[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","Tribeca_Rep","name","tribeca-site-analytics","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/Tribeca_Rep/tribeca-site-analytics/code/main.tsx","extension","id","13191341-a5da-4ba4-aafb-99d4f728d7f5","fileId","25c3e054-ae27-11f1-936e-1607ee4eb77e","parentId","branchId","0e49238c-239c-4e36-95d6-7f0c7c028ce1","branchVersion",194,"latest",true,"createdAt",["D",1789238052434],"version",148,"fileType","http","content","import { Hono } from \"npm:hono@4\";\nimport type { Context } from \"npm:hono@4\";\nimport {\n activeVisits,\n backfillHistoricalRows,\n botShare,\n checkIngestRate,\n dailyPageviewTimes,\n dailySeriesRaw,\n deviceBreakdown,\n eventBreakdown,\n eventTimes,\n engagementStats,\n eventUserCounts,\n firstTouchChannels,\n getCachedRegion,\n type Geo,\n INGEST_RATE_LIMIT_PER_MINUTE,\n ingestRateSummary,\n KEY_EVENTS,\n landingPages,\n newVsReturning,\n type Pageview,\n recentViews,\n recordEvent,\n regionBreakdown,\n type ReportFilters,\n pagesBreakdown,\n sessionRawHits,\n setCachedRegion,\n siteTotals,\n techBreakdown,\n topCampaigns,\n topLocations,\n topPaths,\n trafficSources,\n} from \"./db.ts\";\nimport {\n classifyTrafficSource,\n easternDayKey,\n formatDayLabel,\n formatEastern,\n parseSqliteUtc,\n parseUA,\n} from \"./util.ts\";\nimport { buildSessions, groupSessionsByChannel, summarize } from \"./sessions.ts\";\nconst app = new Hono();\n\n// 1x1 transparent GIF, served as the tracking beacon.\nconst PIXEL = Uint8Array.from(\n atob(\"R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAUwAOw==\"),\n (c) => c.charCodeAt(0),\n);\n\nconst SITE_LABELS: Record = {\n \"mississippivehicleregistrationrenewal.com\": \"MS Vehicle Registration\",\n \"fileunemploymentflorida.com\": \"FL Unemployment Benefits\",\n \"notarypublicsouthdakota.com\": \"SD Notary Public\",\n \"delawareevtaxcredit.com\": \"DE EV & Solar Incentives\",\n \"homesteadexemptioninflorida.com\": \"FL Homestead Exemption\",\n \"filefloridasalestax.com\": \"FL Sales Tax\",\n \"filenewyorksalestax.com\": \"NY Sales Tax\",\n \"jerseywaterdeliverypros.com\": \"Jersey Water Delivery Pros\",\n \"manhattanwaterdeliverypros.com\": \"Manhattan Water Delivery Pros\",\n \"miamiwaterdeliverypros.com\": \"Miami Water Delivery Pros\",\n};\n\nfunction siteLabel(site: string) {\n return SITE_LABELS[site] || site;\n}\n\n// The US state each site is actually targeting (ipapi.co's `region` field\n// format — full name, e.g. \"Florida\" — since that's what we compare it\n// against). Drives the per-site \"Geo match\" card: is this site's traffic\n// coming from the state it's about, or is it noise (bots, unrelated\n// nationwide SEO trawling, curious out-of-state visitors)? A site missing\n// from this map just doesn't get a Geo match card — every current site has\n// an entry.\n//\n// Accuracy caveat, worth remembering before anyone treats a Geo match\n// percentage as a measurement: region comes from a single ipapi.co lookup\n// per /24, cached 30 days (see lookupGeo). A /24 can straddle a state line,\n// and mobile/carrier IPs often resolve to the carrier's exit point rather\n// than the visitor's actual location — neither is rare. The card is\n// directionally useful (\"is this roughly working\"), not a precise\n// per-visitor measurement, and a percentage built on a small or\n// mostly-unknown sample (check the \"no geo signal\" line above the card)\n// is weaker evidence than the same percentage on a week of traffic.