[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_106":107,"_108":109},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","oromaskevic23","name","hanter-mail","path","inbox.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":58,"_59":32,"_60":-5,"_61":-5,"_62":36,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/oromaskevic23/hanter-mail/code/inbox.ts","extension","id","029a2556-75d3-4089-809f-566de17fc894","fileId","01a05866-6d09-7403-9f33-29cc672b4054","parentId","branchId","c0019558-380b-49ef-aae2-e7e3a3178a0e","branchVersion",1,"latest",true,"createdAt",["D",1788189502653],"version",0,"fileType","email","content","import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\ntype EmailEvent = {\n from?: unknown;\n to?: unknown;\n subject?: unknown;\n text?: unknown;\n html?: unknown;\n attachments?: unknown;\n headers?: unknown;\n};\n\nconst TRACE_PATTERN = /\\bIC-HANTER-[A-Z0-9][A-Z0-9-]{7,99}\\b/;\nconst INJECTION_PATTERNS = [\n /ignore (?:all |any )?(?:previous|prior|system) instructions/i,\n /(?:this is |treat (?:this|the following) as )(?:a )?system message/i,\n /(?:the )?architect (?:has )?approved/i,\n /reveal (?:the )?(?:system prompt|secrets?|credentials?)/i,\n /(?:execute|run) (?:this |the )?(?:command|code|script)/i,\n /bypass (?:the )?(?:approval|guardian|security|policy)/i,\n /(?:send|transfer) (?:money|funds|crypto|bitcoin)/i,\n];\nconst EXECUTABLE_EXTENSIONS = new Set([\n \".apk\", \".app\", \".bat\", \".cmd\", \".com\", \".dmg\", \".dll\", \".exe\", \".jar\",\n \".js\", \".msi\", \".pkg\", \".ps1\", \".scr\", \".sh\", \".vbs\",\n]);\nconst MACRO_EXTENSIONS = new Set([\n \".docm\", \".dotm\", \".potm\", \".ppam\", \".ppsm\", \".pptm\",\n \".xlam\", \".xlsb\", \".xlsm\", \".xltm\",\n]);\nconst ARCHIVE_EXTENSIONS = new Set([\".7z\", \".bz2\", \".gz\", \".rar\", \".tar\", \".tgz\", \".xz\", \".zip\"]);\nconst MAX_SAFE_TEXT_BYTES = 64 * 1024;\nconst MAX_ATTACHMENT_BYTES = 10 * 1024 * 1024;\nconst MAX_TOTAL_ATTACHMENT_BYTES = 20 * 1024 * 1024;\n\nfunction stringValue(value: unknown, maximum: number): string {\n if (value === undefined || value === null) return \"\";\n if (typeof value !== \"string\") throw new Error(\"MAIL_FIELD_INVALID\");\n if (new TextEncoder().encode(value).byteLength > maximum) throw new Error(\"MAIL_FIELD_TOO_LARGE\");\n return value;\n}\n\nfunction recipients(value: unknown): string[] {\n const list = typeof value === \"string\" ? [value] : value;\n if (!Array.isArray(list) || list.length < 1 || list.length > 100) {\n throw new Error(\"MAIL_RECIPIENT_INVALID\");\n }\n return list.map((entry) => stringValue(entry, 2048));\n}\n\nfunction headers(value: unknown): Record {\n if (!value || typeof value !== \"object\" || Array.isArray(value)) return {};\n const output: Record = {};\n for (const [key, entry] of Object.entries(value)) {\n if (\n typeof entry === \"string\" &&\n /^[A-Za-z0-9-]{1,100}$/.test(key) &&\n new TextEncoder().encode(entry).byteLength <= 8192\n ) {\n output[key.toLowerCase()] = entry;\n }\n }\n return output;\n}\n\nasync function digestBytes(bytes: Uint8Array): Promise {\n const result = await crypto.subtle.digest(\"SHA-256\", bytes);\n return \"sha256:\" + Array.from(\n new Uint8Array(result),\n (entry) => entry.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n}\n\nasync function digest(value: string): Promise {\n return await digestBytes(new TextEncoder().encode(value));\n}\n\nfunction collapseWhitespace(value: string): string {\n return value\n .replace(/\\r\\n?