${ok ? \"✓ Verified\" : \"✗ Access denied\"}

${\n ok\n ? \"You're verified. Return to MotiveWave — the zones will load automatically.\"\n : (okMsg ?? \"You need the required role in the Discord server.\")\n }

`;\n return new Response(html, {\n status: ok ? 200 : 403,\n headers: { \"Content-Type\": \"text/html\" },\n });\n}\n\n// ── HTTP handler ─────────────────────────────────────────────────────────────\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n const cors = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, X-Upload-Token, X-Session\",\n };\n const json = (\n obj: unknown,\n status = 200,\n extra: Record = {},\n ) =>\n new Response(JSON.stringify(obj), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...cors, ...extra },\n });\n\n if (req.method === \"OPTIONS\") return new Response(null, { headers: cors });\n if (path === \"/health\") {\n return json({ ok: true, ts: new Date().toISOString() });\n }\n\n const redirectUri = `${url.origin}/discord/callback`;\n\n // Public config for the JAR's IPC handshake (client_id is not secret).\n if (path === \"/discord/config\" && req.method === \"GET\") {\n return json({ clientId: env(\"DISCORD_CLIENT_ID\"), scopes: [\"identify\"] });\n }\n\n // Browser flow: kick off Discord OAuth.\n if (path === \"/discord/login\" && req.method === \"GET\") {\n const state = url.searchParams.get(\"state\") ?? crypto.randomUUID();\n const auth = new URL(\"https://discord.com/oauth2/authorize\");\n auth.searchParams.set(\"client_id\", env(\"DISCORD_CLIENT_ID\"));\n auth.searchParams.set(\"response_type\", \"code\");\n auth.searchParams.set(\"scope\", \"identify\");\n auth.searchParams.set(\"redirect_uri\", redirectUri);\n auth.searchParams.set(\"state\", state);\n return Response.redirect(auth.toString(), 302);\n }\n\n // Browser flow: Discord redirects back here with a code.\n if (path === \"/discord/callback\" && req.method === \"GET\") {\n const code = url.searchParams.get(\"code\");\n const state = url.searchParams.get(\"state\") ?? \"\";\n if (!code) return resultPage(\"Missing authorization code.\");\n try {\n const session = await verifyAndMint(code, redirectUri);\n if (!session) {\n return resultPage(\"You need the required role in the Discord server.\");\n }\n if (state) {\n await blob.setJSON(`pending_${state}`, {\n token: session,\n ts: Date.now(),\n });\n }\n return resultPage(null);\n } catch (e) {\n return resultPage(`Verification error: ${(e as Error).message}`);\n }\n }\n\n // Client polls this after opening the browser; returns the session once ready.\n if (path === \"/discord/poll\" && req.method === \"GET\") {\n const state = url.searchParams.get(\"state\") ?? \"\";\n if (!state) return json({ error: \"missing state\" }, 400);\n const rec: any = await blob.getJSON(`pending_${state}`).catch(() => null);\n if (!rec) return json({ pending: true });\n await blob.delete(`pending_${state}`).catch(() => {});\n return json({ token: rec.token });\n }\n\n // IPC flow: JAR obtained a code over Discord IPC and posts it here.\n if (path === \"/discord/verify\" && req.method === \"POST\") {\n let b: any;\n try {\n b = await req.json();\n } catch {\n return json({ error: \"invalid JSON\" }, 400);\n }\n if (!b.code) return json({ error: \"missing code\" }, 400);\n try {\n const session = await verifyAndMint(b.code, b.redirectUri ?? redirectUri);\n if (!session) return json({ error: \"role required\" }, 403);\n return json({ token: session });\n } catch (e) {\n return json({ error: (e as Error).message }, 500);\n }\n }\n\n // Debug: live conversion inputs (not gated; reveals no zones).