[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_143":144,"_145":146},"routes/_app.x.$handle.$name",{"_16":17,"_20":21,"_81":65,"_82":31,"_63":-7,"_83":-5,"_13":84,"_85":86,"_11":87,"_88":89,"_90":91,"_92":-5,"_93":-5,"_94":-5,"_95":26,"_96":97,"_98":99,"_100":-5,"_101":-5,"_102":103},"routes/_app.x.$handle.$name.search.$(branch)",{"_11":12,"_13":14,"_15":-5,"_16":17},"files",[],"project",{"_18":19,"_20":21,"_22":23,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":-5,"_36":26,"_37":-5,"_38":-5,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":48,"_49":48,"_50":51,"_52":51,"_53":51,"_54":48,"_55":48,"_56":57,"_58":59,"_60":61,"_62":26},"query","handle","davidcrawford","id","0495e87f-b134-4136-b025-e0878201c1a0","name","fapp-f1","createdAt",["D",1782713664035],"deletedAt","legacyEnvVars",false,"privacy","public","httpPrivacy","description","","imageUrl","userId","7695f599-e357-4cb9-a4da-efdfeb83b7fa","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019eda39-ddab-70b4-b789-e5891ba1a5e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_16":17,"_80":31},"org",{"_16":17,"_75":31,"_76":31,"_33":34,"_77":78,"_79":26},"branch",{"_63":64,"_20":65,"_18":66,"_67":19,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":21,"_74":17},"isOwned","version",5,"main","e91cbde5-0f59-4f83-9149-beab72dc0c96","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","branchName","path","adoptOrgId",{"_18":19,"_20":21,"_22":139,"_24":-5,"_25":26,"_27":28,"_29":28,"_30":31,"_32":-5,"_33":34,"_35":-5,"_36":26,"_37":-5,"_38":-5,"_39":40,"_41":42,"_43":-5,"_44":-5,"_45":-5,"_46":-5,"_47":48,"_49":48,"_50":51,"_52":51,"_53":51,"_54":48,"_55":48,"_56":140,"_58":141,"_60":142,"_62":26},"tree",[134],[134],"counts",{"_122":40,"_123":124,"_125":40,"_126":127,"_128":129},"contents",[104],"file","upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_18":105,"_20":106,"_107":108,"_109":-5,"_110":66,"_111":64,"_112":99,"_22":113,"_63":114,"_115":116,"_117":118,"_119":26,"_120":-5,"_82":121},"c88f1e60-07b6-4f35-ad78-7f2a4bc08e85","main.ts","fileId","c65469a2-7381-11f1-ab94-1607ee4eb77e","parentId","branchId","branchVersion","latest",["D",1782714594889],4,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\nimport { GetObjectCommand, S3Client } from \"https://esm.sh/@aws-sdk/client-s3\";\nimport { getSignedUrl } from \"https://esm.sh/@aws-sdk/s3-request-presigner\";\n\n// ---------- In-memory storage (cleared on cold start) ----------\nconst sessions = new Map();\nconst downloadTokens = new Map();\nconst SESSION_ID_PREFIX = \"sess_\";\n\nconst SESSION_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes\nconst MAX_ATTEMPTS = 30;\n\n// ---------- Metadata constants (for future use) ----------\nconst APP_VERSION = \"2.1.4\";\nconst DATETIME_FORMAT = \"sv-SE\";\nconst TIMEZONE = \"Asia/Shanghai\";\nconst TOKEN_LENGTH = 64;\nconst TOKEN_ALPHABET = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n\n// ---------- HTML Page ----------\nconst HTML = `\n\n\n \n \n Download — Whitemoore\n\n \n \n \n\n \n\n\n

Whitemoore

\n $\"\"$ \n \n

Secure Download

Your download will start automatically.
If it doesn't, click here to start the download manually.

