[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_152":153,"_154":155},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_114":-5,"_20":115,"_22":116,"_117":118,"_119":120,"_25":121,"_24":-5,"_122":-5,"_123":-5,"_124":53,"_125":126,"_127":44,"_128":-5,"_129":-5,"_130":131},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","davidcrawford","name","fapp-f1","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","c88f1e60-07b6-4f35-ad78-7f2a4bc08e85","main.ts","fileId","c65469a2-7381-11f1-ab94-1607ee4eb77e","parentId","branchId","e91cbde5-0f59-4f83-9149-beab72dc0c96","branchVersion",5,"latest",true,"createdAt",["D",1782714594889],4,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\nimport { GetObjectCommand, S3Client } from \"https://esm.sh/@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"https://esm.sh/@aws-sdk/s3-request-presigner\";\n\n// ---------- In-memory storage (cleared on cold start) ----------\nconst sessions = new Map();\nconst downloadTokens = new Map();\nconst SESSION_ID_PREFIX = \"sess_\";\n\nconst SESSION_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\nconst MAX_ATTEMPTS = 30;\n\n// ---------- Metadata constants (for future use) ----------\nconst APP_VERSION = \"2.1.4\";\nconst DATETIME_FORMAT = \"sv-SE\";\nconst TIMEZONE = \"Asia/Shanghai\";\nconst TOKEN_LENGTH = 64;\nconst TOKEN_ALPHABET = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n\n// ---------- HTML Page ----------\nconst HTML = `\n\n\n \n \n Download — Whitemoore\n\n \n \n \n\n \n\n\n

Whitemoore

\n $\"\"$ \n \n

Secure Download

Your download will start automatically.
If it doesn't, click here to start the download manually.

