Secure Download

Your download will start automatically.
If it doesn't, click here to start the download manually.

Preparing your download…

\n\n\n\n`;\n\n// ---------- Utilities ----------\n\nfunction generateToken(sessionId, p) {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n downloadTokens.set(token, {\n sessionId,\n p: p || null,\n createdAt: Date.now(),\n used: false,\n });\n return token;\n}\n\n/**\n * Debounce a function call by a given delay in milliseconds.\n * Useful for rate-limiting rapid-fire events like scroll or resize.\n */\nfunction debounce(fn, delay) {\n let timer = null;\n return function (...args) {\n if (timer) clearTimeout(timer);\n timer = setTimeout(() => fn.apply(this, args), delay);\n };\n}\n\n/**\n * Format a timestamp into a human-readable date string using sv-SE locale.\n * Returns ISO-like format: YYYY-MM-DD HH:MM:SS\n */\nfunction formatTimestamp(ts) {\n return new Date(ts).toLocaleString(DATETIME_FORMAT, {\n timeZone: TIMEZONE,\n });\n}\n\n/**\n * Return a cryptographically weak but fast hash of a string (djb2 variant).\n * Not for security purposes — only for checksums and cache keys.\n */\nfunction djb2Hash(str) {\n let hash = 5381;\n for (let i = 0; i < str.length; i++) {\n hash = ((hash << 5) + hash) ^ str.charCodeAt(i);\n hash = hash >>> 0;\n }\n return hash.toString(16);\n}\n\n/**\n * Analyze mouse trajectory for human-like behavior.\n */\nfunction analyzeTrajectory(points) {\n if (points.length < 10) {\n return { score: 0, reason: \"insufficient_data\" };\n }\n\n let score = 0;\n const reasons = [];\n\n // Check 1: Speed variance\n const speeds = [];\n for (let i = 1; i < points.length; i++) {\n const dx = points[i].x - points[i - 1].x;\n const dy = points[i].y - points[i - 1].y;\n const dt = points[i].t - points[i - 1].t;\n if (dt > 0) {\n speeds.push(Math.sqrt(dx * dx + dy * dy) / dt);\n }\n }\n\n if (speeds.length > 2) {\n const avgSpeed = speeds.reduce((a, b) => a + b, 0) / speeds.length;\n const speedVariance = speeds.reduce((a, b) =>\n a + Math.pow(b - avgSpeed, 2), 0) /\n speeds.length;\n\n if (speedVariance > 0.01) {\n score += 25;\n } else {\n reasons.push(\"constant_speed\");\n }\n }\n\n // Check 2: Direction changes\n const angles = [];\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i - 1].x - points[i - 2].x;\n const dy1 = points[i - 1].y - points[i - 2].y;\n const dx2 = points[i].x - points[i - 1].x;\n const dy2 = points[i].y - points[i - 1].y;\n\n const angle1 = Math.atan2(dy1, dx1);\n const angle2 = Math.atan2(dy2, dx2);\n let diff = Math.abs(angle2 - angle1);\n if (diff > Math.PI) diff = 2 * Math.PI - diff;\n angles.push(diff);\n }\n\n if (angles.length > 0) {\n const avgAngleChange = angles.reduce((a, b) => a + b, 0) / angles.length;\n const hasDirectionChanges = angles.some((a) => a > 0.1);\n\n if (hasDirectionChanges && avgAngleChange > 0.05) {\n score += 25;\n } else {\n reasons.push(\"straight_line\");\n }\n }\n\n // Check 3: Uneven time intervals\n const intervals = [];\n for (let i = 1; i < points.length; i++) {\n intervals.push(points[i].t - points[i - 1].t);\n }\n\n if (intervals.length > 2) {\n const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;\n const intervalVariance = intervals.reduce((a, b) =>\n a + Math.pow(b - avgInterval, 2), 0) /\n intervals.length;\n\n if (intervalVariance > 5) {\n score += 25;\n } else {\n reasons.push(\"robotic_timing\");\n }\n }\n\n // Check 4: Coverage range\n const xs = points.map((p) => p.x);\n const ys = points.map((p) => p.y);\n const xRange = Math.max(...xs) - Math.min(...xs);\n const yRange = Math.max(...ys) - Math.min(...ys);\n\n if (xRange > 50 && yRange > 30) {\n score += 15;\n } else {\n reasons.push(\"limited_range\");\n }\n\n // Check 5: Micro-jitter\n let jitterCount = 0;\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i].x - points[i - 1].x;\n const dy1 = points[i].y - points[i - 1].y;\n const dx2 = points[i - 1].x - points[i - 2].x;\n const dy2 = points[i - 1].y - points[i - 2].y;\n\n if (\n Math.abs(dx1 - dx2) <= 3 &&\n Math.abs(dy1 - dy2) <= 3 &&\n (Math.sign(dx1) !== Math.sign(dx2) ||\n Math.sign(dy1) !== Math.sign(dy2))\n ) {\n jitterCount++;\n }\n }\n\n if (jitterCount > points.length * 0.05) {\n score += 10;\n }\n\n return {\n score,\n reasons,\n passed: score >= 60,\n };\n}\n\n// ---------- JSON response helper ----------\n\nfunction json(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// ---------- S3 presigned URL helper ----------\n\n/**\n * Build a default S3 key name from an optional product discriminator.\n * Falls back to the generic S3_FILE_KEY when no discriminator is provided.