/g, \"\\n\")\n .replace(/[\\t\\f\\v ]+/g, \" \")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim();\n}\n\nfunction safeContent(subject: string, text: string, html: string) {\n const activeHtml = /<(?:script|iframe|object|embed|form|input|button|meta|link|svg|math)\\b|\\bon\\w+\\s*=|javascript\\s*:/i.test(html);\n const sanitizedHtml = html\n .replace(//g, \" \")\n .replace(/<(script|style|iframe|object|embed|svg|math)\\b[\\s\\S]*?<\\/\\1\\s*>/gi, \" \")\n .replace(/<(?:br|\\/p|\\/div|\\/li|\\/tr|\\/h[1-6])\\s*\\/?>/gi, \"\\n\")\n .replace(/<[^>]{0,4096}>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/&/gi, \"&\")\n .replace(/</gi, \"<\")\n .replace(/>/gi, \">\")\n .replace(/"/gi, '\"')\n .replace(/'/gi, \"'\");\n const normalizedText = collapseWhitespace(text);\n const normalizedHtml = collapseWhitespace(sanitizedHtml);\n const combined = normalizedText && normalizedHtml && !normalizedText.includes(normalizedHtml)\n ? normalizedText + \"\\n\\n\" + normalizedHtml\n : normalizedText || normalizedHtml;\n const encoded = new TextEncoder().encode(combined);\n const boundedBytes = encoded.slice(0, MAX_SAFE_TEXT_BYTES);\n const boundedText = new TextDecoder(\"utf-8\", { fatal: false }).decode(boundedBytes).replace(/\\uFFFD$/, \"\");\n return {\n subject: collapseWhitespace(subject.replace(/[\\u0000-\\u001f\\u007f]/g, \" \")),\n text: boundedText,\n activeHtml,\n truncated: encoded.byteLength > MAX_SAFE_TEXT_BYTES,\n };\n}\n\nfunction extensionOf(filename: string): string | null {\n return filename.toLowerCase().match(/(\\.[a-z0-9]{1,12})$/)?.[1] ?? null;\n}\n\nasync function quarantineAttachments(list: unknown[]) {\n const evidence = [];\n const aggregate = new Set();\n let totalBytes = 0;\n for (const item of list) {\n const flags = new Set();\n if (!(item instanceof File)) {\n flags.add(\"ATTACHMENT_METADATA_INVALID\");\n flags.add(\"CONTENT_HASH_UNAVAILABLE\");\n evidence.push({\n filename_hash: await digest(\"unnamed\"),\n extension: null,\n declared_mime: null,\n size_bytes: null,\n content_sha256: null,\n disposition: \"QUARANTINED\",\n archive_recursion_limit: 0,\n automatic_execution: false,\n automatic_upload: false,\n risk_flags: [...flags].sort(),\n });\n for (const flag of flags) aggregate.add(flag);\n continue;\n }\n\n const traversal = /(?:^|[\\\\/])\\.\\.(?:[\\\\/]|$)|[\\\\/]/.test(item.name) || item.name.includes(\"\\0\");\n const basename = item.name.split(/[\\\\/]/).at(-1)?.replace(/[\\u0000-\\u001f\\u007f]/g, \"_\").slice(0, 120) || \"unnamed\";\n const extension = extensionOf(basename);\n const declaredMime = /^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+$/i.test(item.type)\n ? item.type.toLowerCase()\n : null;\n totalBytes += item.size;\n if (traversal) flags.add(\"PATH_TRAVERSAL_NAME\");\n if (declaredMime === null) flags.add(\"INVALID_MIME_TYPE\");\n if (item.size > MAX_ATTACHMENT_BYTES) flags.add(\"ATTACHMENT_OVERSIZE\");\n if (extension && EXECUTABLE_EXTENSIONS.has(extension)) flags.add(\"EXECUTABLE_DENIED\");\n if (extension && MACRO_EXTENSIONS.has(extension)) flags.add(\"MACRO_DOCUMENT_QUARANTINED\");\n if (extension && ARCHIVE_EXTENSIONS.has(extension)) flags.add(\"ARCHIVE_NOT_EXPANDED\");\n\n let contentSha256: string | null = null;\n if (item.size <= MAX_ATTACHMENT_BYTES) {\n contentSha256 = await digestBytes(new Uint8Array(await