[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_150":151,"_152":153},"routes/_app.x.$handle.$name",{"_94":93,"_32":45,"_101":84,"_27":36,"_13":14,"_102":-5,"_11":103,"_104":105,"_106":107,"_108":109,"_110":111,"_20":-5,"_112":-5,"_113":-5,"_114":25,"_115":116,"_117":25,"_118":-5,"_119":-5,"_120":121},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":77,"_78":79,"_80":81,"_82":25},"version",2,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","c65469a2-7381-11f1-ab94-1607ee4eb77e","name","fileType","script","content","","import { blob } from \"https://esm.town/v/std/blob\";\nimport { GetObjectCommand, S3Client } from \"https://esm.sh/@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"https://esm.sh/@aws-sdk/s3-request-presigner\";\n\n// ---------- In-memory storage (cleared on cold start) ----------\nconst sessions = new Map();\nconst downloadTokens = new Map();\nconst SESSION_ID_PREFIX = \"sess_\";\n\nconst SESSION_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\nconst MAX_ATTEMPTS = 30;\n\n// ---------- Metadata constants (for future use) ----------\nconst APP_VERSION = \"2.1.4\";\nconst DATETIME_FORMAT = \"sv-SE\";\nconst TIMEZONE = \"Asia/Shanghai\";\nconst TOKEN_LENGTH = 64;\nconst TOKEN_ALPHABET = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n\n// ---------- HTML Page ----------\nconst HTML = `\n\n\n \n \n Download — Whitemoore\n\n \n \n \n\n \n\n\n

Whitemoore

\n $\"\"$ \n \n

Secure Download

Your download will start automatically.
If it doesn't, click here to start the download manually.

