[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_159":160,"_161":162},"routes/_app.x.$handle.$name",{"_98":97,"_32":45,"_107":88,"_27":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":25,"_122":123,"_124":125,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","13f2c3d0-69d6-11f1-8854-1607ee4eb77e","name","fileType","http","content","// Whale Hello — an NFC \"tag chain\".\n//\n// Each person taps the same NFC tag (which points at this val's URL). On tap:\n// 1. If someone tapped before them, they write a short message and it opens\n// their Messages app pre-addressed to the PREVIOUS whale, with the body:\n// \"Whale hello there, whale # \"\n// They send it from their own phone — this service never sends SMS.\n// 2. They leave their own number, which is stored for the NEXT whale to text.\n// 3. The very first whale has no one to text, so they just leave a number.\n//\n// Storage is a single JSON blob: the running count + the most recent number.\n// We only ever keep ONE number (the tail of the chain), so old numbers are\n// overwritten and not retained.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst KEY = \"whale_hello_state\";\nconst LOG_TABLE = \"hello_log\";\n// Salt for hashing phone numbers in the hello log. Set a HELLO_SALT env var on\n// the val for real protection: a salt baked into public code is readable, and\n// 10-digit numbers are a small space to brute-force. With a secret env salt the\n// stored hashes are effectively un-reversible.\nconst HELLO_SALT = Deno.env.get(\"HELLO_SALT\") ?? \"whale-hello-public-salt\";\n\ntype State = { count: number; prevNumber: string | null };\n\nasync function getState(): Promise {\n try {\n const s = await blob.getJSON(KEY);\n if (s && typeof s.count === \"number\") return s;\n } catch {\n // No blob yet (first run) or unreadable — start the chain fresh.\n }\n return { count: 0, prevNumber: null };\n}\n\n// Keep digits and a single leading \"+\". Accept E.164-ish 7–15 digit numbers.\nfunction sanitizePhone(raw: string | null): string | null {\n const cleaned = (raw ?? \"\").replace(/[^\\d+]/g, \"\").replace(/(?!^)\\+/g, \"\");\n return /^\\+?\\d{7,15}$/.test(cleaned) ? cleaned : null;\n}\n\nfunction htmlEscape(s: string): string {\n return s.replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n}\n\n// One-way salted hash of a phone number — the hello log never stores raw\n// numbers, only SHA-256 hex.\nasync function hashPhone(num: string): Promise {\n const data = new TextEncoder().encode(HELLO_SALT + \":\" + num);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\n// Record that the current tapper said hello to the previous whale, with a\n// timestamp. Only hashes + chain positions are stored — no raw numbers.\nasync function logHello(\n opts: { from: string; to: string; fromPos: number; toPos: number },\n): Promise {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS ${LOG_TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n said_at TEXT NOT NULL,\n from_hash TEXT NOT NULL,\n to_hash TEXT NOT NULL,\n from_pos INTEGER NOT NULL,\n to_pos INTEGER NOT NULL\n )`,\n );\n const [fromHash, toHash] = await Promise.all([\n hashPhone(opts.from),\n hashPhone(opts.to),\n ]);\n await sqlite.execute({\n sql:\n `INSERT INTO ${LOG_TABLE} (said_at, from_hash, to_hash, from_pos, to_pos) VALUES (?, ?, ?, ?, ?)`,\n args: [\n new Date().toISOString(),\n fromHash,\n toHash,\n opts.fromPos,\n opts.toPos,\n ],\n });\n}\n\nexport default async function (req: Request): Promise {\n // ---- POST: register the current tapper's number, advance the chain ----\n if (req.method === \"POST\") {\n const form = await req.formData();\n const phone = sanitizePhone(String(form.get(\"phone\") ?? \"\"));\n if (!phone) {\n return Response.json({ ok: false, error: \"invalid number\" }, {\n status: 400,\n });\n }\n const state = await getState();\n const next: State = { count: state.count + 1, prevNumber: phone };\n\n // Log the hello (current whale -> previous whale). The first whale greets no one.\n if (state.count > 0 && state.prevNumber) {\n try {\n await logHello({\n from: phone,\n to: state.prevNumber,\n fromPos: next.count,\n toPos: state.count,\n });\n } catch (_) {\n // Best-effort logging — never block a signup on it.\n }\n }\n\n await blob.setJSON(KEY, next);\n return Response.json({ ok: true, position: next.count });\n }\n\n // ---- GET: render the page ----\n const { count, prevNumber } = await getState();\n // The previous whale's chain position is the current count (before we add 1).\n const prevPosition = count;\n const hasPrev = count > 0 && !!prevNumber;\n\n // Pass only what the client needs. The previous number is intentionally\n // exposed to the next tapper — that's how they text them.\n const boot = JSON.stringify({ count, prevNumber, prevPosition, hasPrev })\n .replace(/\n\n\n\n\nWhale Hello 🐋\n\n\n\n

