${title}

${subtitle}

${msg}

`;\n}\n\nasync function hashPattern(color:string, pattern:string) {\n const bytes = new TextEncoder().encode(`SAMI.TECH|${color}|${pattern}`);\n const digest = await crypto.subtle.digest('SHA-256', bytes);\n return Array.from(new Uint8Array(digest)).map(b => b.toString(16).padStart(2,'0')).join('');\n}\nfunction validPattern(pattern:string) {\n const parts = pattern.split('-');\n return parts.length >= 4 && parts.length <= 9 && parts.every(x => /^[1-9]$/.test(x)) && new Set(parts).size === parts.length;\n}\n\nconst html = `\nSAMI.TECH\n

☰ PARAMÈTRES

EN LIGNE

✓ ENREGISTRÉ

SCAN QR COLIS

Sélectionnez une couleur, scannez le QR puis entrez le montant du colis.

COLIS

ENVOYER LA LOCALISATION DU BUREAU

Saisissez le numéro puis appuyez sur WhatsApp ou Entrée.

SCAN QR

TRACKING : AUCUN

CADREZ LE QR CODE

Présentez le QR code du colis dans le cadre bleu.

MONTANT DU COLIS

TÉLÉPHONE CLIENT

SCHÉMA

Dessinez votre schéma.

HISTORIQUE DU JOUR

Sélectionnez une couleur.