\nconst SITE_EXPECTED_STATE: Record = {\n \"mississippivehicleregistrationrenewal.com\": \"Mississippi\",\n \"fileunemploymentflorida.com\": \"Florida\",\n \"notarypublicsouthdakota.com\": \"South Dakota\",\n \"delawareevtaxcredit.com\": \"Delaware\",\n \"homesteadexemptioninflorida.com\": \"Florida\",\n \"filefloridasalestax.com\": \"Florida\",\n \"filenewyorksalestax.com\": \"New York\",\n \"jerseywaterdeliverypros.com\": \"New Jersey\",\n \"manhattanwaterdeliverypros.com\": \"New York\",\n \"miamiwaterdeliverypros.com\": \"Florida\",\n};\n\n// Cloudflare Pages serves every project at its own .pages.dev\n// subdomain in addition to the custom domain — real hits land there from\n// crawlers/previews, but they're noise the dashboard doesn't need to surface.\nfunction isDevHost(site: string) {\n return site.endsWith(\".pages.dev\");\n}\n\n// Fail CLOSED: every protected route (dashboard/reports/events/backfill)\n// renders visitor-level rows (IP-derived city/lat/lon, visitor id, UA), so a\n// missing/deleted ANALYTICS_DASH_KEY must never mean \"public by accident\".\n// Previously `if (wantKey && key !== wantKey)` let an unset key skip the\n// check entirely and serve to anyone.\nfunction requireKey(c: Context): Response | null {\n const wantKey = Deno.env.get(\"ANALYTICS_DASH_KEY\");\n if (!wantKey) {\n return c.text(\"Service unavailable — no dashboard key is configured.\", 503);\n }\n if (c.req.query(\"key\") !== wantKey) {\n return c.text(\"Forbidden — add ?key=... to the URL.\", 403);\n }\n return null;\n}\n\n// Site allowlist derived from the sites we actually know about, plus each\n// one's Cloudflare Pages preview twin (every Pages project also serves at\n// .pages.dev). The `s` param is otherwise fully attacker-controlled\n// — a browser tracker's key is public by definition, there's no way around\n// that — so this plus the Referer cross-check below is what actually stops\n// someone forging hits for an arbitrary or nonexistent site.\nconst PROD_SITES = new Set(Object.keys(SITE_LABELS));\nconst ALLOWED_SITES = new Set();\nfor (const s of PROD_SITES) {\n ALLOWED_SITES.add(s);\n ALLOWED_SITES.add(s.replace(/\\.com$/, \".pages.dev\"));\n}\n\n// A production domain and its .pages.dev preview are the same logical site.\nfunction siteBase(site: string): string {\n return site.replace(/\\.pages\\.dev$/, \"\").replace(/\\.com$/, \"\");\n}\n\n// Reject an `s` outside the allowlist, always. When a Referer is present,\n// also reject if its host doesn't correspond to the reported site — that\n// cross-check is the part that actually does the work; the allowlist alone\n// only proves \"a real site\", not \"this hit came from it\". No Referer\n// (stripped by a privacy browser/extension, or a strict referrer-policy) is\n// NOT itself grounds for rejection: dropping those would silently lose real\n// visitors, which is worse than recording an unverified-but-allowlisted hit.\n//\n// IMPORTANT: this is not a forgery control, just a noise/laziness filter.\n// Omitting the Referer header entirely (trivial for anything other than a\n// real browser — a bare `curl` has no Referer) passes straight through, by\n// design, for the reason above. The actual control against sustained or\n// deliberate forgery is per-IP rate limiting plus ingest-rate visibility —\n// not built yet (see item 17 in the site's own security review), and it\n// matters more than this check does for anyone who actually wants to\n// forge data at scale.\nfunction isAllowedHit(site: string, referrer: string): boolean {\n if (!ALLOWED_SITES.has(site)) return false;\n if (!referrer) return true;\n try {\n const refHost = new URL(referrer).hostname.replace(/^www\\./, \"\");\n return siteBase(refHost) === siteBase(site);\n } catch {\n return true;\n }\n}\n\nfunction esc(s: string) {\n return s.replace(/[&<>\"']/g, (c) =>\n ({ \"&\": \"&\", \"<\": \"<\", \">\": \">\", '\"': \""\", \"'\": \"'\" }[c] as string)\n );\n}\n\nconst KEY_EVENT_SET = new Set(KEY_EVENTS);\n\n// GA4-style \"value (share%)\" cell. Cheap, and most of why GA4 tables read\n// well compared to a bare count — every number gets a sense of scale\n// against the same total without a second lookup.