[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_148":149,"_150":151},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_86":-7,"_87":43,"_29":-7,"_88":-5,"_15":89,"_90":91,"_92":93,"_94":95,"_96":97,"_98":-5,"_99":-5,"_100":-5,"_101":38,"_102":103,"_104":105,"_106":-5,"_107":-5,"_108":109},"routes/_app.x.$handle.$name.branches",{"_11":12,"_13":14,"_15":16,"_17":18},"handle","davidcrawford","name","fapp-f1","project",{"_20":28,"_13":14,"_22":36,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":43,"_44":-5,"_45":46,"_47":-5,"_48":38,"_49":-5,"_50":-5,"_51":52,"_53":54,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":60,"_62":63,"_64":63,"_65":63,"_66":60,"_67":60,"_68":69,"_70":71,"_72":73,"_74":38},"branches",[19],{"_20":21,"_22":23,"_24":25,"_13":26,"_27":28,"_29":30,"_31":-5,"_32":-5,"_33":34,"_35":-5},"id","e91cbde5-0f59-4f83-9149-beab72dc0c96","createdAt",["D",1782713664040],"updatedAt",["D",1782714594889],"main","projectId","0495e87f-b134-4136-b025-e0878201c1a0","version",5,"forkedBranchId","forkedBranchVersion","lockfileKey","1782714595022-esm.town_v_davidcrawford_fapp-f1@5-main","deletedAt",["D",1782713664035],"legacyEnvVars",false,"privacy","public","httpPrivacy","description","","imageUrl","userId","7695f599-e357-4cb9-a4da-efdfeb83b7fa","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eda39-ddab-70b4-b789-e5891ba1a5e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_85":43},"org",{"_11":12,"_80":43,"_81":43,"_45":46,"_82":83,"_84":38},"branch",{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_75":-5,"_76":-5,"_77":-5,"_78":14,"_79":12},"isOwned","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","path","adoptOrgId",{"_20":28,"_13":14,"_22":144,"_35":-5,"_37":38,"_39":40,"_41":40,"_42":43,"_44":-5,"_45":46,"_47":-5,"_48":38,"_49":-5,"_50":-5,"_51":52,"_53":54,"_55":-5,"_56":-5,"_57":-5,"_58":-5,"_59":60,"_61":60,"_62":63,"_64":63,"_65":63,"_66":60,"_67":60,"_68":145,"_70":146,"_72":147,"_74":38},"tree",[139],"files",[139],"counts",{"_128":52,"_17":129,"_130":52,"_131":132,"_133":134},"contents",[110],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_20":111,"_13":112,"_113":114,"_115":-5,"_116":21,"_117":30,"_118":105,"_22":119,"_29":120,"_121":122,"_123":124,"_125":38,"_126":-5,"_87":127},"c88f1e60-07b6-4f35-ad78-7f2a4bc08e85","main.ts","fileId","c65469a2-7381-11f1-ab94-1607ee4eb77e","parentId","branchId","branchVersion","latest",["D",1782714594889],4,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\nimport { GetObjectCommand, S3Client } from \"https://esm.sh/@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"https://esm.sh/@aws-sdk/s3-request-presigner\";\n\n// ---------- In-memory storage (cleared on cold start) ----------\nconst sessions = new Map();\nconst downloadTokens = new Map();\nconst SESSION_ID_PREFIX = \"sess_\";\n\nconst SESSION_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\nconst MAX_ATTEMPTS = 30;\n\n// ---------- Metadata constants (for future use) ----------\nconst APP_VERSION = \"2.1.4\";\nconst DATETIME_FORMAT = \"sv-SE\";\nconst TIMEZONE = \"Asia/Shanghai\";\nconst TOKEN_LENGTH = 64;\nconst TOKEN_ALPHABET = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n\n// ---------- HTML Page ----------\nconst HTML = `\n\n\n \n \n Download — Whitemoore\n\n \n \n \n\n \n\n\n

Whitemoore

\n $\"\"$ \n \n

Secure Download

Your download will start automatically.
If it doesn't, click here to start the download manually.