$\"1984$

\n\n`;\n\napp.get(\"/\", async (c) => {\n c.header('Cache-Control','no-store, no-cache, must-revalidate');\n c.header('Pragma','no-cache');\n const state = await rootAccessState(c.req.header('cookie') || '');\n if (!state.configured) return c.html(accessPage('setup'));\n if (!state.valid) return c.html(accessPage('login'));\n return c.html(html);\n});\napp.get(\"/health\", (c) => c.json({ ok: true }));\n\napp.post(\"/api/access/setup\", async (c) => {\n if (await accessConfigured()) return c.redirect('/',303);\n const body = await c.req.parseBody();\n const code = String(body?.code || '').trim();\n const confirm = String(body?.confirm || '').trim();\n if (!/^[0-9]{4,8}$/.test(code)) return c.html(accessPage('setup','Le code doit contenir de 4 à 8 chiffres.'),400);\n if (code !== confirm) return c.html(accessPage('setup','Les deux codes ne correspondent pas.'),400);\n const salt = randomHex(16);\n const codeHash = await hashText(salt+'|'+code);\n await sqlite.execute({sql:'INSERT INTO app_access (id,salt,code_hash,updated_at) VALUES (1,?,?,?)',args:[salt,codeHash,Date.now()]});\n const token = randomHex(32);\n const tokenHash = await hashText(token);\n const expiresAt = Date.now() + 12*60*60*1000;\n await sqlite.execute({sql:'INSERT INTO access_sessions (token_hash,expires_at) VALUES (?,?)',args:[tokenHash,expiresAt]});\n const res = c.redirect('/',303);\n res.headers.append('Set-Cookie',`sami_session=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=43200`);\n return res;\n});\n\napp.post(\"/api/access/login\", async (c) => {\n if (!(await accessConfigured())) return c.redirect('/',303);\n const now = Date.now();\n const key = clientKey(c);\n const failed = await sqlite.execute({sql:'SELECT attempts,locked_until FROM access_failures WHERE client_key=?',args:[key]});\n let attempts = failed.rows.length ? Number((failed.rows[0] as any).attempts || 0) : 0;\n let lockedUntil = failed.rows.length ? Number((failed.rows[0] as any).locked_until || 0) : 0;\n if (lockedUntil > now) {\n const seconds = Math.max(1,Math.ceil((lockedUntil-now)/1000));\n return c.html(accessPage('login','Trop de tentatives. Réessayez dans '+seconds+' seconde(s).'),429);\n }\n if (lockedUntil > 0 && lockedUntil <= now) attempts = 0;\n const body = await c.req.parseBody();\n const code = String(body?.code || '').trim();\n const cfg = await sqlite.execute('SELECT salt,code_hash FROM app_access WHERE id=1 LIMIT 1');\n const salt = String((cfg.rows[0] as any).salt || '');\n const expected = String((cfg.rows[0] as any).code_hash || '');\n const actual = await hashText(salt+'|'+code);\n if (!/^[0-9]{4,8}$/.test(code) || actual !== expected) {\n attempts += 1;\n const newLock = attempts >= 5 ? now + 5*60*1000 : 0;\n const storedAttempts = attempts >= 5 ? 0 : attempts;\n await sqlite.execute({sql:'INSERT INTO access_failures (client_key,attempts,locked_until,updated_at) VALUES (?,?,?,?) ON CONFLICT(client_key) DO UPDATE SET attempts=excluded.attempts,locked_until=excluded.locked_until,updated_at=excluded.updated_at',args:[key,storedAttempts,newLock,now]});\n return c.html(accessPage('login',attempts >= 5 ? 'Accès bloqué pendant 5 minutes.' : 'Code incorrect.'),401);\n }\n await sqlite.execute({sql:'DELETE FROM access_failures WHERE client_key=?',args:[key]});\n await sqlite.execute({sql:'DELETE FROM access_sessions WHERE expires_at<=?',args:[now]});\n const token = randomHex(32);\n const tokenHash = await hashText(token);\n const expiresAt = now + 12*60*60*1000;\n await sqlite.execute({sql:'INSERT INTO access_sessions (token_hash,expires_at) VALUES (?,?)',args:[tokenHash,expiresAt]});\n const res = c.redirect('/',303);\n res.headers.append('Set-Cookie',`sami_session=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=43200`);\n return res;\n});\n\napp.post(\"/api/access/logout\", async (c) => {\n const token = readCookie(c.req.header('cookie') || '','sami_session');\n if (token) await sqlite.execute({sql:'DELETE FROM access_sessions WHERE token_hash=?',args:[await hashText(token)]});\n const res = c.redirect('/',303);\n res.headers.append('Set-Cookie','sami_session=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0');\n return res;\n});\n\napp.use('/api/*', async (c,next) => {\n const path = new URL(c.req.url).pathname;\n if (path.startsWith('/api/access/')) return next();\n if (!