item.arrayBuffer()));\n } else {\n flags.add(\"CONTENT_HASH_UNAVAILABLE_OVERSIZE\");\n }\n evidence.push({\n filename_hash: await digest(basename),\n extension,\n declared_mime: declaredMime,\n size_bytes: item.size,\n content_sha256: contentSha256,\n disposition: \"QUARANTINED\",\n archive_recursion_limit: 0,\n automatic_execution: false,\n automatic_upload: false,\n risk_flags: [...flags].sort(),\n });\n for (const flag of flags) aggregate.add(flag);\n }\n if (totalBytes > MAX_TOTAL_ATTACHMENT_BYTES) aggregate.add(\"ATTACHMENT_TOTAL_OVERSIZE\");\n return { evidence, riskFlags: [...aggregate].sort(), totalBytes };\n}\n\nfunction mailLoopDetected(normalizedHeaders: Record): boolean {\n const autoSubmitted = normalizedHeaders[\"auto-submitted\"]?.toLowerCase() ?? \"\";\n const precedence = normalizedHeaders.precedence?.toLowerCase() ?? \"\";\n return (autoSubmitted !== \"\" && autoSubmitted !== \"no\") ||\n [\"bulk\", \"junk\", \"list\"].includes(precedence) ||\n normalizedHeaders[\"x-autoreply\"] !== undefined ||\n normalizedHeaders[\"x-autorespond\"] !== undefined;\n}\n\nfunction malformedMimeDetected(normalizedHeaders: Record): boolean {\n const contentType = normalizedHeaders[\"content-type\"];\n if (contentType === undefined) return false;\n if (!/^[a-z0-9!#$&^_.+-]+\\/[a-z0-9!#$&^_.+-]+(?:\\s*;[\\s\\S]*)?$/i.test(contentType)) return true;\n if (\n /^multipart\\//i.test(contentType) &&\n !/;\\s*boundary=(?:\"[^\"]{1,200}\"|[^;\\s]{1,200})(?:;|$)/i.test(contentType)\n ) return true;\n return (contentType.match(/\"/g)?.length ?? 0) % 2 !== 0;\n}\n\nexport default async function handler(event: EmailEvent) {\n if (!event || typeof event !== \"object\" || Array.isArray(event)) {\n throw new Error(\"MAIL_INVALID\");\n }\n\n const from = stringValue(event.from, 2048);\n const to = recipients(event.to);\n const subject = stringValue(event.subject, 998);\n const text = stringValue(event.text, 2 * 1024 * 1024);\n const html = stringValue(event.html, 2 * 1024 * 1024);\n const attachmentList = event.attachments ?? [];\n if (!Array.isArray(attachmentList) || attachmentList.length > 100) {\n throw new Error(\"MAIL_ATTACHMENTS_INVALID\");\n }\n\n const normalizedHeaders = headers(event.headers);\n const receivedAt = new Date().toISOString();\n const retentionUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();\n const normalized = safeContent(subject, text, html);\n const attachments = await quarantineAttachments(attachmentList);\n const traceId = (subject + \"\\n\" + text).match(TRACE_PATTERN)?.[0] ?? null;\n const injectionDetected = INJECTION_PATTERNS.some((pattern) =>\n pattern.test(subject + \"\\n\" + text + \"\\n\" + html)\n );\n const loopDetected = mailLoopDetected(normalizedHeaders);\n const malformedMime = malformedMimeDetected(normalizedHeaders);\n const attachmentCount = attachmentList.length;\n\n const senderHash = await digest(from.trim().toLowerCase());\n const recipientHash = await digest(to.map((entry) => entry.trim().toLowerCase()).sort().join(\"\\n\"));\n const subjectHash = await digest(subject);\n const contentHash = await digest(text + \"\\n\" + html);\n const messageIdentity = normalizedHeaders[\"message-id\"] ??