[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_253":254,"_255":256},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_157":158,"_33":-7,"_159":-5,"_17":160,"_161":162,"_163":164,"_165":166,"_167":168,"_48":-5,"_169":170,"_171":172,"_173":24,"_174":175,"_176":115,"_177":-5,"_178":-5,"_179":180},"routes/_app.x.$handle.$name.branch.$branch.history",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5},"handle","devanshsoni","name","email-val","branchName","main","project",{"_27":104,"_13":14,"_31":105,"_69":-5,"_106":24,"_107":108,"_109":108,"_110":111,"_112":-5,"_25":75,"_113":82,"_114":115,"_116":-5,"_117":-5,"_118":20,"_35":36,"_119":120,"_121":122,"_123":124,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_46":135,"_136":137,"_138":139,"_140":24},"page",0,"history",[26],"hasNext",false,"userId",{"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":47,"_48":49,"_50":-5,"_51":52,"_53":-5,"_54":55,"_56":57},"id","41119931-afb5-4db3-9f87-67a6674027ba","branchId","c5f4f437-88d8-4a48-b357-288ceb20e81b","createdAt",["D",1780944642915],"version",1,"orgId","019ea892-48c0-7519-9d28-313dd62dd2f4","parentId","incomingCommitId","0e83a6b2-4468-4a3b-9cf6-9fa0a673304e","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","clientLabel","user",{"_27":75,"_35":36,"_11":12,"_76":77},"file",{"_70":101,"_13":102,"_73":103,"_74":24},"pull","merge",{"_29":67,"_13":16,"_33":68,"_69":-5},"revert","multiple",{"_98":99,"_100":20},"commits",[58,59,60,61,62],{"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":47,"_48":49,"_50":-5,"_51":52,"_53":-5},{"_27":28,"_29":30,"_31":92,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":93,"_48":94,"_50":-5,"_51":95,"_53":-5},{"_27":28,"_29":30,"_31":85,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":86,"_48":87,"_50":-5,"_51":88,"_53":-5},{"_27":28,"_29":30,"_31":78,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":79,"_48":80,"_50":-5,"_51":81,"_53":-5},{"_27":28,"_29":30,"_31":63,"_33":34,"_35":36,"_37":-5,"_38":39,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":-5,"_46":64,"_48":65,"_50":-5,"_51":66,"_53":-5},["D",1780944642915],{"_27":75,"_35":36,"_11":12,"_76":77},{"_70":71,"_13":72,"_73":48,"_74":24},{"_29":67,"_13":16,"_33":68,"_69":-5},"d0ba382a-b9ae-4892-ac97-b2e7d367fda4",15,"deletedAt","fileId","019ea892-a3cd-76f8-9376-fb54999f69df","README.md","fileType","deleted","e90d7ea5-5d87-422e-8bd1-31d7904da8c9","avatar","https://lh3.googleusercontent.com/a/ACg8ocIGOIJ165XIual8KIVlgW7W9kVWyqLg2Rqi6-YSd_2fINxnGw=s96-c",["D",1780944642915],{"_27":75,"_35":36,"_11":12,"_76":77},{"_70":82,"_13":83,"_73":84,"_74":24},{"_29":67,"_13":16,"_33":68,"_69":-5},"019ea892-a3cd-76f8-9376-feecc3bebe49","api.ts","http",["D",1780944642915],{"_27":75,"_35":36,"_11":12,"_76":77},{"_70":89,"_13":90,"_73":91,"_74":24},{"_29":67,"_13":16,"_33":68,"_69":-5},"019ea892-a3cd-76f8-9377-037cc428d76c","crypto.ts","script",["D",1780944642915],{"_27":75,"_35":36,"_11":12,"_76":77},{"_70":96,"_13":97,"_73":91,"_74":24},{"_29":67,"_13":16,"_33":68,"_69":-5},"019ea892-a3cd-76f8-9377-07431e4082d7","db.ts","count",5,"deletedCount","019ea892-a3cd-76f8-9377-0bc6f6c8bbe4","inbox.ts","email","3d09e998-092a-4da8-8ad9-db9b9c83d2d6",["D",1780944642915],"legacyEnvVars","privacy","public","httpPrivacy","description","Relay 6-digit OTPs from forwarded emails to a browser