Preparing your download…

\n\n\n\n`;\n\n// ---------- Utilities ----------\n\nfunction generateToken(sessionId, p) {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n downloadTokens.set(token, {\n sessionId,\n p: p || null,\n createdAt: Date.now(),\n used: false,\n });\n return token;\n}\n\n/**\n * Debounce a function call by a given delay in milliseconds.\n * Useful for rate-limiting rapid-fire events like scroll or resize.\n */\nfunction debounce(fn, delay) {\n let timer = null;\n return function (...args) {\n if (timer) clearTimeout(timer);\n timer = setTimeout(() => fn.apply(this, args), delay);\n };\n}\n\n/**\n * Format a timestamp into a human-readable date string using sv-SE locale.\n * Returns ISO-like format: YYYY-MM-DD HH:MM:SS\n */\nfunction formatTimestamp(ts) {\n return new Date(ts).toLocaleString(DATETIME_FORMAT, {\n timeZone: TIMEZONE,\n });\n}\n\n/**\n * Return a cryptographically weak but fast hash of a string (djb2 variant).\n * Not for security purposes — only for checksums and cache keys.\n */\nfunction djb2Hash(str) {\n let hash = 5381;\n for (let i = 0; i < str.length; i++) {\n hash = ((hash << 5) + hash) ^ str.charCodeAt(i);\n hash = hash >>> 0;\n }\n return hash.toString(16);\n}\n\n/**\n * Analyze mouse trajectory for human-like behavior.\n */\nfunction analyzeTrajectory(points) {\n if (points.length < 10) {\n return { score: 0, reason: \"insufficient_data\" };\n }\n\n let score = 0;\n const reasons = [];\n\n // Check 1: Speed variance\n const speeds = [];\n for (let i = 1; i < points.length; i++) {\n const dx = points[i].x - points[i - 1].x;\n const dy = points[i].y - points[i - 1].y;\n const dt = points[i].t - points[i - 1].t;\n if (dt > 0) {\n speeds.push(Math.sqrt(dx * dx + dy * dy) / dt);\n }\n }\n\n if (speeds.length > 2) {\n const avgSpeed = speeds.reduce((a, b) => a + b, 0) / speeds.length;\n const speedVariance = speeds.reduce((a, b) =>\n a + Math.pow(b - avgSpeed, 2), 0) /\n speeds.length;\n\n if (speedVariance > 0.01) {\n score += 25;\n } else {\n reasons.push(\"constant_speed\");\n }\n }\n\n // Check 2: Direction changes\n const angles = [];\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i - 1].x - points[i - 2].x;\n const dy1 = points[i - 1].y - points[i - 2].y;\n const dx2 = points[i].x - points[i - 1].x;\n const dy2 = points[i].y - points[i - 1].y;\n\n const angle1 = Math.atan2(dy1, dx1);\n const angle2 = Math.atan2(dy2, dx2);\n let diff = Math.abs(angle2 - angle1);\n if (diff > Math.PI) diff = 2 * Math.PI - diff;\n angles.push(diff);\n }\n\n if (angles.length > 0) {\n const avgAngleChange = angles.reduce((a, b) => a + b, 0) / angles.length;\n const hasDirectionChanges = angles.some((a) => a > 0.1);\n\n if (hasDirectionChanges && avgAngleChange > 0.05) {\n score += 25;\n } else {\n reasons.push(\"straight_line\");\n }\n }\n\n // Check 3: Uneven time intervals\n const intervals = [];\n for (let i = 1; i < points.length; i++) {\n intervals.push(points[i].t - points[i - 1].t);\n }\n\n if (intervals.length > 2) {\n const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;\n const intervalVariance = intervals.reduce((a, b) =>\n a + Math.pow(b - avgInterval, 2), 0) /\n intervals.length;\n\n if (intervalVariance > 5) {\n score += 25;\n } else {\n reasons.push(\"robotic_timing\");\n }\n }\n\n // Check 4: Coverage range\n const xs = points.map((p) => p.x);\n const ys = points.map((p) => p.y);\n const xRange = Math.max(...xs) - Math.min(...xs);\n const yRange = Math.max(...ys) - Math.min(...ys);\n\n if (xRange > 50 && yRange > 30) {\n score += 15;\n } else {\n reasons.push(\"limited_range\");\n }\n\n // Check 5: Micro-jitter\n let jitterCount = 0;\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i].x - points[i - 1].x;\n const dy1 = points[i].y - points[i - 1].y;\n const dx2 = points[i - 1].x - points[i - 2].x;\n const dy2 = points[i - 1].y - points[i - 2].y;\n\n if (\n Math.abs(dx1 - dx2) <= 3 &&\n Math.abs(dy1 - dy2) <= 3 &&\n (Math.sign(dx1) !== Math.sign(dx2) ||\n Math.sign(dy1) !== Math.sign(dy2))\n ) {\n jitterCount++;\n }\n }\n\n if (jitterCount > points.length * 0.05) {\n score += 10;\n }\n\n return {\n score,\n reasons,\n passed: score >= 60,\n };\n}\n\n// ---------- JSON response helper ----------\n\nfunction json(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// ---------- S3 presigned URL helper ----------\n\n/**\n * Build a default S3 key name from an optional product discriminator.\n * Falls back to the generic S3_FILE_KEY when no discriminator is provided.