[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_105":106,"_107":108},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","rgb","name","reel-time","path","main.tsx","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":42,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":12,"_13":44},"permalink","https://www.val.town/x/rgb/reel-time/code/main.tsx","extension","id","1d9276fe-7dd9-462e-9df5-1682c5652e3e","fileId","f9be464e-9b65-11f1-b2db-1607ee4eb77e","parentId","branchId","e31252e7-2c57-483c-be8e-c53f0741ebb7","branchVersion",16,"latest",true,"createdAt",["D",1787102685460],"version",2,"fileType","http","content","/**\n * Reel Time — movie watchlist and ratings for Rob and Robert.\n * Third of the family suite (Tau Zero, Mat Time); same val + blob + passcode shape.\n *\n * Routes:\n * GET / → the app (index.html)\n * GET /icon.png → 1024px icon (manifest, retina home screen)\n * GET /icon-180.png → 180px apple-touch-icon\n * GET /manifest.webmanifest → home-screen manifest\n * GET /state → { user, data } for the passcode in X-Reel-Code\n * POST /state → replace the shared state (JSON body = full state object)\n *\n * Auth: the passcode travels in the X-Reel-Code header (not the query string, so it stays\n * out of access logs). REEL_TIME_CODES holds \"user:code\" pairs, comma-separated — the code\n * identifies WHICH user, so ratings are attributed by the server rather than by a client\n * that could claim to be anyone.\n *\n * Storage: ONE shared blob, not one per passcode (this is the deliberate difference from\n * Tau Zero, where each reader keeps private progress). Rob and Robert curate the same list;\n * only the per-user fields inside each movie differ. Last-write-wins — two users, low\n * collision risk, per spec.\n */\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { readFile } from \"https://esm.town/v/std/utils/index.ts\";\nimport { seedState } from \"./seed.ts\";\nimport { ICON_180_BASE64, ICON_BASE64 } from \"./icon.ts\";\n\nconst STATE_KEY = \"reel_time_state_v1\";\n\n/** Constant-time compare so the allowlist check can't be timed. */\nfunction sameCode(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return diff === 0;\n}\n\n/** REEL_TIME_CODES = \"rob:xxxx,robert:yyyy\" */\nfunction codeTable(): { user: string; code: string }[] {\n return (Deno.env.get(\"REEL_TIME_CODES\") ?? \"\")\n .split(\",\")\n .map((pair) => pair.trim())\n .filter(Boolean)\n .map((pair) => {\n const i = pair.indexOf(\":\");\n if (i < 0) return null;\n return { user: pair.slice(0, i).trim().toLowerCase(), code: pair.slice(i + 1).trim() };\n })\n .filter((e): e is { user: string; code: string } => !!e && !!e.user && !!e.code);\n}\n\nconst manifest = (body: unknown) =>\n new Response(JSON.stringify(body), {\n headers: { \"content-type\": \"application/manifest+json; charset=utf-8\", \"cache-control\": \"public, max-age=3600\" },\n });\n\nconst json = (body: unknown, status = 200) =>\n new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n\nconst iconCache = new Map();\nfunction icon(b64: string): Uint8Array {\n let bytes = iconCache.get(b64);\n if (!bytes) {\n bytes = Uint8Array.from(atob(b64), (ch) => ch.charCodeAt(0));\n iconCache.set(b64, bytes);\n }\n return bytes;\n}\n\n/** Read the shared state, seeding it on first ever run. */\nasync function loadState(): Promise> {\n const saved = await blob.getJSON(STATE_KEY);\n if (saved && typeof saved === \"object\" && Array.isArray((saved as any).movies)) {\n return saved as Record;\n }\n const fresh = seedState();\n await blob.setJSON(STATE_KEY, fresh);\n return fresh as unknown as Record;\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n\n if (path === \"/icon.png\" || path === \"/icon-180.png\") {\n return new Response(icon(path === \"/icon.png\" ? ICON_BASE64 : ICON_180_BASE64), {\n headers: { \"content-type\": \"image/png\", \"cache-control\": \"public, max-age=31536000, immutable\" },\n });\n }\n\n if (path === \"/manifest.webmanifest\") {\n return manifest({\n name: \"Reel Time\",\n short_name: \"Reel Time\",\n description: \"Movie watchlist and ratings — Rob & Robert\",\n start_url: \"/\",\n scope: \"/\",\n display: \"standalone\",\n orientation: \"portrait\",\n background_color: \"#0f1420\",\n theme_color: \"#0f1420\",\n icons: [\n { src: \"/icon-180.png\", sizes: \"180x180\", type: \"image/png\", purpose: \"any\" },\n { src: \"/icon.png\", sizes: \"1024x1024\", type: \"image/png\", purpose: \"any\" },\n { src: \"/icon.png\", sizes: \"1024x1024\", type: \"image/png\", purpose: \"maskable\" },\n ],\n });\n }\n\n if (path === \"/state\") {\n const supplied = req.headers.get(\"x-reel-code\")?.trim() ?? \"\";\n if (!supplied) return json({ error: \"Passcode required.\" }, 401);\n\n const table = codeTable();\n if (table.length === 0) {\n return json({ error: \"Server not configured — REEL_TIME_CODES is unset.\" }, 503);\n }\n const match = table.find((e) => sameCode(e.code, supplied));\n if (!match) return json({ error: \"That passcode isn't recognised.\" }, 401);\n\n if (req.method === \"GET\") {\n return json({ user: match.user, data: await loadState() });\n }\n\n if (req.method === \"POST\") {\n let body: unknown;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"Body must be JSON.\" }, 400);\n }\n // Unwrap {data:…} so a backup blob can be POSTed verbatim.\n const data = body && typeof body === \"object\" && \"data\" in (body as Record)\n ? (body as Record).data\n : body;\n // Never let a malformed or empty payload blank the shared list.\n if (typeof data !== \"object\" || data === null || Array.isArray(data) || !Array.isArray((data as any).movies)) {\n return json({ error: \"Expected a state object with a movies array.\" }, 400);\n }\n if ((data as any).movies.length === 0) {\n return json({ error: \"Refusing to save an empty movie list.\" }, 400);\n }\n await blob.setJSON(STATE_KEY, data);\n return json({ ok: true, user: match.user });\n }\n\n return json({ error: \"Method not allowed.\" }, 405);\n }\n\n if (path === \"/\" || path === \"/index.html\") {\n const html = await readFile(\"/index.html\", import.meta.url);\n return new Response(html, {\n headers: { \"content-type\": \"text/html; charset=utf-8\", \"cache-control\": \"no-store\" },\n });\n }\n\n return new Response(\"Not found\", { status: 404 });\n}\n","deleted",false,"label",[14],"ff1080d8-4ddc-4c35-b1e3-7c6ee977c6f3",["D",1787099770493],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Movie watchlist & ratings for Rob and Robert","imageUrl","userId","4c84f2ef-ab8e-44cc-ba80-40d7c3ca2664","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ff7b1-f7ac-7549-9f99-3e4c291751ab","tursoName","ff1080d84ddc4c35b1e37c6ee977c6f3","tursoHostname","ff1080d84ddc4c35b1e37c6ee977c6f3-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789446061244],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_104":99},"org",{"_9":10,"_98":99,"_100":99,"_55":56,"_101":102,"_103":42},"branch",{"_35":88,"_11":89,"_22":28,"_90":45,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":12,"_97":10},"isOwned",19,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","","avatar","tier","free","canRestrictVals","profileImageUrl","ctx",{"_81":-5,"_138":139,"_140":141,"_142":143,"_144":42,"_145":42,"_146":42,"_147":32,"_148":-5,"_149":-7,"_150":-7,"_151":62,"_152":42,"_153":42,"_154":-5,"_155":42,"_156":42,"_157":42,"_158":-5},"ENV",{"_109":110,"_111":112,"_113":89,"_114":115,"_116":117,"_118":119,"_120":121,"_122":123,"_124":125,"_126":127,"_128":129,"_130":131,"_132":133,"_134":135,"_136":137},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]