extension","imageUrl","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","3d09e998092a4da88ad9db9b9c83d2d6","tursoHostname","3d09e998092a4da88ad9db9b9c83d2d6-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789500119686],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_156":77},"org",{"_11":12,"_151":152,"_76":77,"_25":75,"_153":154,"_155":24},"branch",{"_33":34,"_13":16,"_27":30,"_141":104,"_142":67,"_143":68,"_144":108,"_145":146,"_147":148,"_149":14,"_150":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","f91cdf72-9cdc-414c-838d-17edd2984586","forkedProjectOrgId","019e8fc0-9a70-73b8-a383-7d13f37931fb","projectName","userHandle","displayName","Devansh Soni","tier","free","canRestrictVals","profileImageUrl","path","","adoptOrgId",{"_27":104,"_13":14,"_31":248,"_69":-5,"_106":24,"_107":108,"_109":108,"_110":111,"_112":-5,"_25":75,"_113":82,"_114":115,"_116":-5,"_117":-5,"_118":20,"_35":36,"_119":120,"_121":122,"_123":249,"_125":-5,"_126":127,"_128":127,"_129":130,"_131":130,"_132":130,"_133":127,"_134":127,"_46":250,"_136":251,"_138":252,"_140":24},"tree",[227,228,229,230,231],"files",[227,228,229,230,231],"counts",{"_218":20,"_219":34,"_220":20,"_221":222,"_223":224},"contents",[189,190,191,192,193],"upstreamProject",{"_27":146,"_13":14,"_110":111,"_112":-5,"_107":108,"_46":187},"upstreamBranch",{"_27":67,"_31":181,"_182":183,"_13":16,"_141":146,"_33":68,"_142":-5,"_143":-5,"_184":185,"_69":-5,"_140":24,"_107":108,"_150":186,"_35":148,"_149":14},"emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1780528612426],"updatedAt",["D",1780941325718],"lockfileKey","1780941352929-esm.town_v_indenigrate_email-val@15-main","indenigrate",{"_11":186,"_156":188},"https://lh3.googleusercontent.com/a/ACg8ocJwD0RUE37HSMwrSwLEcHlgx6sHh2qmNBrvwUFvZmymKRTjQW8=s96-c",{"_27":214,"_13":72,"_70":71,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":215,"_33":20,"_73":48,"_198":216,"_74":24,"_200":-5,"_157":217},{"_27":210,"_13":83,"_70":82,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":211,"_33":20,"_73":84,"_198":212,"_74":24,"_200":-5,"_157":213},{"_27":206,"_13":90,"_70":89,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":207,"_33":20,"_73":91,"_198":208,"_74":24,"_200":-5,"_157":209},{"_27":202,"_13":97,"_70":96,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":203,"_33":20,"_73":91,"_198":204,"_74":24,"_200":-5,"_157":205},{"_27":194,"_13":102,"_70":101,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":197,"_33":20,"_73":103,"_198":199,"_74":24,"_200":-5,"_157":201},"c1e92998-111b-43e5-926e-c7415b4b8ae8","branchVersion","latest",["D",1780944642915],"content","// Email val: receives forwarded emails, extracts a 6-digit OTP, stores it.\n// Anything that isn't an OTP (e.g. Google's forwarding confirmation link) is\n// forwarded to your real inbox so you can act on it.\n// Learn more: https://docs.val.town/vals/email/\nimport { email } from \"https://esm.town/v/std/email\";\nimport { extractOtp, saveOtp } from \"./db.ts\";\nimport { encryptOtp } from \"./crypto.ts\";\n\ninterface Email {\n from: string;\n to: string[];\n subject?: string;\n text?: string;\n html?: string;\n attachments: File[];\n headers: Record;\n}\n\n/** Strip HTML tags to plain text as a fallback when no text body is present. */\nfunction htmlToText(html: string): string {\n return html\n .replace(//gi, \" \")\n .replace(//gi, \" \")\n .replace(/<[^>]+>/g, \" \")\n .replace(/ /gi, \" \")\n .replace(/\\s+/g, \" \");\n}\n\nexport default async function (e: Email) {\n const body = e.text?.trim() || (e.html ? htmlToText(e.html) : \"\");\n\n // --- THE NEW GUARD CLAUSE ---\n // Gmail's verification email contains a confirmation code. We must intercept\n // it before the regex extracts it, and forward it straight to your real inbox.