${escapeHtml(name)}

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":-7,"_18":19,"_17":-7,"_118":-5,"_20":119,"_22":120,"_121":122,"_123":124,"_26":125,"_24":126,"_127":-5,"_128":-5,"_129":52,"_130":131,"_132":43,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","kertmannik","name","ride-tracker","branchName","main","version","path","ride-tracker.ts","project",{"_33":60,"_13":14,"_44":61,"_62":-5,"_63":52,"_64":65,"_66":65,"_67":68,"_69":-5,"_70":71,"_72":36,"_73":43,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":81,"_82":83,"_84":85,"_86":-5,"_87":88,"_89":88,"_90":91,"_92":91,"_93":91,"_94":88,"_95":88,"_96":97,"_98":99,"_100":101,"_102":52},"tree",[55],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","f6fb23b5-093a-4023-a433-d16e0197f9c2","fileId","66de21ce-aa19-11f1-8645-1607ee4eb77e","parentId","branchId","f3570f90-a8a4-4eda-8e10-278f1c7d3253","branchVersion",11,"latest",true,"createdAt",["D",1789416296818],7,"fileType","http","content","/**\n * Ride Tracker — Val Town HTTP val\n * ================================\n *\n * One-file live GPS tracker, reusable across many trips: GPSLogger on Android\n * sends points via GET, one viewer per trip follows them on a Leaflet map.\n * Each trip can have its own course line, uploaded as a GPX file — deploy this\n * val once, then set up any number of trips without touching the code.\n *\n * ONE-TIME SETUP\n * --------------\n * 1. Create a new HTTP val on val.town and paste this entire file into it.\n * 2. In Val Town: Settings → Environment variables → add two independent tokens\n * (48 random hex chars each, e.g. from: openssl rand -hex 24):\n * ADMIN_TOKEN = <...> — authorises /admin: create/delete trips, upload GPX\n * WRITE_TOKEN = <...> — authorises GPS point uploads only; this is the\n * one embedded in the GPSLogger URL on the phone\n *\n * PER-TRIP SETUP — https:///admin\n * ----------------------------------------\n * Open /admin, paste the ADMIN_TOKEN once (kept in that browser's localStorage),\n * then for each trip:\n * 1. Create it: enter a display name and a slug — or hit \"generate\" for\n * name-prefix + random chars, e.g. rattamaraton-a7f3k2x9. The slug IS the\n * read capability — only share the viewer link with your viewer.\n * 2. (Optional) Upload the course GPX (track- or route-type) with the file\n * picker. It is simplified server-side (~500 points) and drawn as the grey\n * course line; re-upload any time to replace it. Without a route the map\n * simply shows the live track.