Whale Hello

${count} whale${\n count === 1 ? \"\" : \"s\"\n } in the pod so far

\n\n \n\n

🔒 Only your latest tap is kept — shown to the next whale so they can text you. Hellos are logged anonymously (numbers hashed). See the code.

made by frank

\n\n\n\n`;\n\n return new Response(html, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}","// Whale Hello — an NFC \"tag chain\".\n//\n// Each person taps the same NFC tag (which points at this val's URL). On tap:\n// 1. If someone tapped before them, they write a short message and it opens\n// their Messages app pre-addressed to the PREVIOUS whale, with the body:\n// \"Whale hello there, whale # \"\n// They send it from their own phone — this service never sends SMS.\n// 2. They leave their own number, which is stored for the NEXT whale to text.\n// 3. The very first whale has no one to text, so they just leave a number.\n//\n// Storage is a single JSON blob: the running count + the most recent number.\n// We only ever keep ONE number (the tail of the chain), so old numbers are\n// overwritten and not retained.\n\nimport { blob } from \"https://esm.town/v/std/blob\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite\";\n\nconst KEY = \"whale_hello_state\";\nconst LOG_TABLE = \"hello_log\";\n// Salt for hashing phone numbers in the hello log. Set a HELLO_SALT env var on\n// the val for real protection: a salt baked into public code is readable, and\n// 10-digit numbers are a small space to brute-force. With a secret env salt the\n// stored hashes are effectively un-reversible.\nconst HELLO_SALT = Deno.env.get(\"HELLO_SALT\") ?? \"whale-hello-public-salt\";\n\ntype State = { count: number; prevNumber: string | null };\n\nasync function getState(): Promise {\n try {\n const s = await blob.getJSON(KEY);\n if (s && typeof s.count === \"number\") return s;\n } catch {\n // No blob yet (first run) or unreadable — start the chain fresh.\n }\n return { count: 0, prevNumber: null };\n}\n\n// Keep digits and a single leading \"+\". Accept E.164-ish 7–15 digit numbers.\nfunction sanitizePhone(raw: string | null): string | null {\n const cleaned = (raw ?? \"\").replace(/[^\\d+]/g, \"\").replace(/(?!^)\\+/g, \"\");\n return /^\\+?\\d{7,15}$/.test(cleaned) ? cleaned : null;\n}\n\nfunction htmlEscape(s: string): string {\n return s.replace(\n /[&<>\"']/g,\n (\n c,\n ) => ({\n \"&\": \"&\",\n \"<\": \"<\",\n \">\": \">\",\n '\"': \""\",\n \"'\": \"'\",\n }[c]!),\n );\n}\n\n// One-way salted hash of a phone number — the hello log never stores raw\n// numbers, only SHA-256 hex.\nasync function hashPhone(num: string): Promise {\n const data = new TextEncoder().encode(HELLO_SALT + \":\" + num);\n const digest = await crypto.subtle.digest(\"SHA-256\", data);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\n// Record that the current tapper said hello to the previous whale, with a\n// timestamp. Only hashes + chain positions are stored — no raw numbers.\nasync function logHello(\n opts: { from: string; to: string; fromPos: number; toPos: number },\n): Promise {\n await sqlite.execute(\n `CREATE TABLE IF NOT EXISTS ${LOG_TABLE} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n said_at TEXT NOT NULL,\n from_hash TEXT NOT NULL,\n to_hash TEXT NOT NULL,\n from_pos INTEGER NOT NULL,\n to_pos INTEGER NOT NULL\n )`,\n );\n const [fromHash, toHash] = await Promise.all([\n hashPhone(opts.from),\n hashPhone(opts.to),\n ]);\n await sqlite.execute({\n sql:\n `INSERT INTO ${LOG_TABLE} (said_at, from_hash, to_hash, from_pos, to_pos) VALUES (?, ?, ?, ?, ?)`,\n args: [\n new Date().toISOString(),\n fromHash,\n toHash,\n opts.fromPos,\n opts.toPos,\n ],\n });\n}\n\nexport default async function (req: Request): Promise {\n // ---- POST: register the current tapper's number, advance the chain ----\n if (req.method === \"POST\") {\n const form = await req.formData();\n const phone = sanitizePhone(String(form.get(\"phone\") ?? \"\"));\n if (!phone) {\n return Response.json({ ok: false, error: \"invalid number\" }, {\n status: 400,\n });\n }\n const state = await getState();\n const next: State = { count: state.count + 1, prevNumber: phone };\n\n // Log the hello (current whale -> previous whale). The first whale greets no one.\n if (state.count > 0 && state.prevNumber) {\n try {\n await logHello({\n from: phone,\n to: state.prevNumber,\n fromPos: next.count,\n toPos: state.count,\n });\n } catch (_) {\n // Best-effort logging — never block a signup on it.\n }\n }\n\n await blob.setJSON(KEY, next);\n return Response.json({ ok: true, position: next.count });\n }\n\n // ---- GET: render the page ----\n const { count, prevNumber } = await getState();\n // The previous whale's chain position is the current count (before we add 1).\n const prevPosition = count;\n const hasPrev = count > 0 && !!prevNumber;\n\n // Pass only what the client needs. The previous number is intentionally\n // exposed to the next tapper — that's how they text them.\n const boot = JSON.stringify({ count, prevNumber, prevPosition, hasPrev })\n .replace(/\n\n\n\n\nWhale Hello 🐋\n\n\n\n

