[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_294":295,"_296":297},"routes/_app.x.$handle.$name",{"_102":101,"_32":44,"_110":88,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":123,"_124":125,"_126":26,"_127":128,"_129":24,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":26,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":24,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":26},"version",62,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":26,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":26},"previous","deleted",true,"deletedHere",false,"path","debug_waf2.ts","latestPath","fileId","004406d2-87bd-11f1-841c-1607ee4eb77e","name","fileType","script","content","// Second pass at the WAF blocklist — attributes and URI schemes, not just tags.\nconst key = Deno.env.get(\"CELERIS_API_KEY\")!;\n\nasync function blocked(payload: string): Promise {\n const res = await fetch(\"https://inference.celeris.ai/celeris-1/v1/chat/completions\", {\n method: \"POST\",\n headers: { Authorization: `Bearer ${key}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: \"celeris-1\",\n messages: [{ role: \"user\", content: `Reply with ok. Ignore: ${payload}` }],\n max_tokens: 256,\n temperature: 0,\n }),\n });\n return res.status === 403;\n}\n\nconst candidates: Record = {\n 'style= attribute': '

',\n \"style = spaced\": '

',\n \"srcdoc=\": '

',\n \"data: uri\": 'y',\n \"expression(\": \"width: expression(alert(1))\",\n \"url(\": \"background: url(/img.png)\",\n \"@import\": \"@import url('x.css');\",\n \"formaction=\": '',\n \"xlink:href\": 'y',\n \"class= (control)\": '

',\n \"h-[40%] arbitrary\": '

',\n \"aria-label=\": '',\n \"data-attr=\": '