(await validSession(c.req.header('cookie') || ''))) return c.json({success:false,error:'Accès verrouillé'},401);\n await next();\n});\n\napp.get(\"/api/admin/settings-status\", async (c) => {\n const cfg = await sqlite.execute('SELECT 1 FROM settings_access WHERE id=1 LIMIT 1');\n return c.json({configured:cfg.rows.length > 0});\n});\n\napp.post(\"/api/admin/settings-setup\", async (c) => {\n try {\n const existing = await sqlite.execute('SELECT 1 FROM settings_access WHERE id=1 LIMIT 1');\n if (existing.rows.length) return c.json({success:false,error:'Le code PARAMÈTRES est déjà configuré.'},409);\n const body = await c.req.json();\n const appCode = String(body?.appCode || '').trim();\n const settingsCode = String(body?.settingsCode || '').trim();\n if (!/^[0-9]{4,8}$/.test(appCode) || !/^[0-9]{4,8}$/.test(settingsCode)) return c.json({success:false,error:'Les codes doivent contenir de 4 à 8 chiffres.'},400);\n if (appCode === settingsCode) return c.json({success:false,error:'Le code PARAMÈTRES doit être différent du code de l’application.'},400);\n const appCfg = await sqlite.execute('SELECT salt,code_hash FROM app_access WHERE id=1 LIMIT 1');\n if (!appCfg.rows.length) return c.json({success:false,error:'Code d’accès application non configuré.'},409);\n const appActual = await hashText(String((appCfg.rows[0] as any).salt || '')+'|'+appCode);\n if (appActual !== String((appCfg.rows[0] as any).code_hash || '')) return c.json({success:false,error:'Code application incorrect.'},401);\n const salt = randomHex(16);\n const codeHash = await hashText(salt+'|'+settingsCode);\n await sqlite.execute({sql:'INSERT INTO settings_access (id,salt,code_hash,updated_at) VALUES (1,?,?,?)',args:[salt,codeHash,Date.now()]});\n return c.json({success:true});\n } catch (_) {\n return c.json({success:false,error:'Impossible de créer le code PARAMÈTRES.'},500);\n }\n});\n\napp.post(\"/api/admin/settings-unlock\", async (c) => {\n try {\n const cfg = await sqlite.execute('SELECT salt,code_hash FROM settings_access WHERE id=1 LIMIT 1');\n if (!cfg.rows.length) return c.json({success:false,setupRequired:true,error:'Code PARAMÈTRES non configuré.'},409);\n const body = await c.req.json();\n const code = String(body?.code || '').trim();\n if (!/^[0-9]{4,8}$/.test(code)) return c.json({success:false,error:'Code PARAMÈTRES incorrect.'},401);\n const now = Date.now();\n const key = 'settings:'+clientKey(c);\n const failed = await sqlite.execute({sql:'SELECT attempts,locked_until FROM access_failures WHERE client_key=?',args:[key]});\n let attempts = failed.rows.length ? Number((failed.rows[0] as any).attempts || 0) : 0;\n let lockedUntil = failed.rows.length ? Number((failed.rows[0] as any).locked_until || 0) : 0;\n if (lockedUntil > now) {\n const seconds = Math.max(1,Math.ceil((lockedUntil-now)/1000));\n return c.json({success:false,error:'PARAMÈTRES bloqués. Réessayez dans '+seconds+' seconde(s).'},429);\n }\n if (lockedUntil > 0 && lockedUntil <= now) attempts = 0;\n const actual = await hashText(String((cfg.rows[0] as any).salt || '')+'|'+code);\n if (actual !== String((cfg.rows[0] as any).code_hash || '')) {\n attempts += 1;\n const newLock = attempts >= 5 ? now + 5*60*1000 : 0;\n const storedAttempts = attempts >= 5 ? 0 : attempts;\n await sqlite.execute({sql:'INSERT INTO access_failures (client_key,attempts,locked_until,updated_at) VALUES (?,?,?,?) ON CONFLICT(client_key) DO UPDATE SET attempts=excluded.attempts,locked_until=excluded.locked_until,updated_at=excluded.updated_at',args:[key,storedAttempts,newLock,now]});\n return c.json({success:false,error:attempts >= 5 ? 'PARAMÈTRES bloqués pendant 5 minutes.' : 'Code PARAMÈTRES incorrect.'},401);\n }\n await sqlite.execute({sql:'DELETE FROM access_failures WHERE client_key=?',args:[key]});\n return c.json({success:true});\n } catch (_) {\n return c.json({success:false,error:'Impossible de vérifier le code PARAMÈTRES.'},500);\n }\n});\n\napp.post(\"/api/admin/change-access-code\", async (c) => {\n try {\n const body = await c.req.json();\n const currentCode = String(body?.currentCode || '').trim();\n const newCode = String(body?.newCode || '').trim();\n if (!