[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_203":204,"_205":206},"routes/_app.x.$handle.$name",{"_102":101,"_32":44,"_110":89,"_27":111,"_13":14,"_112":-5,"_11":113,"_114":115,"_116":117,"_118":119,"_120":121,"_20":-5,"_122":123,"_124":125,"_126":25,"_127":128,"_129":58,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_32":44,"_37":45,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",3,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","validation.ts","latestPath","fileId","019f5d16-90e0-701c-aca1-17ea73a456f2","name","fileType","script","content","// Disposable/temporary email domains to block\nconst DISPOSABLE_DOMAINS = new Set([\n \"mailinator.com\",\n \"guerrillamail.com\",\n \"tempmail.com\",\n \"throwaway.email\",\n \"yopmail.com\",\n \"sharklasers.com\",\n \"guerrillamailblock.com\",\n \"grr.la\",\n \"guerrillamail.info\",\n \"guerrillamail.net\",\n \"guerrillamail.org\",\n \"guerrillamail.de\",\n \"10minutemail.com\",\n \"trashmail.com\",\n \"trashmail.me\",\n \"trashmail.net\",\n \"fakeinbox.com\",\n \"mailnesia.com\",\n \"maildrop.cc\",\n \"dispostable.com\",\n \"tempr.email\",\n \"temp-mail.org\",\n \"tempail.com\",\n \"emailondeck.com\",\n \"33mail.com\",\n \"getnada.com\",\n \"mohmal.com\",\n \"burnermail.io\",\n \"mailcatch.com\",\n \"meltmail.com\",\n \"harakirimail.com\",\n \"trbvm.com\",\n \"discard.email\",\n \"discardmail.com\",\n \"discardmail.de\",\n \"spamgourmet.com\",\n \"mytemp.email\",\n \"mailsac.com\",\n \"inboxbear.com\",\n \"crazymailing.com\",\n \"deadfake.com\",\n \"einrot.com\",\n \"fakemailgenerator.com\",\n \"filzmail.com\",\n \"getairmail.com\",\n \"jetable.org\",\n \"kasmail.com\",\n \"mailexpire.com\",\n \"mailforspam.com\",\n \"mailinator2.com\",\n \"mailmoat.com\",\n \"mailnator.com\",\n \"mailshell.com\",\n \"mailzilla.com\",\n \"nomail.xl.cx\",\n \"nowmymail.com\",\n \"pookmail.com\",\n \"spamavert.com\",\n \"spamfree24.org\",\n \"tempomail.fr\",\n \"thankyou2010.com\",\n \"trash-mail.at\",\n \"trashymail.com\",\n \"trashymail.net\",\n \"mailhub.pw\",\n \"mailinbox.co\",\n \"test.com\",\n \"example.com\",\n]);\n\n// Valid interests from the form\nexport const VALID_INTERESTS = [\n \"Consistency\",\n \"Deeper understanding\",\n \"Reconnecting\",\n \"Spiritual habits\",\n \"Quiet\",\n] as const;\n\n// Valid referral sources from the form\nexport const VALID_REFERRALS = [\n \"A friend\",\n \"X / Twitter\",\n \"Instagram\",\n \"YouTube\",\n \"My church\",\n \"Search\",\n \"Somewhere else\",\n] as const;\n\nexport type Interest = typeof VALID_INTERESTS[number];\nexport type Referral = typeof VALID_REFERRALS[number];\n\ninterface ValidationResult {\n valid: boolean;\n error?: string;\n}\n\n/**\n * Check if a string looks like gibberish/keyboard smash.\n * Heuristics:\n * - Too many consonants in a row (5+)\n * - Too many repeated characters (4+)\n * - No vowels at all in the local part\n * - Excessive length of local part with no real structure\n */\nfunction isGibberish(localPart: string): boolean {\n const lower = localPart.toLowerCase().replace(/[^a-z]/g, \"\");\n if (lower.length === 0) return true;\n\n // Check for 5+ consecutive consonants\n if (/[bcdfghjklmnpqrstvwxyz]{5,}/i.test(lower)) return true;\n\n // Check for 4+ repeated characters\n if (/(.)\\1{3,}/.test(lower)) return true;\n\n // No vowels at all in a local part longer than 3 chars\n if (lower.length > 3 && !