',\n};\n\nconst hits: string[] = [];\nfor (const [label, payload] of Object.entries(candidates)) {\n const isBlocked = await blocked(payload);\n if (isBlocked) hits.push(label);\n console.log(`${isBlocked ? \"BLOCKED \" : \"ok \"} ${label}`);\n}\nconsole.log(\"\\nnewly blocked:\", JSON.stringify(hits));\n","createdAt",["D",1784938124808],"branchVersion","branchId","47efafa8-61cb-4f71-9cfb-728de8d47dfd","id","0ca32379-8f7c-4225-adac-e716712decaa","celeris_coder",["D",1784936344655],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Chat-driven HTML codegen using the Celeris API","imageUrl","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","019f967f-2c90-70b9-bd1c-5ead1654e4af","pinPreview","pinMigrated","screenshotVersion","likeCount",1,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","0ca323798f7c4225adace716712decaa","tursoHostname","0ca323798f7c4225adace716712decaa-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789474235934],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_109":105},"org",{"_102":101,"_103":-5,"_104":105,"_18":54,"_106":107,"_108":26},"branch",{"_13":87,"_32":88,"_42":41,"_89":43,"_90":91,"_92":93,"_94":49,"_95":96,"_97":98,"_99":44,"_100":101},"isOwned",104,"main","projectId","forkedBranchId","961078ea-f528-11ef-aa68-569c3dd06744","forkedBranchVersion",89,"forkedProjectPrivacy","forkedProjectId","96102714-f528-11ef-aa68-569c3dd06744","forkedProjectOrgId","019aa807-52c2-709c-928b-2029bae9a558","projectName","userHandle","stevekrouse","handle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":289,"_46":-5,"_47":26,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":24,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":290,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":291,"_82":292,"_84":293,"_86":26},"tree",[199,208,209,210,211],"files",[199,200,201,202,203,204,205,206,207,208,209,210,211],"counts",{"_189":165,"_190":61,"_191":165,"_192":193,"_194":195},"contents",[146,147,148,149,150],"upstreamProject",{"_42":96,"_32":141,"_51":142,"_53":143,"_48":49,"_80":144},"upstreamBranch",{"_42":91,"_37":134,"_135":136,"_32":88,"_89":96,"_13":137,"_90":-5,"_92":-5,"_138":139,"_46":-5,"_86":26,"_48":49,"_100":140,"_62":98,"_99":141},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1740674013689],"updatedAt",["D",1785420707976],91,"lockfileKey","1785420708123-esm.town_v_templates_react-hono-starter@91-main","templates","react-hono-starter","Starter template with client-side React & Hono server","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/64dc00cc-94d9-47dd-81b1-dde02610d900/square512?exp=1789563599&sig=c3b06339283e4bc07165fa54c09036aa25cea7ac6108dec2f68b1acc60fad95f",{"_102":140,"_109":145},"https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/129cab32-3bd7-4c3e-f39b-f12900c76100/square512?exp=1789563599&sig=a969511699ef574c42d646a130422bcd8ffa020e1e59bd8fb5bde6db2cea72c1",{"_42":183,"_32":184,"_30":185,"_153":-5,"_40":41,"_39":61,"_155":24,"_37":186,"_13":165,"_33":187,"_35":-5,"_23":26,"_160":-5,"_27":188},{"_42":175,"_32":176,"_30":177,"_153":-5,"_40":41,"_39":178,"_155":26,"_37":179,"_13":180,"_33":20,"_35":181,"_23":26,"_160":-5,"_27":182},{"_42":167,"_32":168,"_30":169,"_153":-5,"_40":41,"_39":170,"_155":26,"_37":171,"_13":172,"_33":34,"_35":173,"_23":26,"_160":-5,"_27":174},{"_42":163,"_32":28,"_30":31,"_153":-5,"_40":41,"_39":14,"_155":26,"_37":164,"_13":165,"_33":34,"_35":36,"_23":26,"_160":-5,"_27":166},{"_42":151,"_32":152,"_30":56,"_153":-5,"_40":41,"_39":154,"_155":26,"_37":156,"_13":157,"_33":158,"_35":159,"_23":26,"_160":161,"_27":162},"d3db4efa-3785-42ec-9d90-cdcc2a79402c","index.ts","parentId",54,"latest",["D",1784937982673],6,"http","import { parseVal, serveFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { Hono } from \"npm:hono\";\nimport { generatePage } from \"./celeris.ts\";\n\nconst app = new Hono();\n\n// Serve index.html at the root /\napp.get(\"/\", () => serveFile(\"/frontend/index.html\"));\n\n// Serve all /frontend files\napp.get(\"/frontend/**/*\", (c) => serveFile(c.req.path));\n\n// View source redirect\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n/**\n * Codegen, as a server-sent event stream.\n *\n * The pipeline makes several Celeris calls (markup, continuations, behaviour),\n * and each one streams back in ~256-token diffusion blocks. Rather than hide\n * that behind one slow request, every block and every call boundary is forwarded\n * to the client so the UI can show the machinery and the timings as they happen.\n */\napp.post(\"/api/generate\", async (c) => {\n const { instructions } = await c.req.json().catch(() => ({}));\n\n const clean = Array.isArray(instructions)\n ? instructions.filter((s): s is string => typeof s === \"string\" && s.trim() !== \"\")\n .map((s) => s.trim())\n : [];\n\n if (clean.length === 0) {\n return c.json({ error: \"Missing 'instructions'.