[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_117":-5,"_20":118,"_22":119,"_120":121,"_122":123,"_25":124,"_24":-5,"_125":-5,"_126":-5,"_127":53,"_128":129,"_130":44,"_131":-5,"_132":-5,"_133":134},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","jgwynne7_4bf3679b","name","Allendale","branchName","main","version","path","","project",{"_33":62,"_13":14,"_45":63,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":19,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":95,"_96":97,"_98":99,"_100":53},"tree",[57],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":56},"id","b2c4045a-950f-4dd4-a4f8-53a4a5ca43c0","new-file-8383.ts","fileId","74e33c06-9e06-11f1-8eca-1607ee4eb77e","parentId","branchId","51acda74-8396-4b36-b9e0-ca2ee66250fe","branchVersion",14,"latest",true,"createdAt",["D",1787388647779],2,"fileType","http","content","import { blob } from \"https://esm.town/v/std/blob\";\n\n// ── iTabs Allendale Square Directory — blob-backed, PIN-editable ──\n// Edit everything from the phone: tap \"edit\" in the footer, enter PIN.\n\nconst DKEY = \"directory-allendale\";\nconst AKEY = \"directory-allendale-attempts\";\nconst LOCK_MAX = 5; // fails before lockout\nconst LOCK_MS = 15 * 60 * 1000; // 15 minute lockout\n\nconst SEED = {\n title: \"Allendale Square\",\n headline: \"Order ahead. Skip the queue.\",\n subtitle: \"Every stall in the food court — tap to see the menu and order.\",\n whatsapp: \"61892263034\",\n pin: \"4826\", // CHANGE THIS in the editor after first login\n venues: [\n {\n code: \"LDU\",\n name: \"Lunches Down Under\",\n desc: \"Cafe · coffee, salads & lunches\",\n url: \"https://lunches-down-under-cafe.val.run/\",\n photo: \"\",\n },\n {\n code: \"UK\",\n name: \"Urban Kitchen\",\n desc: \"Cafe · coffee & hot food\",\n url: \"https://urban-kitchens-order.val.run/\",\n photo: \"\",\n },\n {\n code: \"ZA\",\n name: \"Zensaki\",\n desc: \"Japanese canteen · ramen & bento\",\n url: \"https://zensaki-allendale.val.run/\",\n photo: \"\",\n },\n {\n code: \"AKA\",\n name: \"Arirang Korean\",\n desc: \"Korean street food\",\n url: \"https://arirang-korean-allendale.val.run/\",\n photo: \"\",\n },\n {\n code: \"TCI\",\n name: \"Thali Contemporary Indian\",\n desc: \"Contemporary Indian\",\n url: \"https://thali-contemporary-indian-allendale.val.run/\",\n photo: \"\",\n },\n {\n code: \"CRC\",\n name: \"Chicken Rice Corner\",\n desc: \"Hainanese chicken & rice\",\n url: \"https://chicken-rice-corner-allendale.val.run/\",\n photo: \"\",\n },\n {\n code: \"LK\",\n name: \"Lee's Kitchen\",\n desc: \"Asian home-style\",\n url: \"https://lees-kitchen-allendale.val.run/\",\n photo: \"\",\n },\n ],\n};\n\nasync function getData(): Promise {\n try {\n const d = await blob.getJSON(DKEY);\n if (d && Array.isArray(d.venues)) return d;\n } catch (e) { /* fall through to seed */ }\n await blob.setJSON(DKEY, SEED);\n return SEED;\n}\n\nasync function getAttempts(): Promise {\n try {\n const a = await blob.getJSON(AKEY);\n if (a) return a;\n } catch (e) {}\n return {};\n}\n\nfunction jsonResponse(obj: any, status = 200): Response {\n return new Response(JSON.stringify(obj), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname;\n const ip = (req.headers.get(\"x-forwarded-for\") || \"unknown\").split(\",\")[0]\n .trim();\n\n // ── Public data (PIN stripped) ──\n if (path === \"/directory.json\") {\n const d = await getData();\n return jsonResponse({\n title: d.title,\n headline: d.headline,\n subtitle: d.subtitle,\n whatsapp: d.whatsapp,\n venues: d.venues,\n });\n }\n\n // ── Server-side pull of a stall's hero photo (best effort, silent fail) ──\n if (path === \"/pull\") {\n const u = url.searchParams.get(\"u\") || \"\";\n if (!u) return jsonResponse({ photo: \"\" });\n try {\n const base = u.replace(/\\/+$/, \"\");\n const r = await fetch(base + \"/menu.json\", {\n signal: AbortSignal.timeout(6000),\n });\n if (r.ok) {\n const m = await r.json();\n const p = m.hero || m.heroImage || m.banner ||\n (m.settings && m.settings.hero) || \"\";\n if (p) return jsonResponse({ photo: p });\n }\n } catch (e) { /* silent */ }\n return jsonResponse({ photo: \"\" });\n }\n\n // ── Unlock: verify PIN with per-IP lockout ──\n if (req.method === \"POST\" && path === \"/unlock\") {\n const body = await req.json().catch(() => ({}));\n const attempts = await getAttempts();\n const rec = attempts[ip] || { count: 0, until: 0 };\n const now = Date.now();\n if (rec.until && rec.until > now) {\n const wait = Math.ceil((rec.until - now) / 60000);\n return jsonResponse({ ok: false, locked: true, wait });\n }\n const d = await getData();\n if (String(body.pin || \"\") === String(d.pin)) {\n attempts[ip] = { count: 0, until: 0 };\n await blob.setJSON(AKEY, attempts);\n return jsonResponse({ ok: true });\n }\n rec.count = (rec.count || 0) + 1;\n if (rec.count >= LOCK_MAX) {\n rec.until = now + LOCK_MS;\n rec.count = 0;\n }\n attempts[ip] = rec;\n await blob.setJSON(AKEY, attempts);\n return jsonResponse({ ok: false, locked: false });\n }\n\n // ── Save: re-verify PIN server-side, then persist ──\n if (req.method === \"POST\" && path === \"/save\") {\n const body = await req.json().catch(() => ({}));\n const d = await getData();\n const attempts = await getAttempts();\n const rec = attempts[ip] || { count: 0, until: 0 };\n if (rec.until && rec.until > Date.now()) {\n return jsonResponse({ ok: false, error: \"locked\" }, 403);\n }\n if (String(body.pin || \"\") !== String(d.pin)) {\n return jsonResponse({ ok: false, error: \"bad-pin\" }, 403);\n }\n const next: any = {\n title: (body.title || d.title).toString().slice(0, 60),\n headline: (body.headline || d.headline).toString().slice(0, 100),\n subtitle: (body.subtitle || d.subtitle).toString().slice(0, 160),\n whatsapp: (body.whatsapp || d.whatsapp).toString().replace(/[^0-9]/g, \"\")\n .slice(0, 15),\n pin: body.newPin && String(body.newPin).length === 4\n ? String(body.newPin)\n : d.pin,\n venues: Array.isArray(body.venues)\n ? body.venues.slice(0, 40).map((v: any) => ({\n code: (v.code || \"\").toString().slice(0, 4),\n name: (v.name || \"\").toString().slice(0, 60),\n desc: (v.desc || \"\").toString().slice(0, 100),\n url: (v.url || \"\").toString().slice(0, 300),\n photo: (v.photo || \"\").toString().slice(0, 400000),\n about: (v.about || \"\").toString().slice(0, 400),\n hours: (v.hours || \"\").toString().slice(0, 60),\n gallery: Array.isArray(v.gallery)\n ? v.gallery.slice(0, 3).map((g: any) =>\n (g || \"\").toString().slice(0, 300000)\n )\n : [],\n }))\n : d.venues,\n };\n await blob.setJSON(DKEY, next);\n return jsonResponse({ ok: true });\n }\n\n // ── Serve the page ──\n return new Response(PAGE, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n}\n\nconst PAGE = `\n\n\n\n\nAllendale Square — Order Ahead\n\n\n\n