\nfunction withShare(n: number, total: number): string {\n if (total <= 0) return String(n);\n const pct = ((n / total) * 100).toFixed(2);\n return `${n} `;\n}\n\n// Country code -> flag emoji, via regional indicator symbols. Cosmetic only.\nfunction flag(cc: string | null) {\n if (!cc || cc.length !== 2) return \"\";\n const codePoints = [...cc.toUpperCase()].map((c) => 0x1f1e6 + (c.charCodeAt(0) - 65));\n return String.fromCodePoint(...codePoints);\n}\n\nfunction timeAgo(iso: string) {\n const then = new Date(iso.replace(\" \", \"T\") + \"Z\").getTime();\n const secs = Math.max(0, Math.round((Date.now() - then) / 1000));\n if (secs < 60) return `${secs}s ago`;\n if (secs < 3600) return `${Math.floor(secs / 60)}m ago`;\n return `${Math.floor(secs / 3600)}h ago`;\n}\n\nfunction isPrivateIp(ip: string) {\n return /^(10\\.|127\\.|192\\.168\\.|172\\.(1[6-9]|2\\d|3[01])\\.|::1$|fc|fd|0\\.0\\.0\\.0)/.test(ip);\n}\n\n// Country name from a 2-letter code, via the JS runtime's own locale data —\n// no lookup table to maintain, no external call.\nconst REGION_DISPLAY_NAMES = new Intl.DisplayNames([\"en\"], { type: \"region\" });\nfunction countryName(code: string | null): string | null {\n if (!code) return null;\n try {\n return REGION_DISPLAY_NAMES.of(code) ?? code;\n } catch {\n return code;\n }\n}\n\n// Cache key for the region lookup below: a /24 for IPv4 (drop the last\n// octet), a /64 for IPv6 (first four hextets) — coarse enough that a shared\n// network's visitors share one cache entry, which is what actually keeps\n// the call volume down. Falls back to the address itself if it doesn't\n// parse as either shape (safe — just less cache-effective, not incorrect).\nfunction ipPrefix(ip: string): string {\n const v4 = ip.match(/^(\\d{1,3}\\.\\d{1,3}\\.\\d{1,3})\\.\\d{1,3}$/);\n if (v4) return `v4:${v4[1]}`;\n const hextets = ip.split(\":\");\n if (hextets.length >= 4) return `v6:${hextets.slice(0, 4).join(\":\")}`;\n return `raw:${ip}`;\n}\n\nconst GEO_CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\n// Geo, in two tiers. Country comes from Cloudflare's own `cf-ipcountry`\n// header — free, no call, no visitor IP ever leaves this val for it. State\n// (region) is the one dimension this network actually needs (it's a\n// state-specific site network), and ipapi.co is the only source for it —\n// but it's only called for US traffic (the state question doesn't apply\n// elsewhere) and only on a cache miss, so a shared /24 or /64 pays for the\n// lookup once, not once per visitor. No cf-ipcountry at all (a request that\n// somehow didn't come through the expected edge) means no external call\n// either way — there's nothing to look up region *for* without knowing the\n// country first.\nasync function lookupGeo(ip: string, countryCode: string | null): Promise {\n if (!countryCode) return null;\n const country = countryName(countryCode);\n if (countryCode !== \"US\" || !ip || isPrivateIp(ip)) {\n return { country, countryCode, region: null };\n }\n\n const prefix = ipPrefix(ip);\n try {\n const cached = await getCachedRegion(prefix);\n if (cached && Date.now() - parseSqliteUtc(cached.fetchedAt).getTime() < GEO_CACHE_TTL_MS) {\n return { country, countryCode, region: cached.region };\n }\n } catch (err) {\n console.error(\"geo cache read failed:\", err);\n }\n\n let region: string | null = null;\n try {\n const res = await fetch(`https://ipapi.co/${ip}/json/`, {\n signal: AbortSignal.timeout(2500),\n headers: { \"User-Agent\": \"tribeca-site-analytics/1.0\" },\n });\n if (res.ok) {\n const data = await res.json();\n if (data && !data.error) region = data.region ?? null;\n }\n } catch {\n // best-effort; region stays null, still cached below so a flaky\n // lookup doesn't get retried on every hit from the same /24.