Ayala

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_102":103,"_104":105},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","ayala","name","tracker","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/ayala/tracker/code/main.tsx","extension","id","6eb9a052-15ec-4b68-ba12-e8795b9296fe","fileId","2d0860e0-a816-11f1-a428-1607ee4eb77e","parentId","branchId","4727d397-7473-4f5a-89f0-4f8c4a62dfae","branchVersion",38,"latest",true,"createdAt",["D",1788664231224],"version",5,"fileType","http","content","/**\n * Ayala — tracker host.\n *\n * Val Town's free tier has no private vals, so the URL is public. Nothing\n * behind it is: every request, the app shell included, requires the passphrase\n * held in an environment variable. An unauthenticated visitor gets a lock\n * screen and nothing else — no HTML, no scripts, no data.\n *\n * Unlocking sets an HttpOnly cookie carrying an HMAC of the passphrase, never\n * the passphrase itself, so page scripts can neither read it nor leak it.\n */\nimport { blob } from \"https://esm.town/v/std/blob\";\n\nconst RECORD = \"ayala/record/v1\";\nconst SKILLS = \"ayala/skills.json\"; // past the 80,000-char val file cap\nconst PASS_VAR = \"AYALA_PASSPHRASE\";\nconst COOKIE = \"ayala_auth\";\nconst YEAR = 60 * 60 * 24 * 365;\n\nconst WINDOW_MS = 15 * 60_000;\nconst MAX_TRIES = 8; // wrong passphrases per IP per window\n\nconst TYPES: Record = {\n html: \"text/html; charset=utf-8\",\n css: \"text/css; charset=utf-8\",\n js: \"text/javascript; charset=utf-8\",\n json: \"application/json; charset=utf-8\",\n webmanifest: \"application/manifest+json; charset=utf-8\",\n svg: \"image/svg+xml\",\n png: \"image/png\",\n};\n\nconst ASSETS = new Set([\n \"index.html\", \"manifest.webmanifest\", \"sw.js\",\n \"assets/app.css\", \"assets/skills.json\", \"assets/icon.svg\",\n \"assets/icon-180.png\", \"assets/icon-192.png\",\n \"assets/icon-512.png\", \"assets/icon-maskable-512.png\",\n \"assets/js/app.js\", \"assets/js/data.js\", \"assets/js/i18n.js\",\n \"assets/js/picker.js\", \"assets/js/spring.js\", \"assets/js/store.js\",\n \"assets/js/sync.js\", \"assets/js/ui.js\",\n \"assets/js/screens/onboarding.js\", \"assets/js/screens/week.js\",\n \"assets/js/screens/progress.js\", \"assets/js/screens/map.js\",\n \"assets/js/screens/library.js\", \"assets/js/screens/settings.js\",\n]);\n\nconst BINARY = new Set([\n \"assets/icon-180.png\", \"assets/icon-192.png\",\n \"assets/icon-512.png\", \"assets/icon-maskable-512.png\",\n]);\n\n/* ------------------------------------------------------------------ auth */\n\nconst enc = (s: string) => new TextEncoder().encode(s);\n\n/** Cookie value: HMAC(passphrase, fixed label). Rotating the passphrase\n * invalidates every existing session for free. */\nasync function sessionToken(pass: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\", enc(pass), { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const sig = await crypto.subtle.sign(\"HMAC\", key, enc(\"ayala-session-v1\"));\n return btoa(String.fromCharCode(...new Uint8Array(sig)))\n .replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/** Constant-time compare, so response timing cannot leak the secret. */\nfunction same(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\nfunction cookie(req: Request, name: string): string {\n for (const part of (req.headers.get(\"cookie\") ?? \"\").split(\";\")) {\n const [k, ...v] = part.trim().split(\"=\");\n if (k === name) return v.join(\"=\");\n }\n return \"\";\n}\n\nasync function authed(req: Request): Promise {\n const pass = Deno.env.get(PASS_VAR);\n if (!pass) return false;\n const got = cookie(req, COOKIE);\n return Boolean(got) && same(got, await sessionToken(pass));\n}\n\n/* --------------------------------------------------------- rate limiting */\n\n// Kept in blob, not memory: Val Town recycles isolates constantly, so an\n// in-process counter resets to zero and rate limits nothing at all.\nconst clientIp = (req: Request) =>\n req.headers.get(\"cf-connecting-ip\") ?? req.headers.get(\"x-forwarded-for\")?.split(\",\")[0]?.trim() ?? \"unknown\";\n\nconst rlKey = (ip: string) => `ayala/rl/${ip.replace(/[^a-zA-Z0-9.:_-]/g, \"_\")}`;\n\nasync function tooManyTries(ip: string): Promise {\n const rec = await blob.getJSON(rlKey(ip)).catch(() => null) as { n: number; until: number } | null;\n return Boolean(rec && Date.now() < rec.until && rec.n >= MAX_TRIES);\n}\n\nasync function noteFailure(ip: string): Promise {\n const now = Date.now();\n const rec = await blob.getJSON(rlKey(ip)).catch(() => null) as { n: number; until: number } | null;\n const next = !rec || now > rec.until ? { n: 1, until: now + WINDOW_MS } : { n: rec.n + 1, until: rec.until };\n await blob.setJSON(rlKey(ip), next).catch(() => {});\n}\n\nconst clearFailures = (ip: string) => blob.delete(rlKey(ip)).catch(() => {});\n\n/* ---------------------------------------------------------------- assets */\n\nconst cache = new Map();\n\nasync function asset(path: string): Promise {\n const hit = cache.get(path);\n if (hit) return hit.clone();\n\n if (path === \"assets/skills.json\") {\n const j = await blob.getJSON(SKILLS).catch(() => null);\n if (!j) return new Response(\"skills.json not uploaded\", { status: 503 });\n const out = new Response(JSON.stringify(j), {\n headers: { \"content-type\": TYPES.json, \"cache-control\": \"no-cache\" },\n });\n cache.set(path, out.clone());\n return out;\n }\n\n const ext = path.split(\".