\" }, 400);\n }\n\n const encoder = new TextEncoder();\n const stream = new ReadableStream({\n async start(controller) {\n const send = (event: unknown) => {\n controller.enqueue(encoder.encode(`data: ${JSON.stringify(event)}\\n\\n`));\n };\n try {\n await generatePage(clean, send);\n } catch (err) {\n const message = err instanceof Error ? err.message : String(err);\n console.error(\"generate failed:\", message);\n send({ type: \"error\", message });\n } finally {\n controller.close();\n }\n },\n });\n\n return new Response(stream, {\n headers: {\n \"Content-Type\": \"text/event-stream; charset=utf-8\",\n \"Cache-Control\": \"no-cache, no-transform\",\n \"Connection\": \"keep-alive\",\n // Discourage proxy buffering, which would defeat the point of streaming.\n \"X-Accel-Buffering\": \"no\",\n },\n });\n});\n\n// Unwrap and rethrow Hono errors as the original error\n// If you delete this, all errors will be \"Internal Server Error\"\napp.onError((err) => Promise.reject(err));\n\n// HTTP vals expect an exported \"fetch handler\"\n// This is how you \"run the server\" in Val Town with Hono\nexport default app.fetch;\n","label","celeris-coder",[152],"c3843118-c0bc-4b88-8de7-29e05f1b4d08",["D",1784938124808],0,[28],"8fb60a0f-a444-46f8-aac0-a8ebd491bac4","celeris.ts","0fd0ba18-87b9-11f1-8984-1607ee4eb77e",53,["D",1784937970111],15,"/**\n * Server-side wrapper around the Celeris API (celeris-1).\n *\n * ## Why this file is shaped the way it is\n *\n * **A WAF sits in front of the API.** Request bodies containing common XSS\n * signatures are rejected with a 403 and an nginx error page (not the documented\n * JSON envelope). Escaping doesn't help. Only *inbound* traffic is filtered —\n * generated output is never touched.\n *\n * Blocked: script, style, iframe, object, embed, link, meta, svg tags,\n * ` Math.ceil(s.length / 4);\n\nconst BLOCKED = new RegExp(\n [\n \"(?:<|<)\\\\s*/?\\\\s*(?:script|style|iframe|object|embed|link|meta|svg)\\\\b\",\n \"(?:<|<)!\\\\s*DOCTYPE\",\n \"\\\\son[a-z]{2,}\\\\s*=\",\n \"javascript\\\\s*:\",\n ].join(\"|\"),\n \"i\",\n);\nexport const hasBlockedLiteral = (s: string) => BLOCKED.test(s);\n\n/**\n * Strip the constructs above so a section can still be used as *context* for a\n * later call. Only applied to the copy we send — the original text is what ends\n * up in the assembled page. Not usable for continuation prefills, which must\n * match the model's own output byte for byte.\n */\nexport function sanitizeForRequest(s: string): string {\n return s\n .replace(/<\\s*(script|style|svg|iframe|object|embed)\\b[\\s\\S]*?<\\s*\\/\\s*\\1\\s*>/gi, \"\")\n .replace(/<\\s*(?:link|meta)\\b[^>]*>/gi, \"\")\n .replace(/]*>/gi, \"\")\n .replace(/\\son[a-z]{2,}\\s*=\\s*(?:\"[^\"]*\"|'[^']*'|[^\\s>]+)/gi, \"\")\n .replace(/javascript\\s*:/gi, \"\");\n}\n\n/**\n * celeris-1 sometimes wraps output in a markdown fence, sometimes with the\n * opening backticks missing. See https://docs.celeris.ai/known-issues\n */\nexport function stripFence(content: string): string {\n return content\n .trim()\n .replace(/^(?:```[a-zA-Z]*|html)[ \\t]*\\r?\\n/, \"\")\n .replace(/\\r?\\n```[ \\t]*$/, \"\")\n .trim();\n}\n\n// ---------------------------------------------------------------- prompts\n// These must not contain the blocked patterns — hence \"styling tags\" and\n// \"scripting tags\" rather than the obvious spellings.\n\nconst MARKUP_SYSTEM = `You write the inner markup for a web page body, styled\nentirely with Tailwind CSS utility classes.\n- Output raw markup only. No prose, no code fences.\n- No head section, no doctype, no styling tags, no scripting tags.\n- Style everything with Tailwind utility classes in the class attribute. Never\n write out a stylesheet, and never use inline style attributes.\n- You cannot style the page element itself, so wrap everything in one root\n element carrying the background, min-height and layout utilities.\n- No inline event-handler attributes. Give each interactive element a clear id\n so behaviour can be attached separately.\n- No images, icons, vector graphics, embedded objects, frames or external\n resource links. For decoration use text and emoji only.\n- Prefer Tailwind's built-in scale, and use responsive and state variants\n (sm: md: hover: focus:) where they earn their place.`;\n\nconst JS_SYSTEM = `You write plain JavaScript.\n- Output raw JavaScript only. No prose, no code fences, no markup tags.\n- The DOM is already parsed when your code runs.\n- Appearance is handled entirely by Tailwind utility classes already present in\n the markup. Never assign to .style and never inject CSS. To change how\n something looks, add or remove Tailwind classes with classList.\n- Write only behaviour: state, events, timers, and text updates.\n- If the page needs no interactivity, output nothing at all.