\n * Km markers are computed from the full GPX at upload: a numbered white\n * circle every km, a numbered dark circle every 10 km.\n * 3. Copy the ready-made GPSLogger URL and viewer link from the trip row.\n * Viewer link: https:///t/\n *\n * (The same works headless: POST the GPX to /t//route?key=.)\n *\n * Trips exist only if created in /admin: points or GPX sent to an unknown slug\n * are rejected with 404, so a typo'd GPSLogger profile fails loudly instead of\n * silently logging into a ghost trip.\n *\n * GPSLOGGER (F-Droid) CONFIGURATION — one profile per trip, profile name = trip name\n * ----------------------------------------------------------------------------------\n * Logging details → Log to custom URL → URL:\n *\n * https:///log/?key=&lat=%LAT&lon=%LON&ts=%TIME&acc=%ACC&spd=%SPD&batt=%BATT\n *\n * - HTTP Method: GET\n * - Logging interval: 60 seconds\n * - Also enable \"Log to GPX\" as a local backup\n * - Android Settings → Battery → GPSLogger → Unrestricted (battery optimisation\n * exemption). Verify with a 4-hour stationary test before the ride.\n *\n * %TIME is ISO 8601 UTC and is parsed server-side; %SPD is m/s (converted to\n * km/h on the map page); %BATT is battery percent.\n */\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\n\n// favicon.png embedded as base64 (the val must stay a single file)\nconst FAVICON_B64 =\n \"iVBORw0KGgoAAAANSUhEUgAAAIAAAACACAYAAADDPmHLAAAACXBIWXMAAB2HAAAdhwGP5fFlAAAAGXRFWHRTb2Z0d2FyZQB3d3cuaW5rc2NhcGUub3Jnm+48GgAAFcdJREFUeJztnXt0VdWdx7+/fd8hL5IARoRQdAyDlWecGURM0EgBG6W2gkrFsrTG+Bim2nG1a+rMpfQx01WV6QgYLNrBMmiY6aq5gLyEgCCtNREfMMAoEIIgYiA3JCT3dX7zR3LJfZxz7jn3nhtz4XzWci3ZZ5/v/t3f+WW/zt77ACYmJiYmJiYmJiYmlxek94YpP5ji8uV1VRN4ARilvckHwbzafn7Qyr3P7+1KxaC766a4OvyDqolpAdCjz+CDBFo9yNGxct3c1PRN+6PRFQA3PDOxXLJIa8EoVlA7JUG65333R7v06IaZtfq2ciKsBRT0gVMQdM/G+VuS0jftj0dozVjmHnePZJE2KxYOAIxiAbFlknv8XK26YW5fPeMeImyGsvMAoBgSb5n9aqVufdN+eTTVABPdE8sEpN1gODSq+jgkTW1a8lGjluyzV99WBsJuQKM+4CNBUzfM36JJ37RfmYQ1wNSnS3MEpDrNhQMAw0FC1E19ujQnUdY7Vt2RA0IdtDsPABwscd0dq+5IqG/ar07CAOhyOp4E42uaC+9jdHeWc1GiTEH7hSeB5PSDtu6E+qb96qg2ARPcE/ItzEcB5CdhAEDw2hEcvde9/6zc5TmvVOT7rbbk9QFvyCFGb567WVbftF/dfiBBDWCR+MGkCwcARp4PtgVKl302W2r6QJ7whxT1TfvV7QcSBAALzEu68F6IWVGD2Ah9UtQw7Ve3H1BpAia4J4yySHwEpH+yKAoGQ1hHNbobj0cmz3xl5ihhDR1Rs0FrCRbmUZ4F26L0TfvD6vL2h1GsAawST0u5cAA9GqGb4gq2hKYhdecBAIUE4vRN+8Pq8vaHUQwASWBiyoWHYRktYsP0mUWclml/ZAHKWooBQMAEo