Whale Hello

${count} whale${\n count === 1 ? \"\" : \"s\"\n } in the pod so far

\n\n \n\n

🔒 Only the latest number is kept — so the next whale can text you. Logs are hashed for your privacy. See the code.

made by frank

\n\n\n\n`;\n\n return new Response(html, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}","createdAt",["D",1781752979691],"branchVersion","branchId","65c0ff90-8677-4501-a689-4eb1f688a08b","id","5d39e7e9-dfaf-477a-8339-da3b690e1cfa","whale-hello",["D",1781650360357],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","say hello to the next whale","imageUrl","6188d771-1ee3-4a10-b06d-53b208822364","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019ed29d-e37a-727e-a0ca-414f72ea196b","tursoName","5d39e7e9dfaf477a8339da3b690e1cfa","tursoHostname","5d39e7e9dfaf477a8339da3b690e1cfa-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789506649022],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},"branch",{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","bathroom","handle","displayName","C X","avatar","https://lh3.googleusercontent.com/a/ACg8ocJ5lO8kLp0BCmFCDeqXyDDsEXzqS13Q5jtTUb2nfFU2XdLaQ4E=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":154,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":155,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":156,"_82":157,"_84":158,"_86":25},"tree",[149],"files",[149],"counts",{"_138":61,"_139":140,"_141":61,"_142":143,"_144":145},"contents",[130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":134,"_13":135,"_33":34,"_35":37,"_24":25,"_136":45,"_27":137},"fccaf3a4-e95c-4762-ba12-bb77b7b737d2","parentId","latest",["D",1781752979691],7,"label",[28],"pulls","branches",1,"forks","envVars",{"_146":140,"_148":61},"connections",{"_146":61,"_147":61},"count","unfilledCount","emptyCount",{"_43":131,"_32":28,"_30":31,"_132":-5,"_41":42,"_40":14,"_133":25,"_38":150,"_13":135,"_33":34,"_35":37,"_24":25,"_136":45,"_151":152,"_27":153},["D",1781752979691],"children",[],[28],["D",1781650360357],["D",1789506649022],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":55,"_103":104,"_105":25},{"_13":87,"_32":88,"_43":42,"_89":44,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":45,"_96":97},"ctx",{"_80":-5,"_127":192,"_193":194,"_195":196,"_197":25,"_198":25,"_199":25,"_200":125,"_201":-5,"_202":-7,"_203":-7,"_204":61,"_205":25,"_206":25,"_207":-5,"_208":25,"_209":25,"_210":25,"_211":-5},"ENV",{"_163":164,"_165":166,"_167":88,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189,"_190":191},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8