\n }\n try {\n await setCachedRegion(prefix, region);\n } catch (err) {\n console.error(\"geo cache write failed:\", err);\n }\n\n return { country, countryCode, region };\n}\n\n// Shared by both ingest routes below (/px.gif's query-string GET and\n// /collect's JSON POST) — the actual \"is this a real, allowed hit, and what\n// do we derive from it\" logic doesn't depend on how the fields arrived, only\n// on what they are. Kept here (not db.ts) since isAllowedHit/lookupGeo,\n// which it calls, are also main.tsx-local.\ninterface HitInput {\n site: string;\n path: string;\n ref: string;\n ua: string;\n ip: string;\n countryCode: string | null;\n utmSource: string | null;\n utmMedium: string | null;\n utmCampaign: string | null;\n utmTerm: string | null;\n utmContent: string | null;\n viewport: string | null;\n visitorId: string | null;\n eventName: string;\n eventLabel: string | null;\n}\n\nasync function ingestHit(h: HitInput): Promise {\n if (!h.site || !isAllowedHit(h.site, h.ref)) return;\n // Item 17: the actual control against a sustained/deliberate flood\n // targeting a real, allowed site — isAllowedHit above only screens out\n // garbage/disallowed sites, for free, before this. Gates the expensive\n // work below it (a geo lookup that can hit ipapi.co, plus the DB write),\n // not the cheap allowlist check above. Silently dropped, no error\n // surfaced to the client either way (/px.gif still returns its GIF,\n // /collect still returns 204) — same \"degrades silently\" posture as the\n // rest of this beacon, and deliberately gives an attacker probing the\n // limit no observable signal to calibrate against.\n const rate = await checkIngestRate(ipPrefix(h.ip));\n if (!rate.allowed) return;\n try {\n const geo = await lookupGeo(h.ip, h.countryCode);\n const { deviceType, browser, os } = parseUA(h.ua);\n const trafficSource = classifyTrafficSource(h.ref, h.utmMedium, h.utmSource);\n await recordEvent({\n site: h.site,\n path: h.path,\n referrer: h.ref,\n ua: h.ua,\n geo,\n utmSource: h.utmSource,\n utmMedium: h.utmMedium,\n utmCampaign: h.utmCampaign,\n utmTerm: h.utmTerm,\n utmContent: h.utmContent,\n deviceType,\n browser,\n os,\n viewport: h.viewport,\n visitorId: h.visitorId,\n trafficSource,\n event: h.eventName,\n eventLabel: h.eventLabel,\n });\n } catch (err) {\n console.error(\"hit ingest failed:\", err);\n }\n}\n\n// The original tracking beacon. A 1x1 GIF via , not fetch() — sidesteps\n// CORS entirely, works even on a strict _headers file, and degrades silently\n// if blocked. Kept indefinitely alongside /collect below (not deprecated):\n// any page whose HTML still carries the older inline snippet keeps working\n// exactly as before, forever — the migration to /t.js + POST /collect is\n// additive, not a cutover, so there's no rollout window where anything\n// breaks.\napp.get(\"/px.gif\", async (c) => {\n const q = (key: string, max = 300) => (c.req.query(key) || \"\").slice(0, max);\n const ua = (c.req.header(\"user-agent\") || \"\").slice(0, 300);\n const ip = c.req.header(\"cf-connecting-ip\") ||\n (c.req.header(\"x-forwarded-for\") || \"\").split(\",\")[0].trim();\n const countryCode = c.req.header(\"cf-ipcountry\") || null;\n\n await ingestHit({\n site: q(\"s\", 200).toLowerCase().replace(/^www\\./, \"\"),\n path: q(\"p\") || \"/\",\n ref: q(\"r\"),\n ua,\n ip,\n countryCode,\n // GA4-style flexible signals. All optional — the beacon still works (as\n // a plain pageview) if a site's snippet is the older, simpler version.