\n const isVerification = e.from.includes(\"forwarding-noreply@google.com\") ||\n e.subject?.includes(\"Forwarding Confirmation\");\n\n if (isVerification) {\n console.log(\n \"Intercepted Gmail Forwarding Confirmation. Forwarding to owner.\",\n );\n await email({\n subject: `[ACTION REQUIRED] Fwd: ${\n e.subject ?? \"Gmail Forwarding Confirmation\"\n }`,\n text:\n `Click the confirmation link below to activate your Gmail forwarding rule:\\n\\n${body}`,\n html: e.html,\n });\n return;\n }\n // ----------------------------\n\n const haystack = `${e.subject ?? \"\"}\\n${body}`;\n const code = extractOtp(haystack);\n\n if (!code) {\n // Not an OTP — forward the whole message to your real inbox.\n console.log(\n `No OTP in email from ${e.from} (\"${\n e.subject ?? \"\"\n }\") — forwarding to owner`,\n );\n await email({\n subject: `[OTP relay] Fwd: ${e.subject ?? \"(no subject)\"}`,\n text: `Forwarded from: ${e.from}\\n\\n${body}`,\n html: e.html,\n });\n return;\n }\n\n const token = Deno.env.get(\"OTP_API_TOKEN\");\n let codeToSave = code;\n\n if (token) {\n console.log(\"OTP_API_TOKEN found, encrypting OTP before storage...\");\n try {\n const encryptedData = await encryptOtp(code, token);\n codeToSave = JSON.stringify(encryptedData);\n } catch (err) {\n console.error(\"Encryption failed:\", err);\n // Fallback or handle error. Here we store plaintext if encryption fails,\n // but ideally we should throw. Let's throw.\n throw new Error(\"Failed to encrypt OTP\");\n }\n }\n\n await saveOtp(codeToSave, e.from, e.subject ?? null);\n console.log(`Stored OTP from ${e.from} (\"${e.subject ?? \"\"}\")`);\n}","label",[102],"f927e342-e5f6-4a5c-acd5-2a7a27ee767c",["D",1780944642915],"// Shared SQLite schema + helpers for the OTP relay.\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport const TTL_MS = 5 * 60 * 1000; // codes expire after 5 minutes\n\nexport interface OtpRecord {\n code: string;\n sender: string | null;\n subject: string | null;\n created_at: number;\n}\n\nexport async function initDb() {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS otp_codes (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n code TEXT NOT NULL,\n sender TEXT,\n subject TEXT,\n created_at INTEGER NOT NULL\n )`);\n}\n\n/** Delete any codes older than the TTL. Keeps the table small and enforces expiry. */\nexport async function purgeExpired() {\n await sqlite.execute({\n sql: \"DELETE FROM otp_codes WHERE created_at < ?\",\n args: [Date.now() - TTL_MS],\n });\n}\n\n/** Extract the first plausible 6-digit OTP from a block of text. */\nexport function extractOtp(text: string): string | null {\n if (!text) return null;\n // Match a standalone run of exactly 6 digits (not embedded in a longer number).\n // Allows an optional separator in the middle (e.g. \"123 456\" or \"123-456\").\n const match = text.match(/(? {\n await initDb();\n await purgeExpired();\n const cutoff = Date.now() - TTL_MS;\n const result = await sqlite.execute({\n sql:\n \"SELECT code, sender, subject, created_at FROM otp_codes WHERE created_at >= ? ORDER BY created_at DESC LIMIT 1\",\n args: [cutoff],\n });\n if (result.rows.length === 0) return null;\n const row = result.rows[0] as unknown as OtpRecord;\n const age = Date.now() - row.created_at;\n return { ...row, age_ms: age, expires_in_ms: TTL_MS - age };\n}\n",[97],"18004db9-709e-443b-8eef-928b571abf10",["D",1780944642915],"/**\n * Helper to encrypt the OTP using AES-GCM and a shared secret.