/[aeiou]/.test(lower)) return true;\n\n // Extremely high ratio of unique bigrams to length (random strings)\n // If the local part is long but every 2-char pair is unique, it's likely random\n if (lower.length > 10) {\n const bigrams = new Set();\n for (let i = 0; i < lower.length - 1; i++) {\n bigrams.add(lower.slice(i, i + 2));\n }\n const ratio = bigrams.size / (lower.length - 1);\n // Very high uniqueness in a long string suggests randomness\n if (ratio > 0.95 && lower.length > 15) return true;\n }\n\n return false;\n}\n\n/**\n * Validate email address with multiple layers of protection\n */\nexport function validateEmail(email: string): ValidationResult {\n if (!email || typeof email !== \"string\") {\n return { valid: false, error: \"Email is required\" };\n }\n\n const trimmed = email.trim().toLowerCase();\n\n // Basic format check\n const emailRegex = /^[a-zA-Z0-9._%+\\-]+@[a-zA-Z0-9.\\-]+\\.[a-zA-Z]{2,}$/;\n if (!emailRegex.test(trimmed)) {\n return { valid: false, error: \"Invalid email format\" };\n }\n\n // Length checks\n if (trimmed.length > 254) {\n return { valid: false, error: \"Email is too long\" };\n }\n\n const [localPart, domain] = trimmed.split(\"@\");\n\n if (localPart.length > 64) {\n return { valid: false, error: \"Email local part is too long\" };\n }\n\n // Block disposable email domains\n if (DISPOSABLE_DOMAINS.has(domain)) {\n return {\n valid: false,\n error: \"Disposable email addresses are not allowed\",\n };\n }\n\n // Block gibberish local parts\n if (isGibberish(localPart)) {\n return { valid: false, error: \"Please use a valid email address\" };\n }\n\n // Block obviously fake TLDs or very short domains\n const domainParts = domain.split(\".\");\n if (domainParts.some((p) => p.length < 1)) {\n return { valid: false, error: \"Invalid email domain\" };\n }\n\n return { valid: true };\n}\n\n/**\n * Validate the full waitlist submission\n */\nexport function validateSubmission(body: unknown): ValidationResult & {\n data?: {\n email: string;\n };\n} {\n if (!body || typeof body !== \"object\") {\n return { valid: false, error: \"Invalid request body\" };\n }\n\n const { email } = body as Record;\n\n // Validate email\n const emailResult = validateEmail(email as string);\n if (!emailResult.valid) {\n return emailResult;\n }\n\n return {\n valid: true,\n data: {\n email: (email as string).trim().toLowerCase(),\n },\n };\n}","createdAt",["D",1783973359483],"branchVersion","branchId","113de6af-f85a-4089-bdde-1d0e4cfb0bcd","id","5f8556ca-fe8d-4586-b971-9d0968404fa9","ascend-waitlist",["D",1783973187726],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Waitlist API for Elorah with email validation","imageUrl","c9ad4c4f-0ce1-4f18-8c66-10ee36a1d6a2","pinnedFileId","019f5d16-90e0-701c-aca1-0f1a2b9c1610","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","380b02c7-e14d-481a-8a10-e7eff18a2a54","tursoName","5f8556cafe8d4586b9719d0968404fa9","tursoHostname","5f8556cafe8d4586b9719d0968404fa9-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789560070146],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_102":101,"_109":105},"org",{"_102":101,"_103":-5,"_104":105,"_18":54,"_106":107,"_108":25},"branch",{"_13":88,"_32":89,"_42":41,"_90":43,"_91":92,"_93":94,"_95":49,"_96":97,"_98":64,"_99":44,"_100":101},"isOwned",13,"main","projectId","forkedBranchId","14771000-57b5-11f1-a5ca-ee650bb23af1","forkedBranchVersion",8,"forkedProjectPrivacy","forkedProjectId","14765f02-57b5-11f1-a5ca-ee650bb23af1","forkedProjectOrgId","projectName","userHandle","benrobo","handle