\n if (path === \"/quote\" && req.method === \"GET\") {\n const stored: any = (await blob.getJSON(LEVELS_KEY).catch(() => null)) ??\n {};\n const c = await computeRatio(stored.ratio);\n return json({\n futSym: FUT_SYMBOL,\n etfSym: ETF_SYMBOL,\n fut: c.fut,\n etf: c.etf,\n rawRatio: c.raw,\n ratio: c.ratio,\n source: c.source,\n error: c.error ?? null,\n ts: new Date().toISOString(),\n });\n }\n\n // GET /: zones + live ratio. Gated by Discord session OR admin upload token.\n if (req.method === \"GET\") {\n const admin = req.headers.get(\"X-Upload-Token\");\n const isAdmin = admin && admin === env(\"UPLOAD_TOKEN\");\n if (!isAdmin) {\n const okSession = await sessionValid(req.headers.get(\"X-Session\") ?? \"\");\n if (!okSession) return json({ error: \"unauthorized\" }, 401);\n }\n const data: any = await blob.getJSON(LEVELS_KEY).catch(() => null);\n if (!data) return json({ error: \"no levels uploaded yet\" }, 404);\n const c = await computeRatio(data.ratio);\n return json(\n {\n updated: data.updated,\n ratio: c.ratio,\n ratioSource: c.source,\n fut: c.fut,\n etf: c.etf,\n futSym: FUT_SYMBOL,\n etfSym: ETF_SYMBOL,\n w1d1: data.w1d1 ?? [],\n w7m60: data.w7m60 ?? [],\n w10m15: data.w10m15 ?? [],\n w50m1: data.w50m1 ?? [],\n },\n 200,\n { \"Cache-Control\": \"no-store\" },\n );\n }\n\n // POST /: upload strikes (admin only).\n if (req.method === \"POST\") {\n const token = req.headers.get(\"X-Upload-Token\");\n if (!env(\"UPLOAD_TOKEN\")) {\n return json({ error: \"server misconfigured: UPLOAD_TOKEN not set\" }, 500);\n }\n if (token !== env(\"UPLOAD_TOKEN\")) {\n return json({ error: \"invalid upload token\" }, 401);\n }\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"invalid JSON body\" }, 400);\n }\n for (const key of [\"w1d1\", \"w7m60\", \"w10m15\", \"w50m1\"]) {\n if (!(key in body)) return json({ error: `missing field: ${key}` }, 400);\n }\n const payload = {\n updated: new Date().toISOString(),\n ratio: typeof body.ratio === \"number\" && body.ratio > 0 ? body.ratio : 0,\n w1d1: body.w1d1,\n w7m60: body.w7m60,\n w10m15: body.w10m15,\n w50m1: body.w50m1,\n };\n await blob.setJSON(LEVELS_KEY, payload);\n return json({\n ok: true,\n updated: payload.updated,\n mode: payload.ratio > 0 ? `manual ${payload.ratio}` : \"live\",\n });\n }\n\n return json({ error: \"method not allowed\" }, 405);\n}","label",[72],"pulls","branches","forks","envVars",{"_264":98,"_266":20},"connections",{"_264":20,"_265":20},"count","unfilledCount","emptyCount",{"_41":249,"_13":72,"_70":71,"_51":-5,"_43":44,"_250":176,"_251":95,"_45":268,"_47":155,"_73":103,"_253":254,"_75":24,"_255":-5,"_269":270,"_227":271},["D",1785264698182],"children",[],[72],["D",1784974752616],{"_11":12,"_226":78},{"_11":12,"_222":78,"_77":78,"_25":76,"_223":224,"_225":24},{"_47":176,"_13":16,"_41":44,"_214":181,"_215":-5,"_216":-5,"_217":-5,"_218":-5,"_219":-5,"_220":14,"_221":12},"ctx",{"_59":-5,"_245":309,"_310":311,"_312":313,"_314":24,"_315":24,"_316":24,"_317":95,"_318":-5,"_319":-7,"_320":-7,"_321":20,"_322":24,"_323":24,"_324":-5,"_325":24,"_326":24,"_327":24,"_328":-5},"ENV",{"_280":281,"_282":283,"_284":16,"_285":286,"_287":288,"_289":290,"_291":292,"_293":294,"_295":296,"_297":298,"_299":300,"_301":302,"_303":304,"_305":306,"_307":308},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History