n \"directv_channel\": 691,\n \"note\": null\n }\n};\nconst STREAMING_CHANNELS: Record = {\n \"amzn\": {\n \"label\": \"AMZN\",\n \"note\": \"computer only\"\n },\n \"amazon\": {\n \"label\": \"AMZN\",\n \"note\": \"computer only\"\n },\n \"peacock\": {\n \"label\": \"Peacock\",\n \"note\": \"computer only\"\n },\n \"hbo max\": {\n \"label\": \"HBO Max\",\n \"note\": \"computer only\"\n }\n};\n\n\n// `name` stays the raw string Sleeper sent — it is the drift-detection\n// value, and the json format has to keep reporting what actually arrived.\n// `label` is the display form: dictionary-mapped where there is a mapping,\n// chopped raw text where there isn't.\nexport type ChannelInfo = {\n category: string;\n name: string | null;\n label: string | null;\n directv_channel: number | null;\n note: string | null;\n};\n\nfunction channelMatches(rawChannel: string, key: string) {\n return new RegExp(`\\\\b${key.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}\\\\b`, \"i\").test(rawChannel);\n}\n\nexport function channelInfo(rawChannel: string | null | undefined): ChannelInfo {\n if (!rawChannel) return { category: \"unknown\", name: null, label: null, directv_channel: null, note: null };\n\n const nationalKey = Object.keys(NATIONAL_CHANNELS).find((key) => channelMatches(rawChannel, key));\n if (nationalKey) return { category: \"national\", name: rawChannel, ...NATIONAL_CHANNELS[nationalKey] };\n\n const streamingKey = Object.keys(STREAMING_CHANNELS).find((key) => channelMatches(rawChannel, key));\n if (streamingKey) {\n return { category: \"streaming\", name: rawChannel, directv_channel: null, ...STREAMING_CHANNELS[streamingKey] };\n }\n\n return {\n category: \"regional\",\n name: rawChannel,\n label: chop(rawChannel, MAX_CHANNEL_LABEL),\n directv_channel: null,\n note: null,\n };\n}\n",[],[164,325],["D",1788811087002],[181,182,183,184,185,186,187],[164],["D",1788811087002],["D",1789509043237],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_126":372,"_373":374,"_375":376,"_377":24,"_378":24,"_379":24,"_380":58,"_381":-5,"_382":-7,"_383":-7,"_384":62,"_385":24,"_386":24,"_387":-5,"_388":24,"_389":24,"_390":24,"_391":-5},"ENV",{"_343":344,"_345":346,"_347":89,"_348":349,"_350":351,"_352":353,"_354":355,"_356":357,"_358":359,"_360":361,"_362":363,"_364":365,"_366":367,"_368":369,"_370":371},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v35