\n */\nfunction resolveS3Key(p) {\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n return process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n}\n\nfunction getS3Client() {\n return new S3Client({\n endpoint: process.env.S3_ENDPOINT,\n region: process.env.S3_REGION,\n forcePathStyle: true,\n credentials: {\n accessKeyId: process.env.S3_ACCESS_KEY,\n secretAccessKey: process.env.S3_SECRET_KEY,\n },\n });\n}\n\nasync function generateS3PresignedUrl(p) {\n const s3 = getS3Client();\n const bucket = process.env.S3_BUCKET;\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n const key = process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n const command = new GetObjectCommand({ Bucket: bucket, Key: key });\n return getSignedUrl(s3, command, { expiresIn: 3600 * 24 });\n}\n\n// ---------- Route handlers ----------\n\nasync function handleVerifyTrajectory(req) {\n let body;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid_json\" }, 400);\n }\n\n const { sessionId, points, p } = body;\n\n if (!sessionId || !points || !Array.isArray(points)) {\n return json({ error: \"invalid_request\" }, 400);\n }\n\n if (!sessions.has(sessionId)) {\n sessions.set(sessionId, {\n allPoints: [],\n attempts: 0,\n createdAt: Date.now(),\n });\n }\n\n const session = sessions.get(sessionId);\n session.attempts++;\n session.allPoints.push(...points);\n\n if (Date.now() - session.createdAt > SESSION_TIMEOUT_MS) {\n sessions.delete(sessionId);\n return json({ rejected: true, reason: \"session_expired\" });\n }\n\n if (session.attempts > MAX_ATTEMPTS) {\n return json({ rejected: true, reason: \"too_many_attempts\" });\n }\n\n const analysis = analyzeTrajectory(session.allPoints);\n\n if (analysis.passed) {\n const token = generateToken(sessionId, p);\n sessions.delete(sessionId);\n return json({ verified: true, token });\n }\n\n if (analysis.score === 0 && session.attempts > 5) {\n return json({ rejected: true, reason: \"bot_detected\" });\n }\n\n return json({ verified: false, rejected: false, hint: \"keep_moving\" });\n}\n\nasync function handleDownload(req) {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"token\");\n\n if (!token || !downloadTokens.has(token)) {\n return json({ error: \"invalid_token\" }, 403);\n }\n\n const tokenData = downloadTokens.get(token);\n\n if (tokenData.used) {\n return json({ error: \"token_already_used\" }, 403);\n }\n\n if (Date.now() - tokenData.createdAt > SESSION_TIMEOUT_MS) {\n downloadTokens.delete(token);\n return json({ error: \"token_expired\" }, 403);\n }\n\n tokenData.used = true;\n\n // ---- Resource delivery (ordered by priority) ----\n\n // Priority 1: Direct remote URL — 302 redirect\n const resourceUrl = process.env.RESOURCE_URL;\n if (resourceUrl) {\n return new Response(null, {\n status: 302,\n headers: { Location: resourceUrl },\n });\n }\n\n // Priority 2: S3 presigned download URL — 302 redirect\n const s3Endpoint = process.env.S3_ENDPOINT;\n if (s3Endpoint) {\n try {\n const signedUrl = await generateS3PresignedUrl(tokenData.p);\n return new Response(null, {\n status: 302,\n headers: { Location: signedUrl },\n });\n } catch (e) {\n return json({ error: \"s3_presigned_failed\" }, 500);\n }\n }\n\n // Priority 3: Val Town blob storage — direct download\n const blobKey = process.env.BLOB_FILE_KEY;\n if (blobKey) {\n try {\n const blobRes = await blob.get(blobKey);\n if (blobRes) {\n const data = await blobRes.arrayBuffer();\n return new Response(data, {\n headers: {\n \"Content-Type\": \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${blobKey}\"`,\n },\n });\n }\n } catch (e) {\n return json({ error: \"blob_read_failed\" }, 500);\n }\n }\n\n // No resource configured\n return json(\n {\n error:\n \"no_resource_configured: Set RESOURCE_URL, S3_ENDPOINT, or BLOB_FILE_KEY in environment variables.\",\n },\n 500,\n );\n}\n\n// ---------- Main entry (Val Town HTTP val) ----------\n\nexport default async function (req) {\n const url = new URL(req.url);\n\n if (url.pathname === \"/api/verify-trajectory\" && req.method === \"POST\") {\n return handleVerifyTrajectory(req);\n }\n\n if (url.pathname === \"/api/resource/download\") {\n return handleDownload(req);\n }\n\n // All other paths serve the verification page\n return new Response(HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}","label",[62],"pulls","branches","forks","envVars",{"_182":184,"_185":20},"connections",{"_182":20,"_183":20},"count","unfilledCount",6,"emptyCount",{"_31":167,"_13":62,"_60":61,"_41":-5,"_33":34,"_168":93,"_169":161,"_35":187,"_37":86,"_63":83,"_171":172,"_65":24,"_173":-5,"_188":189,"_144":190},["D",1782714594889],"children",[],[62],["D",1782713664035],{"_11":12,"_143":68},{"_11":12,"_139":68,"_67":68,"_25":66,"_140":141,"_142":24},{"_37":93,"_13":16,"_31":34,"_131":98,"_132":-5,"_133":-5,"_134":-5,"_135":-5,"_136":-5,"_137":14,"_138":12},"ctx",{"_49":-5,"_163":228,"_229":230,"_231":232,"_233":24,"_234":24,"_235":24,"_236":161,"_237":-5,"_238":-7,"_239":-7,"_240":20,"_241":24,"_242":24,"_243":-5,"_244":24,"_245":24,"_246":24,"_247":-5},"ENV",{"_199":200,"_201":202,"_203":16,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History