8onOWexcfoC8fqm/RFaKsGq3AlkDDfKAAZfGZdIZKA+4vVN+yOkZOzvRTkACHlGGQCmwTKpxulDRt+0vw95+wGoDwNTGd9GQ5AzwDh9cHr1L037Aag3AWyYAYAkW0I69U371fV7UasB2gw0QEaL0qxv2q9Fq38CgHEuPo2N/IHx+qb9fcjZ34taJ/CUUeWTrBYbpw8ZfdP+PikVLbU+wPtGGQBwU1wSkWH6LKdv2h8pFq/fi2IAMBlogBSvRUbqI/5hmPZHIGN/GOWpYNBuQ3qiDGZh2xObHApYdsOYnjRbmOP0TfvD6vL2h1EMgH3ufcdA+EvK5RP2yr2J2rRw0zFw6voA9sa+SQNM+8Mo2R9GfUkY4fVUDSDmunTqA0ir/iVtPxIEQAj0Mkh5CJG4dHj9fl6tdNkeDLwM+SGQVrwk7Ir6pv3q9gMJAmCfe18bS/zvSRsA/Pqjf/1I8Qf8cWFDG5CCPtOvN8zfoKhv2q9uP6BhVbCr2/ccCEd1F030qfNCd0Ljrf6s54Ak9EGfWgPOhPqm/eokDIA9vzp0XgqJb4Ggfc8Zwceh0Lw9vzp0PlHW+gfrzwuIbwE69AEfCcyrf7A+ob5pvzqatoa9v+T9DyDRAyD4NGTvJvB3te6qAYD192/+gBgPANr0mei7WnfVAKb9auhaczbpmXHTSNBrkFvA0MNJEOY1uj/YrUc3zO2vfmOaBOk1UtBn4CQzz9u0YFtS+qb98WjeHAoATUs+fNvennUNiBfldYZgkRgWiZHfGQSIF+WQ9+pknQcAG+7f/Ha2o+MaMC3Kau2GCEkQIQmDznYDTIu6goGrk3Weab88Sa86/eeZV0XNUv100wkjVsia+v2sr6sGMLn0MAPgMscMgMscMwAuc8wAuMwxA+AyxwyAy5y4sWPtj+cYuR7dZIBR/cs/Rj1zswa4zDED4DLHDAATExMTExMTk8sQQ99Rp4udwAgCngcwA0DC828V6ATwMYA1HcDK2dqWbyWkYfkts4jEiwBGpiTEPfaxwJoLftvK2X//piH2JWLAB0Dvw98HoMAoTQb22YBv3gh8lqrWrhWVxxgoMcKuixD2BVn65q0121O2LxEDfhjY+5dv2MPv1ZwQANZv1HfCtyycjj8ixgQrifUbfzMrZfsSMeADAD3VvuEQMCEb+L4BOhuMsCcOxoRsWyBl+xJhTXcBAxkG5gN4IRUNiXktEdVEJHUMEq5hZdWeC3p0drxUcZUI2lYCPMtI+xKRCTXAW+kSJuC6VDXKv5i2B0BLRFJ2J1+o0qsz/fsNJyBRdUxyyvYlYsAHgAB+hNQ2YIKBxTcDJPNfbqr2kdstgWN28TLdm4xWkIP9/jwGfADcBBxiYDyAdQDa9d7PwOJywG24YRGQRVobkzRzx/MVus7527lsxgirxfJSTPLHqVmWmIzoA5T3VLGKX8La9WLly8xYeDGBsLL8kW2x1WnauLl6e1PDispDhIvf8XMIp/UuAC8nunfnisre9RcyR/kxrTHOSnkGfA2gBUmS1kUlMO7a4a7o1+Am4LWYlHtSlHy/qCg/tkYwnEsiALIt3m0AIr+LU2S5wlbenzZYOBTTDPAt2166dViScu8HIVVdN3edP2XDEnBJBEBZdWOACG9EpjHj7v604aZHdxwCEHkcm8UeJD02dAD0DpgeLyoc/Hf9MQsIZEgfQAuSJK0jEn39APC3d7grHp/ubgj2lw3EeI0Jky5aALoXCcbx5TXbvtLp+EuiBgAGRjPALF5DVG+Op+xYMXNUf9qgl6Sj76m6g7Krh1tPGnbCKQCg8Er5T+Xe0fq4oeWkDaYflT+69d++ajOUuGRqgIEKk5TUpFB/YQZAmiHQ+N0vTE/7lG6ymAHQDwQt1pQ/AJku0j4KePb+cbryP/Xqh5ryRfaeG5ZXLiRSnHX7UjodLE7naKBh+W13EymfyCnA9zHjX4gM/QqIIWR8DbD7henXEcUNtUIR/18khtlvTlf5by+vHE3EUTN2BHyKiGPjGLi6ofa2yemyIRUyOgA2r54xKGSx1AHIikjuRuwiDZbSMim0w11hlQi/R/QXxHwhib4DxpuReQVLqU4Np4WMDgBnJy8DMDYyjUA1IKpFdOJ30vFugK6w/gLAlMg0Jn5y+mNb95HgmKlhupfd7gHn77T3AbS26XppWF65EOAHItMIWHtzzdbfvVc72dbJg8+iby1huBnYblT5u1ZUfoMZT0WmMbC+vPqtFXgECDlC60W31Yu+2uHKXVe8cxOAXUbZYAQDLiK1EtfuMw4Le1c10PNuACBP9HXjmoE9K2YMZeB3iPIfnQiG+Hvhjt70hQ3d4Oj3E5AG3pxAxgYAYtp9ISxzb3pwz8WzcYk5+hUx4dtGNAPsdosg+PcArohIDrEkLah8/K3WyLxSbDNA+M57tZNtqdpgJJkcABchUM20RzZ/EJmWZTm3BdHvBoYYMRrYNWz30wDfFpXIcFc89taOuMyfh7YB+CIipagjlFeZqg1GkvEBEG73Y9PT0Qw0LLv1BgCLY5J3ni4a/Eu5/NPdDUEC/icyTZAYUM1AZgdARLsvh5HNwNbayjwieh2APSL5S0uQ7ps7d11I6T6Jo5sBBua889wUVzI2pINMXg8Q1+7HkmU5t6VTihoNDEl2NOCQsIIJX4tIYjA9eNMTW0+q3Vde89but1+sbI7YPpbTMbRiVX39jx0AxgAoJqJsAGDmDgAnARwC0Ahge1NT07tut1vx27+pkrE1gFy7H4tRzcDO5ZUPMxBVdTOwtPzRrfUJ7SRwSLg2RaaJwNl7AdyFnjmMwcxsY2YbgMHo2QtwF4CfA9g7ceLE5vr6+l9u3LjxKr12a8Hw9QD9xbNzx2iyfdfyytuZsD4i6Yx0Onil1ncDu1+Yfl3IYnkX0aOOps6A7cZEO3g3btw4JBgM/swa+GLhoC9e6+v9kxXtxQ+Bya5ydxx+Zn5ZCPFMVVXVl3puVCNjawCt9I4GIjeWDKEhlmla7t3xSoUzaBFrEP3wOywcui/Rw/d4PPcFg8GDAB4O2obaJFvE/lYOwtr1qebf0IudiB5h5oNvvPGGYdPKl3wA9DYDUVW1ENoWa4pu21ICjY9MY9CjvQtAZamtrbXV19e/xMxrELGrOeD6q6h89guHtZggRyERra2vr3+xtrY25TmFSz4AgPjRACPxu4FdKyq/DXDMCIP+s6Jm66tK93g8nqzi4uI3ADwUey3gujbq31Z/C4Sk5ztTcVQXFxf/0ePxZCXOqkwqo4DzSP60jlTx6sncOxo4h55OFtDXDMRP3qBnmxZDWhmT/InFfuEJpTJqa2ttzPzfAGbJXQ9ZByNkGwJL4ExPAksYOfgCCq6eCoej5xgAn8+HQCAAr9eL1tZWdHZ2JvppswG8UVdXd/vcuXOT2kOQdA2QK7rOJs6VHnLFBV2doLLqxgAYUaMBpWZgh7vCCiGtRfShFD4S0jy1IWdxcfFyKDz8MPaiiVH/9p9pgsvlghACQgi4XC7k5uZixIgRmDBhAiZNmoTCwkLV38bMlQ6HI+mPSyYVAB6PZ/4Y2+kSK6VteKqIFSGMtX1+tcfj0bXMSpC2ZoCG2n4KYGp0Xn765urtTbF5w3g8nvmQqfbDuFwujB8/HtdMngNQ3+Cl88xB+DvPKNrscrkwZswYjBs3Dk6nUzEfET2i1x9hdAfAH/7wh0JmXuoiP8rszRgizqM/AsFKEoZYzqPM0QwHBcHMyz0eT5HW+12ibTMSjAZ2rKisIOKnY27dWP7IW/+hpBv2h9L13NxcXH/99cjOzoYtqxCDCksjrjLaT/wpoe05OTkYN24c8vLyFPPo9UcY3X0Aq9X6CwBFAOCgAMba+/YB5OXlYezYsRBCf8Vy7mgDPvvLiqi0vBE3wptzK7xe2Sa/gJkXA3hMi35ZdWNg5/JKDwgLwmm9zcAOANj1m1lDGIH/AmCJuO0zSQQfUFvLF+mPWOT8kTvyRnR+efDiv9ua96CoNPF5EjabDWPHjsWBAwcM8UcYXU+qdzbqe3LXnE4nSktLk3r4Pm8LTjatikqzZxdj+A0Po7S0VK36e8jj8Wg+nk2mGbirru5uCzOIrf5VACJ3oUiAWDC9ukGxv5GMP/KumgISfTHW3XYUvnZt2wCFEIb6A9AZAMFg8HFEvwy5SGlpKWw2/cNSKeTD8b1LwaG+TiwJG0be+AMIqws2mw3XXnut0u12Zq5RuhhLQWHBlvPe7vbDH53Gn7cfQcOGw8P2v/Knjp/PKTl1eP+Zqs72qLmdJeU1W1TfGSTjD6szF4OGfj0qzduyV+tPMNQfgI4AcLvdgpnny10rKipCdna2nnIvcrJxFXztJ6LShpd9H878vqP3cnJy1HrD99fV1VmULoZ5YtY1jtdXvbP03YZjOS1HzqHjvB+hoARmdvp9oWEtn57FnxuO4dCHp8ESdp8uHLxETS8Vf+SPjOpjou34nkTmR2GEP8Jo7gNMnjz5b5lZ9oVESYmGcxKlAGxtm2Fp2wnyNQMAAhgMR3srBFkg9bay+SOnIn9U/J7OkpIStLa2xqUDGO5yuSYDeFep6CdmXeMYzN1vgmi6monMjBNHz+Hkca9AVo4F0cvLo0jFH7nD/wYW628xJK8LhXkhOJ1HIA7cDXaOQii/AoH8GYBQr01T8UckmmsAZpZ1XnZ2tuoQBQAo2Arn0X+E7dRLEF2HQZIPJPlglz5HSXEAY7/mh93GsGcX48oy+aPxXC6X2l/VLWrlF8C3FIDqw49ECkk3cof3WbU8qfjDQhdw3TUhjLwigEEuCRYCiP0QXYdhO7USrqNPg4KyD/ciqfgjEj0BUCaXnmiiAlIAjuYlEN1HFbNkuSSUjgyiZMoTEFbltRIFBfIHhkqSpLjp4pnZV13PzA+rGxkPM2qe+cZIxT19qfrDaVGe5aPuI3A2/wyQAqpSyfgjFs0BQESyPY/cXPWT1mxtm1UffhiXM4RsPqiaR6ksIUSp7AUAQsJDSG7Cy0LEDypdTLc/qPsIbG1bVPMk449Y9MwDyG7Ut9vV32lb2ho0F+D79Lc4sG21ah6FqZDr+07biuZP24+g83ySR+1QzOLPaNLuD0vbTgQKble8rlQWM8sfqiCDnr8M2QYn0dCPfC2q1yNxOY2fUezuSmFPKKueAp52f4Q7y0qoBJvml3QDa00gG39cjpLie/P/OurfZWv+Vy7bV7ybN/1v6/WU0CGXGAiod1TYMUJzAV0+4wPA4UohxgnHVa6m3R+J8vr9ik2b4lvLWPR45xRkzu33+Xyqw55Q/nSIrv/TVIDj6ofw9RuU2zyv14uPP44/PZWIPqqqqpI9iOCfZ121FMAiTQbE6jKr9cLS7o9QvvoZV0oBQESaD2rSMwyUXcPU3q5+fG8gfwbYOTqxvnM0AoPVPw2g8BIEkiQpLtESIfotVCZ0VAgRWVYpXcxUf8SiZxj4nly6wmxURAk2dJf8RPVHs3M0ukt+ApB6B+rsWfk1KEq2AYB7S8vHAF5UN1JGE1jmfvP4AcXrGeqPWPQ0AbIvRjo7O9HV1QWXS3kCh62F6Br9K9jObYmaCmbnKITybu6J9AQ/tqurS22JlOpLG5GT96R03jsGwK2qhYTtBW37/MzQHwIn1LJlrD8i0RwATU1N706aNKkFQFzPpLm5GWPGjFEXIBsCBberjmvVOHbsmNKl401NTY1q97rX7fe7775uNnd4n2VGDaLf+UcSImDZ52eG/nBlY6Nqby6T/RGJnreBEgDZ48tbW1tx/rzmjqdu2tvb1aq7NVq2TrnX7fcvfvPEE8xiPEDPx+mAnxMkxi3edGJRoocPZL4/wugaaFqt1mUAZLuehw8fTjgESoZAIIBPPvlE6bIPwDI9eks2H9//000tT8amL9702VNqbb4cl4I/dAXA7NmzTzCz7HFs3d3dOHToECTJuNk8SZJw8OBBdHXJr58nopeqqqr65VRtOS4Ff+ieanI4HP8EQHaZlNfrxf79+w2J/EAggAMHDqgNq1oRv1e/38l0f+gOgJkzZ55lZsUNEu3t7fjwww9TagPDGkrjXABg5hojN0kmS6b7I+m51/r6+hcBqH6Xp7CwECUlJapDoki6urrQ3NyccCzNzMvuvPNOXceFz371NtV5/Y33b01pHjrT/BEm6Yny7u7ux5xO5zAAc5TytLa2orW1FdnZ2SgoKEBubi7sdvvFt1h+vx9+vx9erxdnz57VshUKRLQhJyfnH5K1O11kqj9SinqPx5PFPRsvZ6eio4P1RDSvqqpK11c5gQQ1AKNl44KtqX39G5nljzApvW+sqqq6cOrUqTnMrHuqVS/MvCwnJ+dbqfxYeWG0gCTdS8bkyER/GPb+1ePxzGPmF6CwSyYFzjDzY3feeee6xFkHDpniD8NWHFRVVb0eDAbHAFiOngmJVPER0Qt2u31Mpj18IHP8kZYvVnk8nuHM/Dh6vn6tfQVEDy1E9HsAy77KSR4jGcj+SOsny9xut5g8eXIZgFskSZoshChl5uHoW0/XAeAEMx/ufYW5vampqTGdx6J9lZj+MDExMTExMTExMTH56vl/TL4kyYklNcwAAAAASUVORK5CYII=\";\n\nconst MAX_POINTS_PER_TRIP = 5000;\nconst MAX_ROUTE_POINTS = 500;\nconst MAX_GPX_BYTES = 5_000_000;\nconst SLUG_RE = /^[a-z0-9][a-z0-9-]{4,63}$/;\n\nlet initPromise: Promise | undefined;\nfunction init(): Promise {\n if (!initPromise) {\n initPromise = (async () => {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS trips (\n slug TEXT PRIMARY KEY,\n name TEXT NOT NULL,\n created_at INTEGER NOT NULL,\n route TEXT,\n km_marks TEXT\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS points (\n trip_slug TEXT NOT NULL,\n ts INTEGER NOT NULL,\n lat REAL NOT NULL,\n lon REAL NOT NULL,\n acc REAL,\n speed REAL,\n batt REAL,\n PRIMARY KEY (trip_slug, ts)\n )`);\n // Upgrade path for a trips table created before the route column existed.