/^[0-9]{4,8}$/.test(currentCode)) return c.json({success:false,error:'Code actuel incorrect.'},401);\n if (!/^[0-9]{4,8}$/.test(newCode)) return c.json({success:false,error:'Le nouveau code doit contenir de 4 à 8 chiffres.'},400);\n if (currentCode === newCode) return c.json({success:false,error:'Le nouveau code doit être différent du code actuel.'},400);\n const cfg = await sqlite.execute('SELECT salt,code_hash FROM app_access WHERE id=1 LIMIT 1');\n if (!cfg.rows.length) return c.json({success:false,error:'Code d’accès non configuré.'},409);\n const salt = String((cfg.rows[0] as any).salt || '');\n const expected = String((cfg.rows[0] as any).code_hash || '');\n const actual = await hashText(salt+'|'+currentCode);\n if (actual !== expected) return c.json({success:false,error:'Code actuel incorrect.'},401);\n const settingsCfg = await sqlite.execute('SELECT salt,code_hash FROM settings_access WHERE id=1 LIMIT 1');\n if (settingsCfg.rows.length) {\n const sameAsSettings = await hashText(String((settingsCfg.rows[0] as any).salt || '')+'|'+newCode);\n if (sameAsSettings === String((settingsCfg.rows[0] as any).code_hash || '')) return c.json({success:false,error:'Le code de l’application doit être différent du code PARAMÈTRES.'},400);\n }\n const newSalt = randomHex(16);\n const newHash = await hashText(newSalt+'|'+newCode);\n const now = Date.now();\n await sqlite.execute({sql:'UPDATE app_access SET salt=?,code_hash=?,updated_at=? WHERE id=1',args:[newSalt,newHash,now]});\n await sqlite.execute('DELETE FROM access_sessions');\n await sqlite.execute('DELETE FROM access_failures');\n const token = randomHex(32);\n const tokenHash = await hashText(token);\n const expiresAt = now + 12*60*60*1000;\n await sqlite.execute({sql:'INSERT INTO access_sessions (token_hash,expires_at) VALUES (?,?)',args:[tokenHash,expiresAt]});\n const res = c.json({success:true});\n res.headers.append('Set-Cookie',`sami_session=${encodeURIComponent(token)}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=43200`);\n return res;\n } catch (_) {\n return c.json({success:false,error:'Impossible de modifier le code d’accès.'},500);\n }\n});\n\napp.get(\"/api/pattern/status\", async (c) => {\n const color = String(c.req.query('color') || '').trim().toUpperCase();\n if (!['ANIS','RACIM','VERT','JAUNE','ROSE'].includes(color)) return c.json({configured:false,error:'Couleur invalide'},400);\n const result = await sqlite.execute({sql:'SELECT 1 FROM color_patterns WHERE color=? LIMIT 1',args:[color]});\n return c.json({configured:result.rows.length > 0});\n});\napp.post(\"/api/pattern/verify\", async (c) => {\n try {\n const body = await c.req.json();\n const color = String(body?.color || '').trim().toUpperCase();\n const pattern = String(body?.pattern || '').trim();\n if (!['ANIS','RACIM','VERT','JAUNE','ROSE'].includes(color) || !validPattern(pattern)) return c.json({success:false},400);\n const result = await sqlite.execute({sql:'SELECT pattern_hash FROM color_patterns WHERE color=?',args:[color]});\n if (!result.rows.length) return c.json({success:false,configured:false},200);\n const expected = String((result.rows[0] as any).pattern_hash || '');\n const actual = await hashPattern(color,pattern);\n return c.json({success:actual === expected,configured:true},200);\n } catch (err) {\n return c.json({success:false,error:err instanceof Error ? err.message : String(err)},500);\n }\n});\napp.post(\"/api/admin/pattern/set\", async (c) => {\n try {\n const body = await c.req.json();\n const color = String(body?.color || '').trim().toUpperCase();\n const pattern = String(body?.pattern || '').trim();\n if (String(body?.confirm || '') !== 'SET') return c.json({success:false,error:'Confirmation invalide'},400);\n if (!