\n utmSource: q(\"utm_source\") || null,\n utmMedium: q(\"utm_medium\") || null,\n utmCampaign: q(\"utm_campaign\") || null,\n utmTerm: q(\"utm_term\") || null,\n utmContent: q(\"utm_content\") || null,\n viewport: q(\"vp\", 20) || null,\n visitorId: q(\"vid\", 64) || null,\n // \"ev\" lets a site call window.tribecaTrack('cta_click', 'quote button')\n // for its own custom events, reusing this same pixel — no new endpoint,\n // no schema change needed for whatever a site wants to track next.\n eventName: q(\"ev\", 60) || \"pageview\",\n eventLabel: q(\"el\", 200) || null,\n });\n\n c.header(\"Content-Type\", \"image/gif\");\n c.header(\"Cache-Control\", \"no-store, no-cache, must-revalidate, private\");\n c.header(\"Access-Control-Allow-Origin\", \"*\");\n return c.body(PIXEL);\n});\n\n// New ingest path for the /t.js beacon below: POST, JSON-shaped body sent as\n// text/plain (so a cross-origin sendBeacon/fetch call counts as a CORS\n// \"simple request\" and never needs an OPTIONS preflight route). Same fields,\n// same allowlist/geo/UA pipeline as /px.gif via ingestHit — the only\n// difference is where the fields come from and that nothing is returned to\n// render (sendBeacon never reads the response anyway).\napp.post(\"/collect\", async (c) => {\n let body: Record;\n try {\n body = JSON.parse(await c.req.text());\n } catch {\n return c.json({ ok: false }, 400);\n }\n const str = (v: unknown, max = 300) => typeof v === \"string\" ? v.slice(0, max) : \"\";\n const ua = (c.req.header(\"user-agent\") || \"\").slice(0, 300);\n const ip = c.req.header(\"cf-connecting-ip\") ||\n (c.req.header(\"x-forwarded-for\") || \"\").split(\",\")[0].trim();\n const countryCode = c.req.header(\"cf-ipcountry\") || null;\n\n await ingestHit({\n site: str(body.s, 200).toLowerCase().replace(/^www\\./, \"\"),\n path: str(body.p) || \"/\",\n ref: str(body.r),\n ua,\n ip,\n countryCode,\n utmSource: str(body.utm_source) || null,\n utmMedium: str(body.utm_medium) || null,\n utmCampaign: str(body.utm_campaign) || null,\n utmTerm: str(body.utm_term) || null,\n utmContent: str(body.utm_content) || null,\n viewport: str(body.vp, 20) || null,\n visitorId: str(body.vid, 64) || null,\n eventName: str(body.ev, 60) || \"pageview\",\n eventLabel: str(body.el, 200) || null,\n });\n\n c.header(\"Access-Control-Allow-Origin\", \"*\");\n return c.body(null, 204);\n});\n\n// The tracker as a shared script instead of ~50 copies of the same inline\n// \n`;\n}\n\nexport default app.fetch;\n","deleted",false,"label",[14],"784adc29-f9cf-46ef-b3ad-c77fef19f98f",["D",1789161858464],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Pageview tracker + dashboard for the lead-gen site network","imageUrl","userId","c5acd3b3-60a7-4deb-bc6d-528f83012ea9","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f8fe2-cdfc-775d-a845-a69af13d39cb","tursoName","784adc29f9cf46efb3adc77fef19f98f","tursoHostname","784adc29f9cf46efb3adc77fef19f98f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516253896],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":100},"org",{"_9":10,"_97":98,"_99":100,"_55":56,"_101":102,"_103":42},"branch",{"_35":30,"_11":88,"_22":28,"_89":45,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":12,"_96":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","M A","avatar","https://lh3.googleusercontent.com/a/ACg8ocI9znhXn2hWp1wjjyWzeuOyoO_JrDgJo8aD0umFraR7bAG3UAmc=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":88,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]