\n */\nexport async function encryptOtp(text: string, token: string): Promise<{ encryptedHex: string, ivHex: string }> {\n // 1. Hash the token to create a robust 256-bit key\n const hash = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(token));\n const key = await crypto.subtle.importKey(\"raw\", hash, \"AES-GCM\", false, [\"encrypt\"]);\n\n // 2. Generate a random IV\n const iv = crypto.getRandomValues(new Uint8Array(12));\n\n // 3. Encrypt the text\n const encryptedBuf = await crypto.subtle.encrypt({ name: \"AES-GCM\", iv }, key, new TextEncoder().encode(text));\n\n // 4. Convert buffers to hex strings for safe storage in SQLite\n const toHex = (buf: ArrayBuffer) => Array.from(new Uint8Array(buf))\n .map(b => b.toString(16).padStart(2, '0'))\n .join('');\n\n return {\n encryptedHex: toHex(encryptedBuf),\n ivHex: toHex(iv.buffer)\n };\n}",[90],"4b62c04c-ba6f-479e-a1ac-fd533f7a5b76",["D",1780944642915],"// HTTP val: returns the latest non-expired OTP to the browser extension.\n// Learn more: https://docs.val.town/vals/http/\nimport { getLatestOtp } from \"./db.ts\";\n\n// When ANY CORS header is set, Val Town stops adding its defaults — so we set\n// the full set ourselves here.\nconst CORS_HEADERS: Record = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, Authorization, X-Auth-Token\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\nfunction json(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...CORS_HEADERS },\n });\n}\n\nexport default async function (req: Request): Promise {\n // Preflight\n if (req.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: CORS_HEADERS });\n }\n\n if (req.method !== \"GET\") {\n return json({ error: \"Method not allowed\" }, 405);\n }\n\n // Optional shared-secret gate. If OTP_API_TOKEN is set, callers must supply it\n // via the `X-Auth-Token` header or `?token=` query param. This keeps the\n // public endpoint from leaking codes to anyone who guesses the URL.\n const requiredToken = Deno.env.get(\"OTP_API_TOKEN\");\n if (requiredToken) {\n const url = new URL(req.url);\n const provided = req.headers.get(\"X-Auth-Token\") ??\n req.headers.get(\"Authorization\")?.replace(/^Bearer\\s+/i, \"\") ??\n url.searchParams.get(\"token\");\n if (provided !== requiredToken) {\n return json({ error: \"Unauthorized\" }, 401);\n }\n }\n\n const latest = await getLatestOtp();\n if (!latest) {\n return json({ code: null, message: \"No active OTP\" }, 404);\n }\n\n return json({\n code: latest.code,\n sender: latest.sender,\n subject: latest.subject,\n createdAt: latest.created_at,\n expiresInMs: latest.expires_in_ms,\n });\n}\n",[83],"ab4e42ab-3c38-4aca-92fd-b882adf4e1eb",["D",1780944642915],"# OTP Email → Browser Extension Relay\n\nSecurely relays 6-digit OTP codes from forwarded emails to a browser extension.\n\n## How it works\n\n```mermaid\nflowchart LR\n A[OTP email] -->|forward to val address| B[inbox.ts
Email Val]\n B -->|extract 6-digit code| C[(SQLite
otp_codes)]\n D[Browser extension] -->|GET /| E[api.ts