\n JSON.stringify({ senderHash, recipientHash, subjectHash, contentHash, attachmentCount });\n const messageFingerprint = await digest(messageIdentity);\n\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_mail_audit (\n message_fingerprint TEXT PRIMARY KEY,\n event_hash TEXT NOT NULL,\n trace_id TEXT,\n first_received_at TEXT NOT NULL,\n last_received_at TEXT NOT NULL,\n sender_hash TEXT NOT NULL,\n recipient_hash TEXT NOT NULL,\n subject_hash TEXT NOT NULL,\n content_hash TEXT NOT NULL,\n attachment_count INTEGER NOT NULL,\n risk_flags TEXT NOT NULL,\n decision_status TEXT NOT NULL,\n duplicate_count INTEGER NOT NULL DEFAULT 0,\n identity_check TEXT NOT NULL,\n eis_state TEXT NOT NULL,\n guardian_state TEXT NOT NULL,\n approval_state TEXT NOT NULL,\n instruction_executed INTEGER NOT NULL DEFAULT 0,\n outbound_sent INTEGER NOT NULL DEFAULT 0\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS hanter_mail_safe_content_v3 (\n message_fingerprint TEXT PRIMARY KEY,\n safe_subject TEXT NOT NULL,\n safe_text TEXT NOT NULL,\n trust_class TEXT NOT NULL,\n authority_class TEXT NOT NULL,\n html_removed INTEGER NOT NULL,\n truncated INTEGER NOT NULL,\n attachment_evidence TEXT NOT NULL,\n retention_until TEXT NOT NULL,\n raw_stored INTEGER NOT NULL DEFAULT 0,\n html_stored INTEGER NOT NULL DEFAULT 0\n )`);\n await sqlite.execute({\n sql: \"DELETE FROM hanter_mail_safe_content_v3 WHERE retention_until < ?\",\n args: [receivedAt],\n });\n\n const senderWindow = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS count FROM hanter_mail_audit WHERE sender_hash = ? AND first_received_at >= ?\",\n args: [senderHash, new Date(Date.now() - 60 * 60 * 1000).toISOString()],\n });\n const globalWindow = await sqlite.execute({\n sql: \"SELECT COUNT(*) AS count FROM hanter_mail_audit WHERE first_received_at >= ?\",\n args: [new Date(Date.now() - 60 * 60 * 1000).toISOString()],\n });\n const rateLimited =\n Number(senderWindow.rows[0]?.count ?? 0) >= 20 ||\n Number(globalWindow.rows[0]?.count ?? 0) >= 500;\n\n const decisionStatus = rateLimited\n ? \"RATE_LIMITED\"\n : loopDetected\n ? \"QUARANTINED_MAIL_LOOP\"\n : malformedMime\n ? \"QUARANTINED_MALFORMED_MIME\"\n : attachmentCount > 0\n ? \"QUARANTINED_ATTACHMENT\"\n : injectionDetected\n ? \"QUARANTINED_PROMPT_INJECTION\"\n : normalized.activeHtml\n ? \"QUARANTINED_HTML_ACTIVE_CONTENT\"\n : \"ACCEPTED_DRAFT_ONLY\";\n const riskFlags = [\n ...(rateLimited ? [\"RATE_LIMIT_EXCEEDED\"] : []),\n ...(loopDetected ? [\"MAIL_LOOP_PATTERN\"] : []),\n ...(malformedMime ? [\"MALFORMED_MIME\"] : []),\n ...(injectionDetected ? [\"PROMPT_INJECTION_PATTERN\"] : []),\n ...(normalized.activeHtml ? [\"HTML_ACTIVE_CONTENT_REMOVED\"] : []),\n ...(attachmentCount > 0 ? [\"UNTRUSTED_ATTACHMENT\", ...attachments.riskFlags] : []),\n ];\n\n const eventHash = await digest(JSON.stringify({\n messageFingerprint,\n traceId,\n senderHash,\n recipientHash,\n subjectHash,\n contentHash,\n attachmentCount,\n riskFlags,\n decisionStatus,\n receivedAt,\n }));\n\n await sqlite.execute({\n sql: `INSERT INTO hanter_mail_audit (\n message_fingerprint, event_hash, trace_id, first_received_at, last_received_at,\n sender_hash, recipient_hash, subject_hash, content_hash, attachment_count,\n risk_flags, decision_status, duplicate_count, identity_check, eis_state,\n guardian_state, approval_state, instruction_executed, outbound_sent\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, ?, ?, ?, ?, 0, 0)\n ON CONFLICT(message_fingerprint) DO UPDATE SET\n last_received_at = excluded.last_received_at,\n duplicate_count = duplicate_count + 1`,\n args: [\n messageFingerprint,\n eventHash,\n traceId,\n receivedAt,\n