\").pop() ?? \"\";\n const res = await fetch(new URL(`./${BINARY.has(path) ? path + \".b64\" : path}`, import.meta.url));\n if (!res.ok) return new Response(\"Not found\", { status: 404 });\n const body = BINARY.has(path)\n ? Uint8Array.from(atob((await res.text()).trim()), (c) => c.charCodeAt(0))\n : await res.text();\n\n const out = new Response(body, {\n headers: { \"content-type\": TYPES[ext] ?? \"application/octet-stream\", \"cache-control\": \"no-cache\" },\n });\n cache.set(path, out.clone());\n return out;\n}\n\n/* ------------------------------------------------------------ lock screen */\n\nfunction lockScreen(msg = \"\"): Response {\n const html = `\n\n\n\nAyala\n`;\n // 401 keeps the service worker from ever caching this as the app shell.\n return new Response(html, {\n status: 401,\n headers: { \"content-type\": TYPES.html, \"cache-control\": \"no-store\" },\n });\n}\n\n/* ----------------------------------------------------------------- routes */\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = decodeURIComponent(url.pathname).replace(/^\\/+/, \"\");\n const pass = Deno.env.get(PASS_VAR);\n\n if (!pass) {\n return new Response(\n `Set ${PASS_VAR} in this val's environment variables.`,\n { status: 503, headers: { \"content-type\": \"text/plain; charset=utf-8\" } },\n );\n }\n\n if (path === \"api/unlock\") return unlock(req, pass);\n if (path === \"api/lock\") {\n return new Response(null, {\n status: 303,\n headers: { location: \"/\", \"set-cookie\": `${COOKIE}=; Path=/; Max-Age=0; HttpOnly; Secure; SameSite=Lax` },\n });\n }\n\n if (!(await authed(req))) {\n // Anything that is not a page navigation gets a bare 401, so scripts and\n // data never leak a byte to an unauthenticated caller.\n if (path.startsWith(\"api/\")) return Response.json({ error: \"locked\" }, { status: 401 });\n if (ASSETS.has(path) && path !== \"index.html\") return new Response(\"Locked\", { status: 401 });\n return lockScreen();\n }\n\n if (path === \"api/state\") return state(req);\n if (path === \"\" || !ASSETS.has(path)) return asset(\"index.html\");\n return asset(path);\n}\n\nasync function unlock(req: Request, pass: string): Promise {\n if (req.method !== \"POST\") return new Response(\"Method not allowed\", { status: 405 });\n\n const ip = clientIp(req);\n if (await tooManyTries(ip)) {\n return lockScreen(\"Слишком много попыток. Подождите 15 минут. · Too many attempts, wait 15 minutes.\");\n }\n\n const form = await req.formData().catch(() => null);\n const given = String(form?.get(\"passphrase\") ?? \"\");\n\n if (!given || !same(given, pass)) {\n await noteFailure(ip);\n return lockScreen(\"Пароль не подошёл. · That passphrase was not accepted.\");\n }\n\n await clearFailures(ip);\n return new Response(null, {\n status: 303,\n headers: {\n location: \"/\",\n \"set-cookie\": `${COOKIE}=${await sessionToken(pass)}; Path=/; Max-Age=${YEAR}; HttpOnly; Secure; SameSite=Lax`,\n },\n });\n}\n\nasync function state(req: Request): Promise {\n if (req.method === \"GET\") {\n const record = await blob.getJSON(RECORD).catch(() => null);\n return Response.json({ record: record ?? null });\n }\n if (req.method === \"PUT\") {\n const body = await req.json().catch(() => null);\n if (!body || typeof body !== \"object\" || !body.record) {\n return Response.json({ error: \"bad_body\" }, { status: 400 });\n }\n // Clients that merge with tombstones always send `gone`. A record without\n // it came from code that merges by plain union, and writing it would\n // resurrect every mark the newer clients have removed.\n if (typeof body.record.gone !== \"object\" || body.record.gone === null) {\n return Response.json({ error: \"stale_client\", detail: \"reload the app\" }, { status: 409 });\n }\n await blob.setJSON(RECORD, { ...body.record, syncedAt: new Date().toISOString() });\n return Response.json({ ok: true });\n }\n return Response.json({ error: \"method_not_allowed\" }, { status: 405 });\n}\n","deleted",false,"label",[14],"693af66c-1a12-4358-b9a7-aa44eee8b254",["D",1788494851578],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Ayala — developmental tracker (data is passphrase-gated)","imageUrl","userId","4769dfb5-ba19-4eb9-8bd9-4e10d91fa4f5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a06a67-e57e-76cd-b711-2548a094569d","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_101":96},"org",{"_9":10,"_95":96,"_97":96,"_55":56,"_98":99,"_100":42},"branch",{"_35":85,"_11":86,"_22":28,"_87":45,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":12,"_94":10},"isOwned",42,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_78":-5,"_135":136,"_137":138,"_139":140,"_141":42,"_142":42,"_143":42,"_144":32,"_145":-5,"_146":-7,"_147":-7,"_148":62,"_149":42,"_150":42,"_151":-5,"_152":42,"_153":42,"_154":42,"_155":-5},"ENV",{"_106":107,"_108":109,"_110":86,"_111":112,"_113":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]