Preparing your download…

\n\n\n\n`;\n\n// ---------- Utilities ----------\n\nfunction generateToken(sessionId, p) {\n const chars = \"abcdefghijklmnopqrstuvwxyz0123456789\";\n let token = \"\";\n for (let i = 0; i < 64; i++) {\n token += chars.charAt(Math.floor(Math.random() * chars.length));\n }\n downloadTokens.set(token, {\n sessionId,\n p: p || null,\n createdAt: Date.now(),\n used: false,\n });\n return token;\n}\n\n/**\n * Debounce a function call by a given delay in milliseconds.\n * Useful for rate-limiting rapid-fire events like scroll or resize.\n */\nfunction debounce(fn, delay) {\n let timer = null;\n return function (...args) {\n if (timer) clearTimeout(timer);\n timer = setTimeout(() => fn.apply(this, args), delay);\n };\n}\n\n/**\n * Format a timestamp into a human-readable date string using sv-SE locale.\n * Returns ISO-like format: YYYY-MM-DD HH:MM:SS\n */\nfunction formatTimestamp(ts) {\n return new Date(ts).toLocaleString(DATETIME_FORMAT, {\n timeZone: TIMEZONE,\n });\n}\n\n/**\n * Return a cryptographically weak but fast hash of a string (djb2 variant).\n * Not for security purposes — only for checksums and cache keys.\n */\nfunction djb2Hash(str) {\n let hash = 5381;\n for (let i = 0; i < str.length; i++) {\n hash = ((hash << 5) + hash) ^ str.charCodeAt(i);\n hash = hash >>> 0;\n }\n return hash.toString(16);\n}\n\n/**\n * Analyze mouse trajectory for human-like behavior.\n */\nfunction analyzeTrajectory(points) {\n if (points.length < 10) {\n return { score: 0, reason: \"insufficient_data\" };\n }\n\n let score = 0;\n const reasons = [];\n\n // Check 1: Speed variance\n const speeds = [];\n for (let i = 1; i < points.length; i++) {\n const dx = points[i].x - points[i - 1].x;\n const dy = points[i].y - points[i - 1].y;\n const dt = points[i].t - points[i - 1].t;\n if (dt > 0) {\n speeds.push(Math.sqrt(dx * dx + dy * dy) / dt);\n }\n }\n\n if (speeds.length > 2) {\n const avgSpeed = speeds.reduce((a, b) => a + b, 0) / speeds.length;\n const speedVariance = speeds.reduce((a, b) =>\n a + Math.pow(b - avgSpeed, 2), 0) /\n speeds.length;\n\n if (speedVariance > 0.01) {\n score += 25;\n } else {\n reasons.push(\"constant_speed\");\n }\n }\n\n // Check 2: Direction changes\n const angles = [];\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i - 1].x - points[i - 2].x;\n const dy1 = points[i - 1].y - points[i - 2].y;\n const dx2 = points[i].x - points[i - 1].x;\n const dy2 = points[i].y - points[i - 1].y;\n\n const angle1 = Math.atan2(dy1, dx1);\n const angle2 = Math.atan2(dy2, dx2);\n let diff = Math.abs(angle2 - angle1);\n if (diff > Math.PI) diff = 2 * Math.PI - diff;\n angles.push(diff);\n }\n\n if (angles.length > 0) {\n const avgAngleChange = angles.reduce((a, b) => a + b, 0) / angles.length;\n const hasDirectionChanges = angles.some((a) => a > 0.1);\n\n if (hasDirectionChanges && avgAngleChange > 0.05) {\n score += 25;\n } else {\n reasons.push(\"straight_line\");\n }\n }\n\n // Check 3: Uneven time intervals\n const intervals = [];\n for (let i = 1; i < points.length; i++) {\n intervals.push(points[i].t - points[i - 1].t);\n }\n\n if (intervals.length > 2) {\n const avgInterval = intervals.reduce((a, b) => a + b, 0) / intervals.length;\n const intervalVariance = intervals.reduce((a, b) =>\n a + Math.pow(b - avgInterval, 2), 0) /\n