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18yaW5rUWxSZjNBNEltemFVRDhvWG5SWTREdW4ifQ","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_32":44,"_37":198,"_46":-5,"_47":25,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":199,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":200,"_83":201,"_85":202,"_87":25},"tree",[181,182,183,184],"files",[181,182,183,184],"counts",{"_171":62,"_172":155,"_173":62,"_174":175,"_176":177},"contents",[141,142,143,144],"upstreamProject",{"_42":97,"_32":139,"_51":52,"_53":-5,"_48":49,"_81":140},"upstreamBranch",{"_42":92,"_37":134,"_135":136,"_32":89,"_90":97,"_13":88,"_91":-5,"_93":-5,"_137":138,"_46":-5,"_87":25,"_48":49,"_100":101,"_63":64,"_99":139},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1779657066923],"updatedAt",["D",1787135001191],"lockfileKey","1787135001439-esm.town_v_benrobo_elorah-waitlist@13-main","elorah-waitlist",{"_102":101,"_109":105},{"_42":165,"_32":166,"_30":167,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":168,"_13":62,"_33":20,"_35":169,"_24":25,"_150":-5,"_27":170},{"_42":159,"_32":160,"_30":56,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":161,"_13":62,"_33":162,"_35":163,"_24":25,"_150":-5,"_27":164},{"_42":152,"_32":153,"_30":154,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":156,"_13":62,"_33":34,"_35":157,"_24":25,"_150":-5,"_27":158},{"_42":145,"_32":28,"_30":31,"_146":-5,"_40":41,"_39":14,"_147":58,"_37":148,"_13":149,"_33":34,"_35":36,"_24":25,"_150":-5,"_27":151},"efc84eb9-c3b7-4818-81e7-83b1872b6515","parentId","latest",["D",1783973359483],2,"label",[28],"198d28ec-5349-48a6-9f12-fe17f24e7843","db.ts","019f5d16-90e0-701c-aca1-1043cd6d7a85",1,["D",1783973187726],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport async function initDB() {\n await sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS waitlist (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT UNIQUE NOT NULL,\n interests TEXT NOT NULL,\n referral TEXT,\n ip_hash TEXT,\n created_at TEXT DEFAULT (datetime('now'))\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS rate_limits (\n ip_hash TEXT PRIMARY KEY,\n attempts INTEGER DEFAULT 1,\n first_attempt TEXT DEFAULT (datetime('now')),\n last_attempt TEXT DEFAULT (datetime('now'))\n )`,\n },\n ]);\n}\n\n/**\n * Hash an IP address for rate limiting (privacy-preserving)\n */\nasync function hashIP(ip: string): Promise {\n const encoder = new TextEncoder();\n // Use a static salt — not secret, just for differentiation\n const data = encoder.encode(`elorah-waitlist-salt:${ip}`);\n const hashBuffer = await crypto.subtle.digest(\"SHA-256\", data);\n const hashArray = Array.from(new Uint8Array(hashBuffer));\n return hashArray.map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Check rate limit: max 5 submissions per IP per hour\n */\nexport async function checkRateLimit(ip: string): Promise<{ allowed: boolean; error?: string }> {\n const ipHash = await hashIP(ip);\n\n const result = await sqlite.execute({\n sql: `SELECT attempts, first_attempt FROM rate_limits WHERE ip_hash = ?`,\n args: [ipHash],\n });\n\n if (result.rows.length > 0) {\n const row = result.rows[0] as Record;\n const attempts = row.attempts as number;\n const firstAttempt = new Date(row.first_attempt as string);\n const now = new Date();\n const hourAgo = new Date(now.getTime() - 60 * 60 * 1000);\n\n if (firstAttempt > hourAgo && attempts >= 5) {\n return { allowed: false, error: \"Too many submissions. Please try again later.