`;\n\n// ---------------------------------------------------------------- events\n\nexport type SectionName = \"markup\" | \"js\";\n\nexport type GenEvent =\n | { type: \"phase\"; section: SectionName; message: string }\n | { type: \"call-start\"; section: SectionName; round: number; continuing: boolean }\n | { type: \"delta\"; section: SectionName; text: string }\n | {\n type: \"call-end\";\n section: SectionName;\n round: number;\n completionTokens: number;\n promptTokens: number;\n ms: number;\n blocks: number;\n tokensPerSecond: number;\n finishReason: string;\n }\n | { type: \"note\"; message: string }\n | { type: \"preview\"; html: string }\n | { type: \"done\"; html: string; truncated: boolean; jsDropped: boolean; stats: GenerateStats }\n | { type: \"error\"; message: string };\n\nexport type Emit = (event: GenEvent) => void;\n\n// ---------------------------------------------------------------- API call\n\ninterface StreamedCall {\n content: string;\n finishReason: string;\n completionTokens: number;\n promptTokens: number;\n /** wall clock around the request — Server-Timing is useless when streaming */\n ms: number;\n /** number of SSE delta events, i.e. diffusion blocks */\n blocks: number;\n}\n\nasync function readError(res: Response): Promise {\n const raw = await res.text().catch(() => \"\");\n let detail = \"\";\n try {\n detail = JSON.parse(raw)?.error?.message ?? \"\";\n } catch { /* WAF pages aren't JSON */ }\n\n switch (res.status) {\n case 401:\n return \"Celeris rejected the API key (401). Check CELERIS_API_KEY.\";\n case 402:\n return \"The Celeris workspace is out of prepaid credit (402).\";\n case 403:\n return \"Blocked by the Celeris edge proxy (403) — a request body reached it \"\n + \"containing a blocked tag or attribute.\";\n case 400:\n case 413:\n return `Celeris rejected the request (${res.status}). ${detail}`.trim();\n case 429:\n return `Rate limited by Celeris. Retry in ${res.headers.get(\"Retry-After\") ?? \"a few\"}s.`;\n default:\n return `Celeris error ${res.status}. ${detail}`.trim();\n }\n}\n\nasync function streamCeleris(\n apiKey: string,\n messages: { role: string; content: string }[],\n continuing: boolean,\n maxTokens: number,\n onDelta: (text: string) => void,\n): Promise {\n const startedAt = performance.now();\n\n const res = await fetch(`${BASE_URL}/chat/completions`, {\n method: \"POST\",\n headers: { \"Authorization\": `Bearer ${apiKey}`, \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n model: MODEL,\n messages,\n max_tokens: maxTokens,\n temperature: 0,\n seed: 7,\n stream: true,\n stream_options: { include_usage: true },\n // vLLM passthrough: resume the trailing assistant message instead of\n // starting a fresh turn. Without this the model restarts from scratch.\n ...(continuing\n ? {\n continue_final_message: true,\n add_generation_prompt: false,\n // Once it finishes it likes to announce a second draft, or narrate\n // corrections to itself in comments. Cut all of that off.\n stop: [\n \"```\",\n \"\\nBelow is\",\n \"\\nHere is\",\n \"\\nHere's\",\n \"\\n// Wait\",\n \"\\n// Note:\",\n \"\\n// Let's\",\n \"\\n// Fixed\",\n \"\\n// Actually\",\n ],\n }\n : {}),\n }),\n signal: AbortSignal.timeout(30_000),\n });\n\n if (!res.ok || !res.body) throw new Error(await readError(res));\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n let content = \"\";\n let blocks = 0;\n let finishReason = \"stop\";\n let completionTokens = 0;\n let promptTokens = 0;\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n\n const lines = buffer.split(\"\\n\");\n buffer = lines.pop() ?? \"\";\n\n for (const line of lines) {\n if (!line.startsWith(\"data:\")) continue;\n const payload = line.slice(5).trim();\n if (!payload || payload === \"[DONE]\") continue;\n\n let json: any;\n try {\n json = JSON.parse(payload);\n } catch {\n continue;\n }\n\n const choice = json.choices?.[0];\n const delta = choice?.delta?.content;\n if (delta) {\n blocks++;\n content += delta;\n onDelta(delta);\n }\n if (choice?.finish_reason) finishReason = choice.finish_reason;\n if (json.usage) {\n completionTokens = json.usage.completion_tokens ?? completionTokens;\n promptTokens = json.usage.prompt_tokens ?? promptTokens;\n }\n }\n }\n\n const ms = performance.now() - startedAt;\n return { content, finishReason, completionTokens, promptTokens, ms, blocks };\n}\n\n// ---------------------------------------------------------------- sections\n\ninterface Section {\n text: string;\n /** false when we stopped early — out of rounds, out of context, or unsafe to continue */\n complete: boolean;\n rounds: number;\n completionTokens: number;\n promptTokens: number;\n ms: number;\n}\n\n/**\n * Generate one section, continuing across as many calls as it takes. Only safe\n * while the accumulated text stays clear of the blocked patterns, since it gets\n * resent verbatim on the next round.\n */\nasync function generateSection(\n apiKey: string,\n section: SectionName,\n system: string,\n user: string,\n emit: Emit,\n maxTokens = MAX_TOKENS,\n): Promise