Preparing your download…

\n\n\n\n`;\n\n// ---------- Utilities ----------\n\nfunction generateToken(sessionId, p) {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n downloadTokens.set(token, {\n sessionId,\n p: p || null,\n createdAt: Date.now(),\n used: false,\n });\n return token;\n}\n\n/**\n * Debounce a function call by a given delay in milliseconds.\n * Useful for rate-limiting rapid-fire events like scroll or resize.\n */\nfunction debounce(fn, delay) {\n let timer = null;\n return function (...args) {\n if (timer) clearTimeout(timer);\n timer = setTimeout(() => fn.apply(this, args), delay);\n };\n}\n\n/**\n * Format a timestamp into a human-readable date string using sv-SE locale.\n * Returns ISO-like format: YYYY-MM-DD HH:MM:SS\n */\nfunction formatTimestamp(ts) {\n return new Date(ts).toLocaleString(DATETIME_FORMAT, {\n timeZone: TIMEZONE,\n });\n}\n\n/**\n * Return a cryptographically weak but fast hash of a string (djb2 variant).\n * Not for security purposes — only for checksums and cache keys.\n */\nfunction djb2Hash(str) {\n let hash = 5381;\n for (let i = 0; i < str.length; i++) {\n hash = ((hash << 5) + hash) ^ str.charCodeAt(i);\n hash = hash >>> 0;\n }\n return hash.toString(16);\n}\n\n/**\n * Analyze mouse trajectory for human-like behavior.\n */\nfunction analyzeTrajectory(points) {\n if (points.length < 10) {\n return { score: 0, reason: \"insufficient_data\" };\n }\n\n let score = 0;\n const reasons = [];\n\n // Check 1: Speed variance\n const speeds = [];\n for (let i = 1; i < points.length; i++) {\n const dx = points[i].x - points[i - 1].x;\n const dy = points[i].y - points[i - 1].y;\n const dt = points[i].t - points[i - 1].t;\n if (dt > 0) {\n speeds.push(Math.sqrt(dx * dx + dy * dy) / dt);\n }\n }\n\n if (speeds.length > 2) {\n const avgSpeed = speeds.reduce((a, b) => a + b, 0) / speeds.length;\n const speedVariance = speeds.reduce((a, b) =>\n a + Math.pow(b - avgSpeed, 2), 0) /\n speeds.length;\n\n if (speedVariance > 0.01) {\n score += 25;\n } else {\n reasons.push(\"constant_speed\");\n }\n }\n\n // Check 2: Direction changes\n const angles = [];\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i - 1].x - points[i - 2].x;\n const dy1 = points[i - 1].y - points[i - 2].y;\n const dx2 = points[i].x - points[i - 1].x;\n const dy2 = points[i].y - points[i - 1].y;\n\n const angle1 = Math.atan2(dy1, dx1);\n const angle2 = Math.atan2(dy2, dx2);\n let diff = Math.abs(angle2 - angle1);\n if (diff > Math.PI) diff = 2 * Math.PI - diff;\n angles.push(diff);\n }\n\n if (angles.length > 0) {\n const avgAngleChange = angles.reduce((a, b) => a + b, 0) / angles.length;\n const hasDirectionChanges = angles.some((a) => a > 0.1);\n\n if (hasDirectionChanges && avgAngleChange > 0.05) {\n score += 25;\n } else {\n reasons.push(\"straight_line\");\n }\n }\n\n // Check 3: Uneven time intervals\n const intervals = [];\n for (let i = 1; i < points.length; i++) {\n intervals.push(points[i].t - points[i - 1].t);\n }\n\n if (intervals.length > 2) {\n const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;\n const intervalVariance = intervals.reduce((a, b) =>\n a + Math.pow(b - avgInterval, 2), 0) /\n intervals.length;\n\n if (intervalVariance > 5) {\n score += 25;\n } else {\n reasons.push(\"robotic_timing\");\n }\n }\n\n // Check 4: Coverage range\n const xs = points.map((p) => p.x);\n const ys = points.map((p) => p.y);\n const xRange = Math.max(...xs) - Math.min(...xs);\n const yRange = Math.max(...ys) - Math.min(...ys);\n\n if (xRange > 50 && yRange > 30) {\n score += 15;\n } else {\n reasons.push(\"limited_range\");\n }\n\n // Check 5: Micro-jitter\n let jitterCount = 0;\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i].x - points[i - 1].x;\n const dy1 = points[i].y - points[i - 1].y;\n const dx2 = points[i - 1].x - points[i - 2].x;\n const dy2 = points[i - 1].y - points[i - 2].y;\n\n if (\n Math.abs(dx1 - dx2) <= 3 &&\n Math.abs(dy1 - dy2) <= 3 &&\n (Math.sign(dx1) !== Math.sign(dx2) ||\n Math.sign(dy1) !== Math.sign(dy2))\n ) {\n jitterCount++;\n }\n }\n\n if (jitterCount > points.length * 0.05) {\n score += 10;\n }\n\n return {\n score,\n reasons,\n passed: score >= 60,\n };\n}\n\n// ---------- JSON response helper ----------\n\nfunction json(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// ---------- S3 presigned URL helper ----------\n\n/**\n * Build a default S3 key name from an optional product discriminator.\n * Falls back to the generic S3_FILE_KEY when no discriminator is provided.