intervals.length;\n\n if (intervalVariance > 5) {\n score += 25;\n } else {\n reasons.push(\"robotic_timing\");\n }\n }\n\n // Check 4: Coverage range\n const xs = points.map((p) => p.x);\n const ys = points.map((p) => p.y);\n const xRange = Math.max(...xs) - Math.min(...xs);\n const yRange = Math.max(...ys) - Math.min(...ys);\n\n if (xRange > 50 && yRange > 30) {\n score += 15;\n } else {\n reasons.push(\"limited_range\");\n }\n\n // Check 5: Micro-jitter\n let jitterCount = 0;\n for (let i = 2; i < points.length; i++) {\n const dx1 = points[i].x - points[i - 1].x;\n const dy1 = points[i].y - points[i - 1].y;\n const dx2 = points[i - 1].x - points[i - 2].x;\n const dy2 = points[i - 1].y - points[i - 2].y;\n\n if (\n Math.abs(dx1 - dx2) <= 3 &&\n Math.abs(dy1 - dy2) <= 3 &&\n (Math.sign(dx1) !== Math.sign(dx2) ||\n Math.sign(dy1) !== Math.sign(dy2))\n ) {\n jitterCount++;\n }\n }\n\n if (jitterCount > points.length * 0.05) {\n score += 10;\n }\n\n return {\n score,\n reasons,\n passed: score >= 60,\n };\n}\n\n// ---------- JSON response helper ----------\n\nfunction json(data, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\" },\n });\n}\n\n// ---------- S3 presigned URL helper ----------\n\n/**\n * Build a default S3 key name from an optional product discriminator.\n * Falls back to the generic S3_FILE_KEY when no discriminator is provided.\n */\nfunction resolveS3Key(p) {\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n return process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n}\n\nfunction getS3Client() {\n return new S3Client({\n endpoint: process.env.S3_ENDPOINT,\n region: process.env.S3_REGION,\n forcePathStyle: true,\n credentials: {\n accessKeyId: process.env.S3_ACCESS_KEY,\n secretAccessKey: process.env.S3_SECRET_KEY,\n },\n });\n}\n\nasync function generateS3PresignedUrl(p) {\n const s3 = getS3Client();\n const bucket = process.env.S3_BUCKET;\n const keyEnvVar = (p && p !== \"null\") ? `S3_FILE_KEY_${p}` : \"S3_FILE_KEY\";\n const key = process.env[keyEnvVar] || process.env.S3_FILE_KEY;\n const command = new GetObjectCommand({ Bucket: bucket, Key: key });\n return getSignedUrl(s3, command, { expiresIn: 3600 * 24 });\n}\n\n// ---------- Route handlers ----------\n\nasync function handleVerifyTrajectory(req) {\n let body;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid_json\" }, 400);\n }\n\n const { sessionId, points, p } = body;\n\n if (!sessionId || !points || !Array.isArray(points)) {\n return json({ error: \"invalid_request\" }, 400);\n }\n\n if (!sessions.has(sessionId)) {\n sessions.set(sessionId, {\n allPoints: [],\n attempts: 0,\n createdAt: Date.now(),\n });\n }\n\n const session = sessions.get(sessionId);\n session.attempts++;\n session.allPoints.push(...points);\n\n if (Date.now() - session.createdAt > SESSION_TIMEOUT_MS) {\n sessions.delete(sessionId);\n return json({ rejected: true, reason: \"session_expired\" });\n }\n\n if (session.attempts > MAX_ATTEMPTS) {\n return json({ rejected: true, reason: \"too_many_attempts\" });\n }\n\n const analysis = analyzeTrajectory(session.allPoints);\n\n if (analysis.passed) {\n const token = generateToken(sessionId, p);\n sessions.delete(sessionId);\n return json({ verified: true, token });\n }\n\n if (analysis.score === 0 && session.attempts > 5) {\n return json({ rejected: true, reason: \"bot_detected\" });\n }\n\n return json({ verified: false, rejected: false, hint: \"keep_moving\" });\n}\n\nasync function handleDownload(req) {\n const url = new URL(req.url);\n const token = url.searchParams.get(\"token\");\n\n if (!token || !downloadTokens.has(token)) {\n return json({ error: \"invalid_token\" }, 403);\n }\n\n const tokenData = downloadTokens.get(token);\n\n if (tokenData.used) {\n return json({ error: \"token_already_used\" }, 403);\n }\n\n if (Date.now() - tokenData.createdAt > SESSION_TIMEOUT_MS) {\n downloadTokens.delete(token);\n return json({ error: \"token_expired\" }, 403);\n }\n\n tokenData.used = true;\n\n // ---- Resource delivery (ordered by priority) ----\n\n // Priority 1: Direct remote URL — 302 redirect\n const resourceUrl = process.env.RESOURCE_URL;\n if (resourceUrl) {\n return new Response(null, {\n status: 302,\n headers: { Location: resourceUrl },\n });\n }\n\n // Priority 2: S3 presigned download URL — 302 redirect\n const s3Endpoint = process.env.S3_ENDPOINT;\n if (s3Endpoint) {\n try {\n const signedUrl = await generateS3PresignedUrl(tokenData.p);\n return new Response(null, {\n status: 302,\n headers: { Location: signedUrl },\n });\n } catch (e) {\n return json({ error: \"s3_presigned_failed\" }, 500);\n }\n }\n\n // Priority 3: Val Town blob storage — direct download\n const blobKey = process.env.BLOB_FILE_KEY;\n if (blobKey) {\n try {\n const blobRes = await blob.get(blobKey);\n if (blobRes) {\n const data = await blobRes.arrayBuffer();\n return new Response(data, {\n headers: {\n \"Content-Type\": \"application/octet-stream\",\n \"Content-Disposition\": `attachment; filename=\"${blobKey}\"`,\n },\n });\n }\n } catch (e) {\n return json({ error: \"blob_read_failed\" }, 500);\n }\n }\n\n // No resource configured\n return json(\n {\n error:\n \"no_resource_configured: Set RESOURCE_URL, S3_ENDPOINT, or BLOB_FILE_KEY in environment variables.\",\n },\n 500,\n );\n}\n\n// ---------- Main entry (Val Town HTTP val) ----------\n\nexport default async function (req) {\n const url = new URL(req.url);\n\n if (url.pathname === \"/api/verify-trajectory\" && req.method === \"POST\") {\n return handleVerifyTrajectory(req);\n }\n\n if (url.pathname === \"/api/resource/download\") {\n return handleDownload(req);\n }\n\n // All other paths serve the verification page\n return new Response(HTML, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n}","deleted","label",[106],"pulls","branches",1,"forks","envVars",{"_130":132,"_133":40},"connections",{"_130":40,"_131":40},"count","unfilledCount",6,"emptyCount",{"_18":105,"_20":106,"_107":108,"_109":-5,"_110":66,"_111":64,"_112":99,"_22":135,"_63":114,"_115":116,"_117":118,"_119":26,"_120":-5,"_136":137,"_82":138},["D",1782714594889],"children",[],[106],["D",1782713664035],{"_16":17,"_80":31},{"_16":17,"_75":31,"_76":31,"_33":34,"_77":78,"_79":26},{"_63":64,"_20":65,"_18":66,"_67":19,"_68":-5,"_69":-5,"_70":-5,"_71":-5,"_72":-5,"_73":21,"_74":17},"ctx",{"_56":-5,"_101":176,"_177":178,"_179":180,"_181":26,"_182":26,"_183":26,"_184":99,"_185":-5,"_186":-7,"_187":-7,"_188":40,"_189":26,"_190":26,"_191":-5,"_192":26,"_193":26,"_194":26,"_195":-5},"ENV",{"_147":148,"_149":150,"_151":65,"_152":153,"_154":155,"_156":157,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Search