{\n let text = \"\";\n let rounds = 0;\n let completionTokens = 0;\n let promptTokens = 0;\n let ms = 0;\n let complete = false;\n\n while (rounds < MAX_ROUNDS) {\n const fixed = estimateTokens(system) + estimateTokens(user) + 64;\n if (fixed + estimateTokens(text) + maxTokens > INPUT_BUDGET) {\n emit({ type: \"note\", message: \"Stopped: no context room left for another round.\" });\n break;\n }\n\n const messages = [\n { role: \"system\", content: system },\n { role: \"user\", content: user },\n ];\n const continuing = text.length > 0;\n if (continuing) messages.push({ role: \"assistant\", content: text });\n\n const round = rounds + 1;\n emit({ type: \"call-start\", section, round, continuing });\n\n const call = await streamCeleris(\n apiKey,\n messages,\n continuing,\n maxTokens,\n (delta) => emit({ type: \"delta\", section, text: delta }),\n );\n\n rounds++;\n completionTokens += call.completionTokens;\n promptTokens += call.promptTokens;\n ms += call.ms;\n text += call.content;\n\n emit({\n type: \"call-end\",\n section,\n round,\n completionTokens: call.completionTokens,\n promptTokens: call.promptTokens,\n ms: call.ms,\n blocks: call.blocks,\n tokensPerSecond: call.ms > 0 ? (call.completionTokens / call.ms) * 1000 : 0,\n finishReason: call.finishReason,\n });\n\n if (call.finishReason !== \"length\") {\n complete = true;\n break;\n }\n if (hasBlockedLiteral(text)) {\n emit({\n type: \"note\",\n message: \"Stopped: output now contains a tag the proxy blocks, so it can't be continued.\",\n });\n break;\n }\n }\n\n return { text: stripFence(text), complete, rounds, completionTokens, promptTokens, ms };\n}\n\n// ---------------------------------------------------------------- assembly\n\nconst escapeHtml = (s: string) =>\n s.replace(/[&<>\"]/g, (c) => ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\" }[c]!));\n\nfunction assemble(markup: string, js: string, title: string): string {\n // The only place blocked literals appear — in output we build ourselves,\n // which never travels back to the API.\n const scriptBlock = js.trim()\n ? `\\n`\n : \"\";\n\n return `\n\n\n\n\n${escapeHtml(title)}\n\n\n\n${markup}${scriptBlock}\n\n\n`;\n}\n\n/** The first instruction is a whole spec sentence; trim it to a usable title. */\nfunction toTitle(instruction: string): string {\n const head = (instruction.split(/[:.—]/)[0] ?? instruction).trim();\n return head.length <= 60 ? head : head.slice(0, 57).replace(/\\s+\\S*$/, \"\") + \"…\";\n}\n\n/**\n * On long continuations celeris-1 sometimes emits invalid JavaScript — a stray\n * `function () => {`, a half-rewritten handler — and one syntax error takes down\n * every listener on the page. `new Function` compiles without executing, which\n * catches it before it ships.\n */\nfunction isValidJs(source: string): boolean {\n if (!source.trim()) return true;\n try {\n new Function(source);\n return true;\n } catch {\n return false;\n }\n}\n\n/** Drop trailing comment-only lines, usually the model talking to itself. */\nfunction trimTrailingComments(source: string): string {\n const lines = source.split(\"\\n\");\n while (lines.length && /^\\s*(?:\\/\\/.*)?$/.test(lines[lines.length - 1])) lines.pop();\n return lines.join(\"\\n\");\n}\n\n// ---------------------------------------------------------------- public API\n\nexport function buildSpec(instructions: string[]): string {\n if (instructions.length === 1) return instructions[0];\n const list = instructions.map((s, i) => `${i + 1}. ${s}`).join(\"\\n\");\n return `Build one page satisfying all of these, in order:\\n${list}`;\n}\n\nexport interface GenerateStats {\n calls: number;\n completionTokens: number;\n promptTokens: number;\n /** summed wall clock of the Celeris requests */\n celerisMs: number;\n /** wall clock for the whole pipeline on the server */\n pipelineMs: number;\n tokensPerSecond: number;\n sections: { markup: number; js: number };\n}\n\nexport async function generatePage(instructions: string[], emit: Emit): Promise {\n const apiKey = Deno.env.get(\"CELERIS_API_KEY\");\n if (!apiKey) throw new Error(\"CELERIS_API_KEY is not set on this val.\");\n\n const startedAt = performance.now();\n const spec = buildSpec(instructions);\n const title = toTitle(instructions[0] ?? \"Untitled\");\n\n // 1. Markup, styled inline with Tailwind utilities — no stylesheet phase.\n emit({ type: \"phase\", section: \"markup\", message: \"Generating markup\" });\n const markup = await generateSection(apiKey, \"markup\", MARKUP_SYSTEM, spec, emit);\n\n // Show the page as soon as it exists, before behaviour is wired up.\n emit({ type: \"preview\", html: assemble(markup.text, \"\", title) });\n\n // 2. Behaviour, written against the markup's ids. Strip anything WAF-hostile\n // from the copy we send; the original still goes in the page.\n emit({ type: \"phase\", section: \"js\", message: \"Generating behaviour\" });\n const jsPrompt = `Spec: ${spec}\\n\\nMarkup to wire up:\\n${sanitizeForRequest(markup.text)}`;\n const js = await generateSection(apiKey, \"js\", JS_SYSTEM, jsPrompt, emit, 512);\n\n let jsText = trimTrailingComments(js.text);\n let jsRetry: Section | null = null;\n let jsDropped = false;\n\n if (!isValidJs(jsText)) {\n emit({ type: \"note\", message: \"Generated JS failed a syntax check. Retrying once.\" });\n jsRetry = await generateSection(\n apiKey,\n \"js\",\n `${JS_SYSTEM}\\n- Keep it short. Fewer features, correct syntax.`,\n jsPrompt,\n emit,\n 512,\n );\n const retryText = trimTrailingComments(jsRetry.text);\n if (isValidJs(retryText)) {\n jsText = retryText;\n } else {\n jsText = \"\";\n jsDropped = true;\n emit({ type: \"note\", message: \"JS still invalid. Shipping the page without behaviour.\" });\n }\n }\n\n const completionTokens = markup.completionTokens + js.completionTokens +\n (jsRetry?.completionTokens ?? 0);\n const celerisMs = markup.ms + js.ms + (jsRetry?.ms ?? 0);\n const jsRounds = js.rounds + (jsRetry?.rounds ?? 0);\n\n emit({\n type: \"done\",\n html: assemble(markup.text, jsText, title),\n truncated: !markup.complete,\n jsDropped,\n stats: {\n calls: markup.rounds + jsRounds,\n completionTokens,\n promptTokens: markup.promptTokens + js.promptTokens + (jsRetry?.promptTokens ?? 0),\n celerisMs,\n pipelineMs: performance.now() - startedAt,\n tokensPerSecond: celerisMs > 0 ? (completionTokens / celerisMs) * 1000 : 0,\n sections: { markup: markup.rounds, js: jsRounds },\n },\n });\n}\n",[168],"5b156480-2b0c-45b7-b610-6bf1428a4426","README.md","019f967f-2c90-70b9-bd1c-5b6f7df1d30e",38,["D",1784937462045],2,"# Celeris Coder\n\nChat-driven HTML codegen on the [Celeris](https://celeris.ai) API. Chat on the\nleft, output on the right, with Preview / Code tabs. Remixed from\n[`templates/react-hono-starter`](https://www.val.town/x/templates/react-hono-starter).\n\n`CELERIS_API_KEY` is an env var on this val, read only server-side in\n`celeris.ts`. The browser never sees it.\n\n## Measured API behavior\n\nSeveral of these contradict the docs. All were established by probing.\n\n| | |\n| --- | --- |\n| Context window | **8,192** — `models.md` says 4,096, but 7,018 + 1,024 is accepted (`/v1/models` and `errors.md` agree on 8,192) |\n| `max_tokens` | `256 \\| 512 \\| 768 \\| 1024`. Anything else is rejected |\n| Tool calling | **Works**, though absent from the API reference. `tools` and `tool_choice: \"required\"` both behave like OpenAI's |\n| `continue_final_message` | **Works** — vLLM passthrough, undocumented. Resumes a trailing assistant message instead of restarting |\n| Latency | ~30ms trivial, ~100–400ms per 1k-token section |\n\n### The WAF\n\nAn nginx proxy in front of the API returns **403** (an HTML error page, not the\ndocumented JSON envelope) for request bodies containing common XSS signatures.\nEscaping doesn't help — `<script>` is blocked too. Only *inbound* traffic\nis filtered; generated output is never touched.\n\n**Blocked:** `script` `style` `iframe` `object` `embed` `link` `meta` `svg`\ntags, `);",[],[184,226],"f4c4ee36-ee35-4cfd-97fc-6dea2e10f77d","index.html","019f967f-2c90-70b9-bd1c-4ff447b9289d",8,["D",1784936496218],"\n\n \n \n \n Celeris Coder\n \n \n \n \n