HTTP Val]\n E -->|read latest non-expired| C\n E -->|JSON code + CORS| D\n```\n\n## Files\n\n| File | Type | Role |\n|------|------|------|\n| `inbox.ts` | email | Receives forwarded emails, extracts the first 6-digit code, stores it with a timestamp. |\n| `api.ts` | http | Returns the most recent **non-expired** OTP as JSON, with full CORS headers. |\n| `db.ts` | script | Shared SQLite schema + helpers (`extractOtp`, `saveOtp`, `getLatestOtp`, `purgeExpired`). |\n\n## Setup\n\n1. **Forward OTP emails** to the email val's address (find it in the Val Town UI for `inbox.ts`, or in the `links.email` field). You can set up an auto-forward rule in Gmail/Outlook so codes arrive automatically.\n\n2. **(Recommended) Protect the endpoint.** The HTTP endpoint is public, so anyone with the URL could read your codes. Set an `OTP_API_TOKEN` env var and have your extension send it. When set, callers must provide it via:\n - `X-Auth-Token: ` header, **or**\n - `Authorization: Bearer ` header, **or**\n - `?token=` query param.\n\n 👉 Add OTP_API_TOKEN here: https://www.val.town/x/indenigrate/email-val/environment-variables?key=OTP_API_TOKEN\n\n## Expiry\n\nCodes expire **5 minutes** after they arrive (`TTL_MS` in `db.ts`). Expired rows are purged lazily on every read and write, so the store never serves a stale code.\n\n## API response\n\n`GET /` returns:\n\n```json\n{\n \"code\": \"614209\",\n \"sender\": \"no-reply@bank.example\",\n \"subject\": \"Your verification code\",\n \"createdAt\": 1780528667360,\n \"expiresInMs\": 297315\n}\n```\n\n- `404 { \"code\": null }` — no active OTP.\n- `401 { \"error\": \"Unauthorized\" }` — `OTP_API_TOKEN` is set and the caller didn't supply it.\n\n## Example: fetching from an extension\n\n```js\nconst res = await fetch(\"https://YOUR-ENDPOINT.web.val.run\", {\n headers: { \"X-Auth-Token\": \"your-secret-token\" },\n});\nconst { code } = await res.json();\n```\n",[72],"pulls","branches","forks","envVars",{"_98":34,"_226":34},"connections",{"_98":20,"_225":20},"unfilledCount","emptyCount",{"_27":214,"_13":72,"_70":71,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":245,"_33":20,"_73":48,"_198":216,"_74":24,"_200":-5,"_233":246,"_157":247},{"_27":210,"_13":83,"_70":82,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":242,"_33":20,"_73":84,"_198":212,"_74":24,"_200":-5,"_233":243,"_157":244},{"_27":206,"_13":90,"_70":89,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":239,"_33":20,"_73":91,"_198":208,"_74":24,"_200":-5,"_233":240,"_157":241},{"_27":202,"_13":97,"_70":96,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":236,"_33":20,"_73":91,"_198":204,"_74":24,"_200":-5,"_233":237,"_157":238},{"_27":194,"_13":102,"_70":101,"_37":-5,"_29":30,"_195":34,"_196":115,"_31":232,"_33":20,"_73":103,"_198":199,"_74":24,"_200":-5,"_233":234,"_157":235},["D",1780944642915],"children",[],[102],["D",1780944642915],[],[97],["D",1780944642915],[],[90],["D",1780944642915],[],[83],["D",1780944642915],[],[72],["D",1780944642915],["D",1789500119686],{"_11":12,"_156":77},{"_11":12,"_151":152,"_76":77,"_25":75,"_153":154,"_155":24},{"_33":34,"_13":16,"_27":30,"_141":104,"_142":67,"_143":68,"_144":108,"_145":146,"_147":148,"_149":14,"_150":12},"ctx",{"_46":-5,"_178":286,"_287":288,"_289":290,"_291":24,"_292":24,"_293":24,"_294":115,"_295":-5,"_296":-7,"_297":-7,"_298":20,"_299":24,"_300":24,"_301":-5,"_302":24,"_303":24,"_304":24,"_305":-5},"ENV",{"_257":258,"_259":260,"_261":16,"_262":263,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":275,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History