[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_152":153,"_154":155},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","g","name","unlock","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_18":55},"id","05e3e649-d74f-4d50-93e0-d5bb63b35ee1","main.ts","fileId","f838a57a-ab92-11f1-b3b4-1607ee4eb77e","parentId","branchId","a36b1d64-7eb8-498a-972a-d6cb0f9d107d","branchVersion",3,"latest",true,"createdAt",["D",1788879178227],2,"fileType","http","content","import { Hono } from \"npm:hono\";\nimport type { Context } from \"npm:hono\";\n\nconst app = new Hono();\n\n// env variables: TOKEN and P2_URL\n// - TOKEN is required (a short alphanumeric secret)\n// - P2_URL is the webhook trigger that unlocks the phone\n\nfunction env(c: Context, name: string): string | undefined {\n const e = c.env as Record | undefined;\n if (e && typeof e[name] === \"string\" && e[name].length > 0) return e[name];\n if (typeof Deno !== \"undefined\" && Deno.env) {\n const v = Deno.env.get(name);\n if (v) return v;\n }\n return undefined;\n}\n\nfunction safeEqual(a: string, b: string): boolean {\n const ab = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (ab.length !== bb.length) return false;\n let diff = 0;\n for (let i = 0; i < ab.length; i++) diff |= ab[i] ^ bb[i];\n return diff === 0;\n}\n\nfunction wantsMarkdown(c: Context): boolean {\n const ua = (c.req.header(\"user-agent\") ?? \"\").toLowerCase();\n if (\n /(curl|wget|httpie|python-requests|powershell|insomnia|postman|http-client|node-fetch|axios)/i\n .test(ua)\n ) {\n return true;\n }\n const accept = c.req.header(\"accept\") ?? \"\";\n if (!accept) return false;\n const score = (entry: string) => {\n const [mimeRaw, ...params] = entry.split(\";\");\n const qParam = params.find((p) => p.trim().toLowerCase().startsWith(\"q=\"));\n const q = qParam ? parseFloat(qParam.trim().slice(2)) : 1;\n return { mime: mimeRaw.trim().toLowerCase(), q };\n };\n const entries = accept.split(\",\").map(score);\n const md = entries.find((t) => t.mime === \"text/markdown\");\n if (!md || md.q === 0) return false;\n const html = entries.find((t) =>\n t.mime === \"text/html\" || t.mime === \"text/*\" || t.mime === \"*/*\"\n );\n if (!html) return true;\n return md.q >= html.q;\n}\n\nasync function relayUnlock(c: Context, token: string): Promise {\n const expected = env(c, \"TOKEN\");\n const p2 = env(c, \"P2_URL\");\n\n if (!expected || !p2) {\n return c.text(\"server misconfigured\", 500);\n }\n if (!token || !safeEqual(token, expected)) {\n return c.text(\"unauthorized\", 401);\n }\n\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), 15000);\n try {\n return await fetch(p2, { method: \"GET\", signal: controller.signal });\n } catch (err) {\n if (err instanceof Error && err.name === \"AbortError\") {\n return c.text(\"unlock timed out\", 504);\n }\n return c.text(\"unlock failed\", 502);\n } finally {\n clearTimeout(timer);\n }\n}\n\nconst PAGE = `\n\n\n\n\nUnlock\n\n\n\n\n

\n \n

Unlock

Enter your key to unlock the phone.

\n \n \n

A correct key triggers the unlock.

\n \n\n`;\n\nfunction markdownPage(c: Context): string {\n const base = new URL(c.req.url).origin;\n return `# Unlock\n\nUnlock the phone by sending your key to the unlock endpoint.\n\n## POST\n\n curl -X POST ${base}/unlock \\\\\n -H 'content-type: application/json' \\\\\n -d '{\"token\":\"YOUR_KEY\"}'\n\n## GET\n\n curl \"${base}/unlock?token=YOUR_KEY\"\n\nA successful unlock relays the trigger and returns \\`ok\\`.\n`;\n}\n\nfunction extractToken(c: Context): string {\n const q = c.req.query(\"token\");\n if (q) return q;\n\n const auth = c.req.header(\"authorization\") ?? \"\";\n if (auth.toLowerCase().startsWith(\"bearer \")) {\n return auth.slice(7).trim();\n }\n\n return \"\";\n}\n\n// Serve the UI or markdown depending on the client.\napp.get(\"/\", (c) => {\n if (wantsMarkdown(c)) {\n c.header(\"content-type\", \"text/markdown; charset=utf-8\");\n return c.body(markdownPage(c));\n }\n c.header(\"content-type\", \"text/html; charset=utf-8\");\n return c.body(PAGE);\n});\n\n// Unlock: GET or POST, token accepted via query, JSON body, or Bearer header.\napp.get(\"/unlock\", (c) => relayUnlock(c, extractToken(c)));\napp.post(\"/unlock\", async (c) => {\n const q = c.req.query(\"token\");\n let token = q ?? \"\";\n if (!token) {\n const ct = (c.req.header(\"content-type\") ?? \"\").toLowerCase();\n if (ct.includes(\"application/json\")) {\n try {\n const body = await c.req.json();\n token = (body && typeof body === \"object\" && \"token\" in body)\n ? String(body.token)\n : \"\";\n } catch {\n token = \"\";\n }\n } else if (ct.includes(\"application/x-www-form-urlencoded\")) {\n const body = await c.req.parseBody();\n token = typeof body === \"object\" && body !== null && \"token\" in body\n ? String(body.token)\n : \"\";\n }\n }\n return relayUnlock(c, token);\n});\n\nexport default app.fetch;","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_58":59,"_18":60},["D",1788879178227],"children",[],[35],"309013d4-b23e-45f8-a813-03b77ec37e3f",["D",1788878314083],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","8d6857d3-cf1c-4e98-a094-0e379c10badf","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","4f4797d6-1767-45ca-8dc5-5113174ca1c1","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvdXBsb2FkZWQvaW1nXzJqRlBqSjdFTUlTVmVORmpObmFqZmJLVWh5VCJ9","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":148,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":37,"_73":44,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":149,"_95":150,"_97":151,"_99":53},[145],"files",[145],"counts",{"_135":77,"_136":137,"_138":77,"_31":139,"_140":141},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_18":134},[35],"pulls","branches",1,"forks",{"_142":47,"_144":77},"connections",{"_142":77,"_143":77},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":14,"_58":146,"_18":147},[],[35],["D",1788878314083],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":185,"_186":187,"_188":189,"_190":53,"_191":53,"_192":53,"_193":44,"_194":-5,"_195":-7,"_196":-7,"_197":77,"_198":53,"_199":53,"_200":-5,"_201":53,"_202":53,"_203":53,"_204":-5},"ENV",{"_156":157,"_158":159,"_160":16,"_161":162,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code