\n \n \n \n\n",[],[184,233],"7671c052-01b6-4f8f-ae96-7ddf7cddd192","favicon.svg","019f967f-2c90-70b9-bd1c-49c497e10f32",["D",1784936344655],"\n",[],[184,241],"62fdf7db-68f0-44f0-af5b-a1d51bc4331f","PreviewPanel.tsx","c76f88ae-87bc-11f1-ae53-1607ee4eb77e","019f967f-2c90-70b9-bd1c-44ae412bc6c1",56,["D",1784938029463],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\n\nexport function PreviewPanel(\n { html, truncated, jsDropped }: {\n html: string;\n truncated: boolean;\n jsDropped: boolean;\n },\n) {\n return (\n

\n Preview\n

\n\n {truncated && (\n

\n A section ran out of continuation rounds, so this page may be incomplete.\n

\n )}\n {jsDropped && (\n

\n The generated JavaScript failed a syntax check twice, so the page\n shipped without behaviour.\n

\n )}\n\n

\n {html\n ? (\n \n )\n : (\n

\n Nothing generated yet.\n

\n )}\n

\n );\n}\n",[],[184,256,248],"components","12e1d6d0-918b-4039-b3a2-70592ab4dc0c","CodePanel.tsx","c23de72c-87bc-11f1-8c3b-1607ee4eb77e",55,["D",1784938020742],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useRef } from \"https://esm.sh/react@18.2.0\";\n\n/**\n * Middle column: the raw output as it arrives.\n *\n * celeris-1 is a diffusion model, so this doesn't type out character by\n * character — it lands in ~256-token blocks, a few per call. The jumpiness is\n * the architecture, not a buffering bug.\n */\nexport function CodePanel(\n { code, phase, streaming }: {\n code: string;\n phase: string | null;\n streaming: boolean;\n },\n) {\n const scrollRef = useRef(null);\n\n useEffect(() => {\n if (streaming) scrollRef.current?.scrollTo({ top: scrollRef.current.scrollHeight });\n }, [code, streaming]);\n\n return (\n

\n \n {phase ?? \"Code\"}\n \n {streaming && (\n \n )}\n

\n {code && !streaming && (\n navigator.clipboard.writeText(code)}\n className=\"text-[11px] px-2 py-1 rounded border border-gray-700 text-gray-400 hover:bg-gray-800 transition-colors cursor-pointer\"\n >\n Copy\n \n )}\n