receivedAt,\n senderHash,\n recipientHash,\n subjectHash,\n contentHash,\n attachmentCount,\n JSON.stringify(riskFlags),\n decisionStatus,\n \"UNVERIFIED_EXTERNAL_SENDER\",\n \"MAIL_INTAKE_EVALUATED\",\n decisionStatus === \"ACCEPTED_DRAFT_ONLY\" ? \"SAFE_INTAKE_ONLY\" : \"QUARANTINED\",\n \"DRAFT_ONLY\",\n ],\n });\n await sqlite.execute({\n sql: `INSERT INTO hanter_mail_safe_content_v3 (\n message_fingerprint, safe_subject, safe_text, trust_class, authority_class,\n html_removed, truncated, attachment_evidence, retention_until, raw_stored, html_stored\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0)\n ON CONFLICT(message_fingerprint) DO UPDATE SET\n safe_subject = excluded.safe_subject,\n safe_text = excluded.safe_text,\n html_removed = excluded.html_removed,\n truncated = excluded.truncated,\n attachment_evidence = excluded.attachment_evidence,\n retention_until = excluded.retention_until`,\n args: [\n messageFingerprint,\n normalized.subject,\n normalized.text,\n \"UNTRUSTED_EMAIL_DATA\",\n \"NONE\",\n html.length > 0 ? 1 : 0,\n normalized.truncated ? 1 : 0,\n JSON.stringify(attachments.evidence),\n retentionUntil,\n ],\n });\n\n const stored = await sqlite.execute({\n sql: \"SELECT duplicate_count FROM hanter_mail_audit WHERE message_fingerprint = ?\",\n args: [messageFingerprint],\n });\n const duplicateCount = Number(stored.rows[0]?.duplicate_count ?? 0);\n const status = duplicateCount > 0 ? \"DUPLICATE\" : decisionStatus;\n\n const safeAuditEvent = {\n event: \"hanter_mail_gateway\",\n version: 3,\n event_hash: eventHash,\n trace_id: traceId,\n status,\n attachment_count: attachmentCount,\n attachment_hashes_created: attachments.evidence.filter((entry) => entry.content_sha256 !== null).length,\n duplicate_count: duplicateCount,\n safe_content_available: true,\n safe_content_trust: \"UNTRUSTED_EMAIL_DATA\",\n safe_content_authority: \"NONE\",\n raw_message_stored: false,\n raw_html_stored: false,\n retention_until: retentionUntil,\n external_effects: false,\n };\n console.log(JSON.stringify(safeAuditEvent));\n return safeAuditEvent;\n}\n","deleted",false,"label",[14],"4e6d1ed1-a24c-47c3-838e-9458afd1888c",["D",1788189502653],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","HANTER privacy-clean corporate communications runtime","imageUrl","userId","fe39b163-4b50-466e-82d1-8bd01133e4b6","pinnedFileId","01a05866-6d09-7403-9f33-3cb37b799f0a","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a03585-eb44-758d-92a4-77db1a9a243c","tursoName","4e6d1ed1a24c47c3838e9458afd1888c","tursoHostname","4e6d1ed1a24c47c3838e9458afd1888c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789492268774],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_105":101},"org",{"_9":10,"_98":99,"_100":101,"_55":56,"_102":103,"_104":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",15,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Олександр Ромаскевич","avatar","https://lh3.googleusercontent.com/a/ACg8ocIo1MJ3hDjpQrinMIRok3d2YY1vpHgehs8m2u1_vc7pmFovRGI=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_139":140,"_141":142,"_143":144,"_145":42,"_146":42,"_147":42,"_148":32,"_149":-5,"_150":-7,"_151":-7,"_152":36,"_153":42,"_154":42,"_155":-5,"_156":42,"_157":42,"_158":42,"_159":-5},"ENV",{"_110":111,"_112":113,"_114":89,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134,"_135":136,"_137":138},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]