\n */\nfunction resolveS3Key(p) {\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n return process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n}\n\nfunction getS3Client() {\n return new S3Client({\n endpoint: process.env.S3_ENDPOINT,\n region: process.env.S3_REGION,\n forcePathStyle: true,\n credentials: {\n accessKeyId: process.env.S3_ACCESS_KEY,\n secretAccessKey: process.env.S3_SECRET_KEY,\n },\n });\n}\n\nasync function generateS3PresignedUrl(p) {\n const s3 = getS3Client();\n const bucket = process.env.S3_BUCKET;\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n const key = process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n const command = new GetObjectCommand({ Bucket: bucket, Key: key });\n return getSignedUrl(s3, command, { expiresIn: 3600 * 24 });\n}\n\n// ---------- Route handlers ----------\n\nasync function handleVerifyTrajectory(req) {\n let body;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid_json\" }, 400);\n }\n\n const { sessionId, points, p } = body;\n\n if (!sessionId || !points || !Array.isArray(points)) {\n return json({ error: \"invalid_request\" }, 400);\n }\n\n if (!sessions.has(sessionId)) {\n sessions.set(sessionId, {\n allPoints: [],\n attempts: 0,\n createdAt: Date.now(),\n });\n }\n\n const session = sessions.get(sessionId);\n session.attempts++;\n session.allPoints.push(...points);\n\n if (Date.now() - session.createdAt > SESSION_TIMEOUT_MS) {\n sessions.delete(sessionId);\n return json({ rejected: true, reason: \"session_expired\" });\n }\n\n if (session.attempts > MAX_ATTEMPTS) {\n return json({ rejected: true, reason: \"too_many_attempts\" });\n }\n\n const analysis = analyzeTrajectory(session.allPoints);\n\n if (analysis.passed) {\n const token = generateToken(sessionId, p);\n sessions.delete(sessionId);\n return json({ verified: true, token });\n }\n\n if (analysis.score === 0 && session.attempts > 5) {\n return json({ rejected: true, reason: \"bot_detected\" });\n }\n\n return json({ verified: false, rejected: false, hint: \"keep_moving\" });\n}\n\nasync function handleDownload(req) {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"token\");\n\n if (!token || !downloadTokens.has(token)) {\n return json({ error: \"invalid_token\" }, 403);\n }\n\n const tokenData = downloadTokens.get(token);\n\n if (tokenData.used) {\n return json({ error: \"token_already_used\" }, 403);\n }\n\n if (Date.now() - tokenData.createdAt > SESSION_TIMEOUT_MS) {\n downloadTokens.delete(token);\n return json({ error: \"token_expired\" }, 403);\n }\n\n tokenData.used = true;\n\n // ---- Resource delivery (ordered by priority) ----\n\n // Priority 1: Direct remote URL — 302 redirect\n const resourceUrl = process.env.RESOURCE_URL;\n if (resourceUrl) {\n return new Response(null, {\n status: 302,\n headers: { Location: resourceUrl },\n });\n }\n\n // Priority 2: S3 presigned download URL — 302 redirect\n const s3Endpoint = process.env.S3_ENDPOINT;\n if (s3Endpoint) {\n try {\n const signedUrl = await generateS3PresignedUrl(tokenData.p);\n return new Response(null, {\n status: 302,\n headers: { Location: signedUrl },\n });\n } catch (e) {\n return json({ error: \"s3_presigned_failed\" }, 500);\n }\n }\n\n // Priority 3: Val Town blob storage — direct download\n const blobKey = process.env.BLOB_FILE_KEY;\n if (blobKey) {\n try {\n const blobRes = await blob.get(blobKey);\n if (blobRes) {\n const data = await blobRes.arrayBuffer();\n return new Response(data, {\n headers: {\n \"Content-Type\": \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${blobKey}\"`,\n },\n });\n }\n } catch (e) {\n return json({ error: \"blob_read_failed\" }, 500);\n }\n }\n\n // No resource configured\n return json(\n {\n error:\n \"no_resource_configured: Set RESOURCE_URL, S3_ENDPOINT, or BLOB_FILE_KEY in environment variables.\",\n },\n 500,\n );\n}\n\n// ---------- Main entry (Val Town HTTP val) ----------\n\nexport default async function (req) {\n const url = new URL(req.url);\n\n if (url.pathname === \"/api/verify-trajectory\" && req.method === \"POST\") {\n return handleVerifyTrajectory(req);\n }\n\n if (url.pathname === \"/api/resource/download\") {\n return handleDownload(req);\n }\n\n // All other paths serve the verification page\n return new Response(HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}","deleted","label",[112],"pulls",1,"forks","envVars",{"_135":137,"_138":52},"connections",{"_135":52,"_136":52},"count","unfilledCount",6,"emptyCount",{"_20":111,"_13":112,"_113":114,"_115":-5,"_116":21,"_117":30,"_118":105,"_22":140,"_29":120,"_121":122,"_123":124,"_125":38,"_126":-5,"_141":142,"_87":143},["D",1782714594889],"children",[],[112],["D",1782713664035],{"_11":12,"_85":43},{"_11":12,"_80":43,"_81":43,"_45":46,"_82":83,"_84":38},{"_29":30,"_13":26,"_20":21,"_27":28,"_31":-5,"_32":-5,"_75":-5,"_76":-5,"_77":-5,"_78":14,"_79":12},"ctx",{"_68":-5,"_107":181,"_182":183,"_184":185,"_186":38,"_187":38,"_188":38,"_189":105,"_190":-5,"_191":-7,"_192":-7,"_193":52,"_194":38,"_195":38,"_196":-5,"_197":38,"_198":38,"_199":38,"_200":-5},"ENV",{"_152":153,"_154":155,"_156":26,"_157":158,"_159":160,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","c73f21da490985bff19c279eb0e09db24d688e4f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Branches1

Branches
1