\n\n \n {code\n ? {code}\n : Output appears here as it streams.}\n \n

\n );\n}\n",[],[184,256,258],"b2dd837f-b234-4bce-b44e-e64faf465fab","ChatPanel.tsx","229a86b0-87b9-11f1-b2d7-1607ee4eb77e",57,["D",1784938055554],5,"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useEffect, useRef, useState } from \"https://esm.sh/react@18.2.0\";\nimport type { FeedItem, Summary } from \"./App.tsx\";\n\nconst EXAMPLES = [\n \"A pricing page with three tiers\",\n \"A pomodoro timer with start/reset\",\n \"A dark landing page for a coffee brand\",\n];\n\nconst ms = (n: number) => n >= 1000 ? `${(n / 1000).toFixed(2)}s` : `${Math.round(n)}ms`;\nconst num = (n: number) => Math.round(n).toLocaleString();\n\n/** Per-call machinery: which round, how many diffusion blocks, how fast. */\nfunction LogLine({ item }: { item: Extract }) {\n return (\n

\n \n {item.tone === \"phase\" ? \"▸\" : \"·\"}\n \n \n {item.text}\n \n {item.detail && {item.detail}}\n

\n );\n}\n\n/** End-of-run totals, including the round trip we measure in the browser. */\nfunction SummaryCard({ summary }: { summary: Summary }) {\n const overhead = Math.max(0, summary.roundTripMs - summary.celerisMs);\n const cells: [string, string][] = [\n [\"round trip\", ms(summary.roundTripMs)],\n [\"model\", ms(summary.celerisMs)],\n [\"overhead\", ms(overhead)],\n [\"first paint\", ms(summary.firstDeltaMs)],\n [\"out / in tok\", `${num(summary.completionTokens)} / ${num(summary.promptTokens)}`],\n [\"calls\", `${summary.calls}`],\n ];\n\n return (\n

\n \n {num(summary.tokensPerSecond)}\n \n tok/s\n

\n {cells.map(([label, value]) => (\n

\n {value}\n {label}\n

\n ))}\n

\n );\n}\n\nexport function ChatPanel({\n feed,\n loading,\n onSend,\n onReset,\n}: {\n feed: FeedItem[];\n loading: boolean;\n onSend: (instruction: string) => void;\n onReset: () => void;\n}) {\n const [draft, setDraft] = useState(\"\");\n const scrollRef = useRef(null);\n\n useEffect(() => {\n scrollRef.current?.scrollTo({ top: scrollRef.current.scrollHeight, behavior: \"smooth\" });\n }, [feed.length, loading]);\n\n function submit() {\n const text = draft.trim();\n if (!text || loading) return;\n onSend(text);\n setDraft(\"\");\n }\n\n return (\n

Celeris Coder

\n HTML codegen on celeris-1\n

\n {feed.length > 0 && (\n \n Reset\n \n )}\n

\n\n

\n {feed.length === 0 && (\n

\n Describe a page. Each follow-up is added to the spec and the page\n is regenerated.\n

\n {EXAMPLES.map((example) => (\n onSend(example)}\n className=\"block w-full text-left px-3 py-2 rounded-lg border border-gray-200 bg-white hover:border-blue-400 hover:text-blue-700 transition-colors cursor-pointer\"\n >\n {example}\n \n ))}\n

\n )}\n\n {feed.map((item, i) => {\n if (item.kind === \"user\") {\n return (\n

\n {item.text}\n

\n );\n }\n if (item.kind === \"log\") return ;\n if (item.kind === \"summary\") return ;\n return (\n \n {item.text}\n

\n );\n })}\n\n {loading && (\n

working…

\n )}\n

\n\n

\n setDraft((e.target as HTMLTextAreaElement).value)}\n onKeyDown={(e) => {\n if (e.key === \"Enter\" && !e.shiftKey) {\n e.preventDefault();\n submit();\n }\n }}\n rows={3}\n placeholder=\"Describe a page… (Enter to send)\"\n className=\"w-full resize-none rounded-lg border border-gray-300 px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-blue-500 focus:border-transparent\"\n />\n \n {loading ? \"Generating…\" : \"Generate\"}\n \n