\" };\n }\n\n // Reset if window has passed\n if (firstAttempt <= hourAgo) {\n await sqlite.execute({\n sql: `UPDATE rate_limits SET attempts = 1, first_attempt = datetime('now'), last_attempt = datetime('now') WHERE ip_hash = ?`,\n args: [ipHash],\n });\n } else {\n await sqlite.execute({\n sql: `UPDATE rate_limits SET attempts = attempts + 1, last_attempt = datetime('now') WHERE ip_hash = ?`,\n args: [ipHash],\n });\n }\n } else {\n await sqlite.execute({\n sql: `INSERT INTO rate_limits (ip_hash) VALUES (?)`,\n args: [ipHash],\n });\n }\n\n return { allowed: true };\n}\n\n/**\n * Insert a waitlist entry. Returns success or duplicate error.\n */\nexport async function insertWaitlistEntry(\n email: string,\n interests: string[],\n referral: string | null,\n ip: string,\n): Promise<{ success: boolean; error?: string }> {\n const ipHash = await hashIP(ip);\n\n try {\n await sqlite.execute({\n sql: `INSERT INTO waitlist (email, interests, referral, ip_hash) VALUES (?, ?, ?, ?)`,\n args: [email, JSON.stringify(interests), referral, ipHash],\n });\n return { success: true };\n } catch (e: unknown) {\n const error = e as Error;\n if (error.message?.includes(\"UNIQUE constraint failed\")) {\n return { success: false, error: \"This email is already on the waitlist\" };\n }\n throw e;\n }\n}\n\n/**\n * Get waitlist count\n */\nexport async function getWaitlistCount(): Promise {\n const result = await sqlite.execute(\"SELECT COUNT(*) as count FROM waitlist\");\n return (result.rows[0] as Record).count as number;\n}\n",[153],"ef53ac8e-0449-410d-8d51-20046d4d208c","api.ts",["D",1783973187726],"http","import { Hono } from \"npm:hono@4\";\nimport { initDB, checkRateLimit, insertWaitlistEntry, getWaitlistCount } from \"./db.ts\";\nimport { validateSubmission, VALID_INTERESTS, VALID_REFERRALS } from \"./validation.ts\";\n\nconst app = new Hono();\n\napp.onError((err) => Promise.reject(err));\n\n// Initialize DB on first request\nlet dbInitialized = false;\napp.use(\"*\", async (_c, next) => {\n if (!dbInitialized) {\n await initDB();\n dbInitialized = true;\n }\n await next();\n});\n\n// Health check / API info\napp.get(\"/\", (c) => {\n return c.json({\n name: \"Elorah Waitlist API\",\n endpoints: {\n \"POST /join\": \"Join the waitlist\",\n \"GET /count\": \"Get waitlist count\",\n },\n schema: {\n email: \"string (required)\",\n interests: `string[] (required, at least 1 from: ${VALID_INTERESTS.join(\", \")})`,\n referral: `string | null (optional, one of: ${VALID_REFERRALS.join(\", \")})`,\n },\n });\n});\n\n// Join waitlist\napp.post(\"/join\", async (c) => {\n const ip = c.req.header(\"x-forwarded-for\")\n ?? c.req.header(\"cf-connecting-ip\")\n ?? \"unknown\";\n\n // Rate limit check\n const rateCheck = await checkRateLimit(ip);\n if (!rateCheck.allowed) {\n return c.json({ success: false, error: rateCheck.error }, 429);\n }\n\n // Parse body\n let body: unknown;\n try {\n body = await c.req.json();\n } catch {\n return c.json({ success: false, error: \"Invalid JSON body\" }, 400);\n }\n\n // Validate submission\n const validation = validateSubmission(body);\n if (!validation.valid || !validation.data) {\n return c.json({ success: false, error: validation.error }, 400);\n }\n\n const { email, interests, referral } = validation.data;\n\n // Insert into DB\n const result = await insertWaitlistEntry(email, interests, referral, ip);\n if (!result.success) {\n return c.json({ success: false, error: result.error }, 409);\n }\n\n const count = await getWaitlistCount();\n\n return c.json({\n success: true,\n message: \"You're on the waitlist! We'll email you when your invite is ready.