Underground

at Allendale Square

\n Allendale Square\n

Order ahead. Skip the queue.

\n \n\n

\n \n \n

Tap View menu to browse and order ahead from your phone — no app to download. Your order is ready when you arrive, so you skip the queue.

\n \n \n

\n\n

Owner access

\n Enter PIN\n \n

\n \n \n

\n\n

Edit directory

\n Directory title\n \n Headline\n \n Subtitle\n \n WhatsApp number (for \"+ your stall\")\n \n Change PIN (leave blank to keep)\n \n Stalls\n

\n \n

\n \n \n

\n\n\n\n`;","deleted",false,"label","allendale-square-food",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":60,"_18":61},["D",1787388647779],"children",[],[35],"a9fdc829-b0da-4aad-b4a2-ee86b39720a1",["D",1787180715377],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","9e73754f-780d-46b7-924e-110519305b47","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d76ed-e14a-727a-b612-7191b6d5a9b7","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_116":112},"org",{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},"branch",{"_17":42,"_13":16,"_33":40,"_101":62,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","iTabs-Menu","avatar","https://avatars.githubusercontent.com/u/177847225?v=4","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":62,"_13":14,"_45":150,"_64":-5,"_65":53,"_66":67,"_68":67,"_69":19,"_70":-5,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":-5,"_82":-5,"_83":-5,"_84":-5,"_85":86,"_87":86,"_88":89,"_90":89,"_91":89,"_92":86,"_93":86,"_94":151,"_96":152,"_98":153,"_100":53},[147],"files",[147],"counts",{"_137":78,"_138":139,"_140":78,"_31":141,"_142":143},[135],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_18":136},[35],"pulls","branches",1,"forks",{"_144":78,"_146":78},"connections",{"_144":78,"_145":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":58,"_17":47,"_48":49,"_50":51,"_52":53,"_54":55,"_59":148,"_18":149},[],[35],["D",1787180715377],{"_11":12,"_116":112},{"_11":12,"_109":110,"_111":112,"_71":72,"_113":114,"_115":53},{"_17":42,"_13":16,"_33":40,"_101":62,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":-5,"_107":14,"_108":12},"ctx",{"_94":-5,"_132":187,"_188":189,"_190":191,"_192":53,"_193":53,"_194":53,"_195":44,"_196":-5,"_197":-7,"_198":-7,"_199":78,"_200":53,"_201":53,"_202":-5,"_203":53,"_204":53,"_205":53,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":16,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code