\n view source\n

\n \n );\n}\n",[],[184,256,266],"8e9093fe-2dc4-49d8-93a0-19cfc1a2e001","App.tsx","019f967f-2c90-70b9-bd1c-3c6a91fd68da",58,["D",1784938075294],"/** @jsxImportSource https://esm.sh/react@18.2.0 */\nimport { useState } from \"https://esm.sh/react@18.2.0\";\nimport { ChatPanel } from \"./ChatPanel.tsx\";\nimport { CodePanel } from \"./CodePanel.tsx\";\nimport { PreviewPanel } from \"./PreviewPanel.tsx\";\n\nexport interface Summary {\n calls: number;\n completionTokens: number;\n promptTokens: number;\n celerisMs: number;\n tokensPerSecond: number;\n /** measured in the browser — the number the user actually feels */\n roundTripMs: number;\n /** browser-measured time until the first block of output appeared */\n firstDeltaMs: number;\n}\n\nexport type FeedItem =\n | { kind: \"user\"; text: string }\n | { kind: \"log\"; text: string; detail?: string; tone?: \"phase\" | \"call\" }\n | { kind: \"summary\"; summary: Summary }\n | { kind: \"error\"; text: string };\n\nconst SECTION_LABEL: Record = {\n markup: \"Generating markup\",\n js: \"Generating behaviour\",\n};\n\nexport function App() {\n const [feed, setFeed] = useState([]);\n // The running spec. We regenerate from this each turn rather than sending the\n // document back for edits — the Celeris edge proxy 403s request bodies\n // containing script/style/svg/etc. See celeris.ts.\n const [instructions, setInstructions] = useState([]);\n const [code, setCode] = useState(\"\");\n const [phase, setPhase] = useState(null);\n const [html, setHtml] = useState(\"\");\n const [truncated, setTruncated] = useState(false);\n const [jsDropped, setJsDropped] = useState(false);\n const [loading, setLoading] = useState(false);\n\n const push = (item: FeedItem) => setFeed((prev) => [...prev, item]);\n\n async function send(instruction: string) {\n if (loading) return;\n const next = [...instructions, instruction];\n\n setLoading(true);\n setInstructions(next);\n setCode(\"\");\n setTruncated(false);\n setJsDropped(false);\n push({ kind: \"user\", text: instruction });\n\n const startedAt = performance.now();\n let firstDeltaMs = 0;\n\n try {\n const res = await fetch(\"/api/generate\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({ instructions: next }),\n });\n\n if (!res.ok || !res.body) {\n const err = await res.json().catch(() => ({}));\n throw new Error(err?.error ?? `Request failed (${res.status})`);\n }\n\n const reader = res.body.getReader();\n const decoder = new TextDecoder();\n let buffer = \"\";\n\n while (true) {\n const { done, value } = await reader.read();\n if (done) break;\n buffer += decoder.decode(value, { stream: true });\n\n // SSE frames are separated by a blank line.\n const frames = buffer.split(\"\\n\\n\");\n buffer = frames.pop() ?? \"\";\n\n for (const frame of frames) {\n const line = frame.split(\"\\n\").find((l) => l.startsWith(\"data:\"));\n if (!line) continue;\n\n const event = JSON.parse(line.slice(5).trim());\n\n switch (event.type) {\n case \"phase\":\n setPhase(SECTION_LABEL[event.section] ?? event.message);\n push({ kind: \"log\", text: event.message, tone: \"phase\" });\n break;\n\n case \"delta\":\n if (!firstDeltaMs) firstDeltaMs = performance.now() - startedAt;\n setCode((prev) => prev + event.text);\n break;\n\n case \"call-end\":\n push({\n kind: \"log\",\n text: `call ${event.round} · ${event.blocks} block${\n event.blocks === 1 ? \"\" : \"s\"\n }`,\n detail: `${event.completionTokens} tok · ${Math.round(event.ms)}ms · ${\n Math.round(event.tokensPerSecond).toLocaleString()\n } tok/s`,\n tone: \"call\",\n });\n break;\n\n case \"note\":\n push({ kind: \"log\", text: event.message });\n break;\n\n case \"preview\":\n setHtml(event.html);\n break;\n\n case \"done\": {\n const roundTripMs = performance.now() - startedAt;\n setHtml(event.html);\n setCode(event.html);\n setPhase(\"Final document\");\n setTruncated(Boolean(event.truncated));\n setJsDropped(Boolean(event.jsDropped));\n push({\n kind: \"summary\",\n summary: { ...event.stats, roundTripMs, firstDeltaMs },\n });\n break;\n }\n\n case \"error\":\n throw new Error(event.message);\n }\n }\n }\n } catch (err) {\n push({ kind: \"error\", text: err instanceof Error ? err.message : String(err) });\n // Keep the spec in sync with what actually rendered.\n setInstructions(instructions);\n } finally {\n setLoading(false);\n }\n }\n\n function reset() {\n setFeed([]);\n setInstructions([]);\n setCode(\"\");\n setPhase(null);\n setHtml(\"\");\n setTruncated(false);\n setJsDropped(false);\n }\n\n return (\n

\n \n \n \n

\n );\n}\n",[],[184,256,275],"165d8dc7-c163-4232-8e49-8111375de75c",["D",1784936344655],[201,202,203,204],[184,256],["D",1784936344655],[200,205,206,207],[184],["D",1784936344655],["D",1789474235934],{"_102":101,"_109":105},{"_102":101,"_103":-5,"_104":105,"_18":54,"_106":107,"_108":26},{"_13":87,"_32":88,"_42":41,"_89":43,"_90":91,"_92":93,"_94":49,"_95":96,"_97":98,"_99":44,"_100":101},"ctx",{"_80":-5,"_131":327,"_328":329,"_330":331,"_332":26,"_333":26,"_334":26,"_335":24,"_336":-5,"_337":-7,"_338":-7,"_339":165,"_340":26,"_341":26,"_342":-5,"_343":26,"_344":26,"_345":26,"_346":-5},"ENV",{"_298":299,"_300":301,"_302":88,"_303":304,"_305":306,"_307":308,"_309":310,"_311":312,"_313":314,"_315":316,"_317":318,"_319":320,"_321":322,"_323":324,"_325":326},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v62