\",\n count,\n }, 201);\n});\n\n// Get waitlist count\napp.get(\"/count\", async (c) => {\n const count = await getWaitlistCount();\n return c.json({ count });\n});\n\n\nexport default app.fetch;\n",[160],"4b2bdab7-02aa-4535-886e-455719f93bc1","README.md","019f5d16-90dd-77a8-8277-597eee3a67b7",["D",1783973187726],"# Elorah Waitlist API\n\nCollects waitlist signups for Elorah with built-in fraud prevention.\n\n## Endpoints\n\n| Method | Path | Description |\n|--------|------|-------------|\n| `GET` | `/` | API info & schema |\n| `POST` | `/join` | Join the waitlist |\n| `GET` | `/count` | Get total waitlist count |\n| `GET` | `/source` | View source code |\n\n## POST /join\n\n```json\n{\n \"email\": \"you@somewhere.com\",\n \"interests\": [\"Consistency\", \"Quiet\"],\n \"referral\": \"Instagram\"\n}\n```\n\n### Fields\n\n- **email** (required) — must be a real email, not disposable or gibberish\n- **interests** (required, array) — at least one of: `Consistency`, `Deeper understanding`, `Reconnecting`, `Spiritual habits`, `Quiet`\n- **referral** (optional) — one of: `A friend`, `X / Twitter`, `Instagram`, `YouTube`, `My church`, `Search`, `Somewhere else`\n\n### Responses\n\n| Status | Meaning |\n|--------|---------|\n| `201` | Successfully joined |\n| `400` | Validation error |\n| `409` | Email already on waitlist |\n| `429` | Rate limited |\n\n## Fraud Prevention\n\n- ✅ Disposable email domain blocking (50+ providers)\n- ✅ Gibberish/keyboard-smash detection\n- ✅ Email format validation (RFC-compliant)\n- ✅ Rate limiting (5 submissions/IP/hour)\n- ✅ Duplicate email prevention\n- ✅ Interest/referral enum validation\n- ✅ Privacy-preserving IP hashing\n\n## Architecture\n\n```mermaid\ngraph LR\n A[Client] -->|POST /join| B[api.ts]\n B --> C[validation.ts]\n C -->|validate email, interests, referral| B\n B --> D[db.ts]\n D -->|rate limit check| E[(SQLite)]\n D -->|insert entry| E\n```\n",[166],"pulls","branches","forks","envVars",{"_178":62,"_180":62},"connections",{"_178":62,"_179":62},"count","unfilledCount","emptyCount",{"_42":165,"_32":166,"_30":167,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":195,"_13":62,"_33":20,"_35":169,"_24":25,"_150":-5,"_186":196,"_27":197},{"_42":159,"_32":160,"_30":56,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":192,"_13":62,"_33":162,"_35":163,"_24":25,"_150":-5,"_186":193,"_27":194},{"_42":152,"_32":153,"_30":154,"_146":-5,"_40":41,"_39":155,"_147":25,"_37":189,"_13":62,"_33":34,"_35":157,"_24":25,"_150":-5,"_186":190,"_27":191},{"_42":145,"_32":28,"_30":31,"_146":-5,"_40":41,"_39":14,"_147":58,"_37":185,"_13":149,"_33":34,"_35":36,"_24":25,"_150":-5,"_186":187,"_27":188},["D",1783973359483],"children",[],[28],["D",1783973187726],[],[153],["D",1783973187726],[],[160],["D",1783973187726],[],[166],["D",1783973187726],["D",1789560070146],{"_102":101,"_109":105},{"_102":101,"_103":-5,"_104":105,"_18":54,"_106":107,"_108":25},{"_13":88,"_32":89,"_42":41,"_90":43,"_91":92,"_93":94,"_95":49,"_96":97,"_98":64,"_99":44,"_100":101},"ctx",{"_81":-5,"_131":236,"_237":238,"_239":240,"_241":25,"_242":25,"_243":25,"_244":58,"_245":-5,"_246":-7,"_247":-7,"_248":62,"_249":25,"_250":25,"_251":-5,"_252":25,"_253":25,"_254":25,"_255":-5},"ENV",{"_207":208,"_209":210,"_211":89,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v3