\n */\nfunction resolveS3Key(p) {\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n return process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n}\n\nfunction getS3Client() {\n return new S3Client({\n endpoint: process.env.S3_ENDPOINT,\n region: process.env.S3_REGION,\n forcePathStyle: true,\n credentials: {\n accessKeyId: process.env.S3_ACCESS_KEY,\n secretAccessKey: process.env.S3_SECRET_KEY,\n },\n });\n}\n\nasync function generateS3PresignedUrl(p) {\n const s3 = getS3Client();\n const bucket = process.env.S3_BUCKET;\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n const key = process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n const command = new GetObjectCommand({ Bucket: bucket, Key: key });\n return getSignedUrl(s3, command, { expiresIn: 3600 * 24 });\n}\n\n// ---------- Route handlers ----------\n\nasync function handleVerifyTrajectory(req) {\n let body;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid_json\" }, 400);\n }\n\n const { sessionId, points, p } = body;\n\n if (!sessionId || !points || !Array.isArray(points)) {\n return json({ error: \"invalid_request\" }, 400);\n }\n\n if (!sessions.has(sessionId)) {\n sessions.set(sessionId, {\n allPoints: [],\n attempts: 0,\n createdAt: Date.now(),\n });\n }\n\n const session = sessions.get(sessionId);\n session.attempts++;\n session.allPoints.push(...points);\n\n if (Date.now() - session.createdAt > SESSION_TIMEOUT_MS) {\n sessions.delete(sessionId);\n return json({ rejected: true, reason: \"session_expired\" });\n }\n\n if (session.attempts > MAX_ATTEMPTS) {\n return json({ rejected: true, reason: \"too_many_attempts\" });\n }\n\n const analysis = analyzeTrajectory(session.allPoints);\n\n if (analysis.passed) {\n const token = generateToken(sessionId, p);\n sessions.delete(sessionId);\n return json({ verified: true, token });\n }\n\n if (analysis.score === 0 && session.attempts > 5) {\n return json({ rejected: true, reason: \"bot_detected\" });\n }\n\n return json({ verified: false, rejected: false, hint: \"keep_moving\" });\n}\n\nasync function handleDownload(req) {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"token\");\n\n if (!token || !downloadTokens.has(token)) {\n return json({ error: \"invalid_token\" }, 403);\n }\n\n const tokenData = downloadTokens.get(token);\n\n if (tokenData.used) {\n return json({ error: \"token_already_used\" }, 403);\n }\n\n if (Date.now() - tokenData.createdAt > SESSION_TIMEOUT_MS) {\n downloadTokens.delete(token);\n return json({ error: \"token_expired\" }, 403);\n }\n\n tokenData.used = true;\n\n // ---- Resource delivery (ordered by priority) ----\n\n // Priority 1: Direct remote URL — 302 redirect\n const resourceUrl = process.env.RESOURCE_URL;\n if (resourceUrl) {\n return new Response(null, {\n status: 302,\n headers: { Location: resourceUrl },\n });\n }\n\n // Priority 2: S3 presigned download URL — 302 redirect\n const s3Endpoint = process.env.S3_ENDPOINT;\n if (s3Endpoint) {\n try {\n const signedUrl = await generateS3PresignedUrl(tokenData.p);\n return new Response(null, {\n status: 302,\n headers: { Location: signedUrl },\n });\n } catch (e) {\n return json({ error: \"s3_presigned_failed\" }, 500);\n }\n }\n\n // Priority 3: Val Town blob storage — direct download\n const blobKey = process.env.BLOB_FILE_KEY;\n if (blobKey) {\n try {\n const blobRes = await blob.get(blobKey);\n if (blobRes) {\n const data = await blobRes.arrayBuffer();\n return new Response(data, {\n headers: {\n \"Content-Type\": \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${blobKey}\"`,\n },\n });\n }\n } catch (e) {\n return json({ error: \"blob_read_failed\" }, 500);\n }\n }\n\n // No resource configured\n return json(\n {\n error:\n \"no_resource_configured: Set RESOURCE_URL, S3_ENDPOINT, or BLOB_FILE_KEY in environment variables.\",\n },\n 500,\n );\n}\n\n// ---------- Main entry (Val Town HTTP val) ----------\n\nexport default async function (req) {\n const url = new URL(req.url);\n\n if (url.pathname === \"/api/verify-trajectory\" && req.method === \"POST\") {\n return handleVerifyTrajectory(req);\n }\n\n if (url.pathname === \"/api/resource/download\") {\n return handleDownload(req);\n }\n\n // All other paths serve the verification page\n return new Response(HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1782714594889],"children",[],[35],"0495e87f-b134-4136-b025-e0878201c1a0",["D",1782713664035],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","7695f599-e357-4cb9-a4da-efdfeb83b7fa","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eda39-ddab-70b4-b789-e5891ba1a5e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_113":19},"org",{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":148,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":149,"_95":150,"_97":151,"_99":53},[145],"files",[145],"counts",{"_134":77,"_135":136,"_137":77,"_31":138,"_139":140},[132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":133},[35],"pulls","branches",1,"forks",{"_141":143,"_144":77},"connections",{"_141":77,"_142":77},"count","unfilledCount",6,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":146,"_18":147},[],[35],["D",1782713664035],{"_11":12,"_113":19},{"_11":12,"_108":19,"_109":19,"_70":71,"_110":111,"_112":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_129":185,"_186":187,"_188":189,"_190":53,"_191":53,"_192":53,"_193":44,"_194":-5,"_195":-7,"_196":-7,"_197":77,"_198":53,"_199":53,"_200":-5,"_201":53,"_202":53,"_203":53,"_204":-5},"ENV",{"_156":157,"_158":159,"_160":16,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]