['ANIS','RACIM','VERT','JAUNE','ROSE'].includes(color)) return c.json({success:false,error:'Couleur invalide'},400);\n if (!validPattern(pattern)) return c.json({success:false,error:'Schéma invalide'},400);\n const patternHash = await hashPattern(color,pattern);\n await sqlite.execute({sql:'INSERT INTO color_patterns (color,pattern_hash,updated_at) VALUES (?,?,?) ON CONFLICT(color) DO UPDATE SET pattern_hash=excluded.pattern_hash,updated_at=excluded.updated_at',args:[color,patternHash,Date.now()]});\n return c.json({success:true});\n } catch (err) {\n return c.json({success:false,error:err instanceof Error ? err.message : String(err)},500);\n }\n});\napp.post(\"/api/admin/reset-dedup\", async (c) => {\n return c.json({success:true,deleted:0,localOnly:true});\n});\napp.post(\"/api/reserve\", async (c) => {\n try {\n const body = await c.req.json();\n const user = String(body?.user || \"\").trim().toUpperCase();\n let value = String(body?.value || \"\").trim();\n if (body?.manualPhone) {\n let phone = value.replace(/[^0-9]/g,'');\n if (phone.startsWith('00')) phone = phone.slice(2);\n if (/^213[5-7][0-9]{8}$/.test(phone)) phone = '0' + phone.slice(3);\n else if (/^[5-7][0-9]{8}$/.test(phone)) phone = '0' + phone;\n value = phone;\n }\n const scanId = String(body?.id || '').trim();\n if (!['ANIS','RACIM','VERT','JAUNE','ROSE'].includes(user)) return c.json({success:false,error:'Utilisateur invalide'},400);\n if (!value) return c.json({success:false,error:'Numéro vide'},400);\n if (!scanId) return c.json({success:false,error:'scan_id manquant'},400);\n return c.json({success:true,reserved:true,synced:false,localOnly:true},200);\n } catch (err) {\n return c.json({success:false,error:err instanceof Error ? err.message : String(err)},200);\n }\n});\n\napp.post(\"/api/scan\", async (c) => {\n try {\n const body = await c.req.json();\n const user = String(body?.user || \"\").trim().toUpperCase();\n let value = String(body?.value || \"\").trim();\n if (body?.manualPhone) {\n let phone = value.replace(/[^0-9]/g,'');\n if (phone.startsWith('00')) phone = phone.slice(2);\n if (/^213[5-7][0-9]{8}$/.test(phone)) phone = '0' + phone.slice(3);\n else if (/^[5-7][0-9]{8}$/.test(phone)) phone = '0' + phone;\n value = phone;\n }\n const scanId = String(body?.id || '').trim();\n if (!['ANIS','RACIM','VERT','JAUNE','ROSE'].includes(user)) return c.json({success:false,error:'Utilisateur invalide'},400);\n if (!value) return c.json({success:false,error:'Numéro vide'},400);\n if (!scanId) return c.json({success:false,error:'scan_id manquant'},400);\n\n const form = new URLSearchParams();\n form.set('user', user);\n form.set('color', user === 'ANIS' ? 'BLEU' : user === 'RACIM' ? 'ORANGE' : user);\n form.set('tracking', value);\n form.set('phone', String(body?.phone || ''));\n form.set('amount', String(body?.amount || ''));\n form.set('scan_id', scanId);\n form.set('timestamp', String(body?.timestamp || Date.now()));\n form.set('timezone', String(body?.timezone || 'Africa/Algiers'));\n\n const r = await fetch(GOOGLE_SCRIPT_URL, {\n method: 'POST',\n headers: {'Content-Type':'application/x-www-form-urlencoded;charset=UTF-8'},\n body: form.toString(),\n redirect: 'follow'\n });\n const text = await r.text();\n let data:any;\n try { data = JSON.parse(text); } catch { throw new Error('Réponse Google invalide'); }\n if (!data?.success) throw new Error(data?.error || 'Échec Google Sheets');\n return c.json(data);\n } catch (err) {\n return c.json({success:false,error:err instanceof Error ? err.message : String(err),debug:true},200);\n }\n});\n\napp.onError((err) => Promise.reject(err));\nexport default app.fetch;\n","deleted",false,"label","sami",[14],"81fba5d7-d8f6-4db9-81f9-40d55ad5a3ad",["D",1788906685327],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Android scanner for ANIS and RACIM","imageUrl","userId","d1a4e165-322f-4bea-a472-a3bfe065b80a","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a04a3a-ab09-722d-b08e-d53e0c46d95a","tursoName","81fba5d7d8f64db981f940d55ad5a3ad","tursoHostname","81fba5d7d8f64db981f940d55ad5a3ad-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789516910456],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_56":57,"_102":103,"_104":42},"branch",{"_35":30,"_11":89,"_22":28,"_90":46,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","E. Müller","avatar","https://lh3.googleusercontent.com/a/ACg8ocLJnTmCFn0ipeSgvNaIC4rYdYukPA7khbo2Fye1VgNbr6ozzQ=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_82":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":63,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]