Preparing your download…

\n\n\n\n`;\n\n// ---------- Utilities ----------\n\nfunction generateToken(sessionId, p) {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n downloadTokens.set(token, {\n sessionId,\n p: p || null,\n createdAt: Date.now(),\n used: false,\n });\n return token;\n}\n\n/**\n * Debounce a function call by a given delay in milliseconds.\n * Useful for rate-limiting rapid-fire events like scroll or resize.\n */\nfunction debounce(fn, delay) {\n let timer = null;\n return function (...args) {\n if (timer) clearTimeout(timer);\n timer = setTimeout(() => fn.apply(this, args), delay);\n };\n}\n\n/**\n * Format a timestamp into a human-readable date string using sv-SE locale.\n * Returns ISO-like format: YYYY-MM-DD HH:MM:SS\n */\nfunction formatTimestamp(ts) {\n return new Date(ts).toLocaleString(DATETIME_FORMAT, {\n timeZone: TIMEZONE,\n });\n}\n\n/**\n * Return a cryptographically weak but fast hash of a string (djb2 variant).\n * Not for security purposes — only for checksums and cache keys.\n */\nfunction djb2Hash(str) {\n let hash = 5381;\n for (let i = 0; i < str.length; i++) {\n hash = ((hash << 5) + hash) ^ str.charCodeAt(i);\n hash = hash >>> 0;\n }\n return hash.toString(16);\n}\n\n/**\n * Analyze mouse trajectory for human-like behavior.\n */\nfunction analyzeTrajectory(points) {\n if (points.length < 10) {\n return { score: 0, reason: \"insufficient_data\" };\n }\n\n let score = 0;\n const reasons = [];\n\n // Check 1: Speed variance\n const speeds = [];\n for (let i = 1; i < points.length; i++) {\n const dx = points[i].x - points[i - 1].x;\n const dy = points[i].y - points[i - 1].y;\n const dt = points[i].t - points[i - 1].t;\n if (dt > 0) {\n speeds.push(Math.sqrt(dx * dx + dy * dy) / dt);\n }\n }\n\n if (speeds.length > 2) {\n const avgSpeed = speeds.reduce((a, b) => a + b, 0) / speeds.length;\n const speedVariance = speeds.reduce((a, b) =>\n a + Math.pow(b - avgSpeed, 2), 0) /\n speeds.length;\n\n if (speedVariance > 0.01) {\n score += 25;\n } else {\n reasons.push(\"constant_speed\");\n }\n }\n\n // Check 2: Direction changes\n const angles = [];\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i - 1].x - points[i - 2].x;\n const dy1 = points[i - 1].y - points[i - 2].y;\n const dx2 = points[i].x - points[i - 1].x;\n const dy2 = points[i].y - points[i - 1].y;\n\n const angle1 = Math.atan2(dy1, dx1);\n const angle2 = Math.atan2(dy2, dx2);\n let diff = Math.abs(angle2 - angle1);\n if (diff > Math.PI) diff = 2 * Math.PI - diff;\n angles.push(diff);\n }\n\n if (angles.length > 0) {\n const avgAngleChange = angles.reduce((a, b) => a + b, 0) / angles.length;\n const hasDirectionChanges = angles.some((a) => a > 0.1);\n\n if (hasDirectionChanges && avgAngleChange > 0.05) {\n score += 25;\n } else {\n reasons.push(\"straight_line\");\n }\n }\n\n // Check 3: Uneven time intervals\n const intervals = [];\n for (let i = 1; i < points.length; i++) {\n intervals.push(points[i].t - points[i - 1].t);\n }\n\n if (intervals.length > 2) {\n const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;\n const intervalVariance = intervals.reduce((a, b) =>\n a + Math.pow(b - avgInterval, 2), 0) /\n intervals.length;\n\n if (intervalVariance > 5) {\n score += 25;\n } else {\n reasons.push(\"robotic_timing\");\n }\n }\n\n // Check 4: Coverage range\n const xs = points.map((p) => p.x);\n const ys = points.map((p) => p.y);\n const xRange = Math.max(...xs) - Math.min(...xs);\n const yRange = Math.max(...ys) - Math.min(...ys);\n\n if (xRange > 50 && yRange > 30) {\n score += 15;\n } else {\n reasons.push(\"limited_range\");\n }\n\n // Check 5: Micro-jitter\n let jitterCount = 0;\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i].x - points[i - 1].x;\n const dy1 = points[i].y - points[i - 1].y;\n const dx2 = points[i - 1].x - points[i - 2].x;\n const dy2 = points[i - 1].y - points[i - 2].y;\n\n if (\n Math.abs(dx1 - dx2) <= 3 &&\n Math.abs(dy1 - dy2) <= 3 &&\n (Math.sign(dx1) !== Math.sign(dx2) ||\n Math.sign(dy1) !== Math.sign(dy2))\n ) {\n jitterCount++;\n }\n }\n\n if (jitterCount > points.length * 0.05) {\n score += 10;\n }\n\n return {\n score,\n reasons,\n passed: score >= 60,\n };\n}\n\n// ---------- JSON response helper ----------\n\nfunction json(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// ---------- S3 presigned URL helper ----------\n\n/**\n * Build a default S3 key name from an optional product discriminator.\n * Falls back to the generic S3_FILE_KEY when no discriminator is provided.\n */\nfunction resolveS3Key(p) {\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n return process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n}\n\nfunction getS3Client() {\n return new S3Client({\n endpoint: process.env.S3_ENDPOINT,\n region: process.env.S3_REGION,\n forcePathStyle: true,\n credentials: {\n accessKeyId: process.env.S3_ACCESS_KEY,\n secretAccessKey: process.env.S3_SECRET_KEY,\n },\n });\n}\n\nasync function generateS3PresignedUrl(p) {\n const s3 = getS3Client();\n const bucket = process.env.S3_BUCKET;\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n const key = process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n const command = new GetObjectCommand({ Bucket: bucket, Key: key });\n return getSignedUrl(s3, command, { expiresIn: 3600 * 24 });\n}\n\n// ---------- Route handlers ----------\n\nasync function handleVerifyTrajectory(req) {\n let body;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid_json\" }, 400);\n }\n\n const { sessionId, points, p } = body;\n\n if (!sessionId || !points || !Array.isArray(points)) {\n return json({ error: \"invalid_request\" }, 400);\n }\n\n if (!sessions.has(sessionId)) {\n sessions.set(sessionId, {\n allPoints: [],\n attempts: 0,\n createdAt: Date.now(),\n });\n }\n\n const session = sessions.get(sessionId);\n session.attempts++;\n session.allPoints.push(...points);\n\n if (Date.now() - session.createdAt > SESSION_TIMEOUT_MS) {\n sessions.delete(sessionId);\n return json({ rejected: true, reason: \"session_expired\" });\n }\n\n if (session.attempts > MAX_ATTEMPTS) {\n return json({ rejected: true, reason: \"too_many_attempts\" });\n }\n\n const analysis = analyzeTrajectory(session.allPoints);\n\n if (analysis.passed) {\n const token = generateToken(sessionId, p);\n sessions.delete(sessionId);\n return json({ verified: true, token });\n }\n\n if (analysis.score === 0 && session.attempts > 5) {\n return json({ rejected: true, reason: \"bot_detected\" });\n }\n\n return json({ verified: false, rejected: false, hint: \"keep_moving\" });\n}\n\nasync function handleDownload(req) {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"token\");\n\n if (!token || !downloadTokens.has(token)) {\n return json({ error: \"invalid_token\" }, 403);\n }\n\n const tokenData = downloadTokens.get(token);\n\n if (tokenData.used) {\n return json({ error: \"token_already_used\" }, 403);\n }\n\n if (Date.now() - tokenData.createdAt > SESSION_TIMEOUT_MS) {\n downloadTokens.delete(token);\n return json({ error: \"token_expired\" }, 403);\n }\n\n tokenData.used = true;\n\n // ---- Resource delivery (ordered by priority) ----\n\n // Priority 1: Direct remote URL — 302 redirect\n const resourceUrl = process.env.RESOURCE_URL;\n if (resourceUrl) {\n return new Response(null, {\n status: 302,\n headers: { Location: resourceUrl },\n });\n }\n\n // Priority 2: S3 presigned download URL — 302 redirect\n const s3Endpoint = process.env.S3_ENDPOINT;\n if (s3Endpoint) {\n try {\n const signedUrl = await generateS3PresignedUrl(tokenData.p);\n return new Response(null, {\n status: 302,\n headers: { Location: signedUrl },\n });\n } catch (e) {\n return json({ error: \"s3_presigned_failed\" }, 500);\n }\n }\n\n // Priority 3: Val Town blob storage — direct download\n const blobKey = process.env.BLOB_FILE_KEY;\n if (blobKey) {\n try {\n const blobRes = await blob.get(blobKey);\n if (blobRes) {\n const data = await blobRes.arrayBuffer();\n return new Response(data, {\n headers: {\n \"Content-Type\": \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${blobKey}\"`,\n },\n });\n }\n } catch (e) {\n return json({ error: \"blob_read_failed\" }, 500);\n }\n }\n\n // No resource configured\n return json(\n {\n error:\n \"no_resource_configured: Set RESOURCE_URL, S3_ENDPOINT, or BLOB_FILE_KEY in environment variables.\",\n },\n 500,\n );\n}\n\n// ---------- Main entry (Val Town HTTP val) ----------\n\nexport default async function (req) {\n const url = new URL(req.url);\n\n if (url.pathname === \"/api/verify-trajectory\" && req.method === \"POST\") {\n return handleVerifyTrajectory(req);\n }\n\n if (url.pathname === \"/api/resource/download\") {\n return handleDownload(req);\n }\n\n // All other paths serve the verification page\n return new Response(HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}","createdAt",["D",1782713834166],"branchVersion","branchId","e91cbde5-0f59-4f83-9149-beab72dc0c96","id","0495e87f-b134-4136-b025-e0878201c1a0","fapp-f1",["D",1782713664035],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","7695f599-e357-4cb9-a4da-efdfeb83b7fa","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eda39-ddab-70b4-b789-e5891ba1a5e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_94":93,"_100":36},"org",{"_94":93,"_95":36,"_96":36,"_18":54,"_97":98,"_99":25},"branch",{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"isOwned",5,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","davidcrawford","handle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":146,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":36,"_53":-5,"_18":54,"_55":-5,"_56":25,"_57":-5,"_58":-5,"_59":60,"_61":62,"_63":-5,"_64":-5,"_65":-5,"_66":-5,"_67":68,"_69":68,"_70":71,"_72":71,"_73":71,"_74":68,"_75":68,"_76":147,"_78":148,"_80":149,"_82":25},"tree",[141],"files",[141],"counts",{"_130":60,"_131":127,"_132":60,"_133":134,"_135":136},"contents",[122],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":123,"_32":28,"_30":31,"_124":-5,"_41":42,"_40":14,"_125":25,"_38":126,"_13":127,"_33":34,"_35":37,"_24":25,"_128":-5,"_27":129},"9bad84af-31fe-4886-bb44-cddf9d6d91fd","parentId","latest",["D",1782713834166],1,"label",[28],"pulls","branches","forks","envVars",{"_137":139,"_140":60},"connections",{"_137":60,"_138":60},"count","unfilledCount",6,"emptyCount",{"_43":123,"_32":28,"_30":31,"_124":-5,"_41":42,"_40":14,"_125":25,"_38":142,"_13":127,"_33":34,"_35":37,"_24":25,"_128":-5,"_143":144,"_27":145},["D",1782713834166],"children",[],[28],["D",1782713664035],{"_94":93,"_100":36},{"_94":93,"_95":36,"_96":36,"_18":54,"_97":98,"_99":25},{"_13":83,"_32":84,"_43":42,"_85":44,"_86":-5,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":45,"_92":93},"ctx",{"_76":-5,"_119":183,"_184":185,"_186":187,"_188":25,"_189":25,"_190":25,"_191":192,"_193":-5,"_194":-7,"_195":-7,"_196":60,"_197":25,"_198":25,"_199":-5,"_200":25,"_201":25,"_202":25,"_203":-5},"ENV",{"_154":155,"_156":157,"_158":84,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets",true,"preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2