\n for (const col of [\"route\", \"km_marks\"]) {\n try {\n await sqlite.execute(`ALTER TABLE trips ADD COLUMN ${col} TEXT`);\n } catch {\n // column already exists\n }\n }\n })();\n }\n return initPromise;\n}\n\nfunction tokenOk(\n given: string | null,\n envName: \"WRITE_TOKEN\" | \"ADMIN_TOKEN\",\n): boolean {\n const expected = Deno.env.get(envName);\n if (!expected || !given) return false;\n // Hash both sides so timingSafeEqual gets equal-length buffers.\n const a = createHash(\"sha256\").update(given).digest();\n const b = createHash(\"sha256\").update(expected).digest();\n return timingSafeEqual(a, b);\n}\n\n// std/sqlite rows are documented as objects keyed by column name, but accept\n// positional arrays too in case the client library changes shape.\nfunction rowVal(row: unknown, key: string, idx: number): unknown {\n return Array.isArray(row) ? row[idx] : (row as Record)[key];\n}\n\nfunction numOrNull(v: string | null): number | null {\n if (v === null || v === \"\") return null;\n const n = Number(v);\n return Number.isFinite(n) ? n : null;\n}\n\nfunction bad(msg: string): Response {\n return new Response(msg, { status: 400 });\n}\n\nfunction escapeHtml(s: string): string {\n return s.replace(/&/g, \"&\").replace(//g, \">\")\n .replace(/\"/g, \""\").replace(/'/g, \"'\");\n}\n\n// --- GPX parsing + Douglas-Peucker simplification (route uploads) ---\n\nfunction parseGpx(xml: string): [number, number][] {\n const pts: [number, number][] = [];\n const tag = /<(?:trkpt|rtept)\\b([^>]*)>/g;\n let m: RegExpExecArray | null;\n while ((m = tag.exec(xml)) !== null) {\n const la = /lat=\"([-\\d.]+)\"/.exec(m[1]);\n const lo = /lon=\"([-\\d.]+)\"/.exec(m[1]);\n if (!la || !lo) continue;\n const lat = parseFloat(la[1]);\n const lon = parseFloat(lo[1]);\n if (\n Number.isFinite(lat) && Number.isFinite(lon) && Math.abs(lat) <= 90 &&\n Math.abs(lon) <= 180\n ) {\n pts.push([lat, lon]);\n }\n }\n return pts;\n}\n\nfunction simplifyRoute(\n pts: [number, number][],\n maxPoints: number,\n): [number, number][] {\n // Pre-decimate huge tracks so the recursive pass stays shallow.\n if (pts.length > 5000) {\n const step = Math.ceil(pts.length / 5000);\n pts = pts.filter((_, i) => i % step === 0 || i === pts.length - 1);\n }\n const midLat = pts.reduce((s, p) => s + p[0], 0) / pts.length;\n const cosLat = Math.cos((midLat * Math.PI) / 180);\n const perpDist = (\n p: [number, number],\n a: [number, number],\n b: [number, number],\n ) => {\n const ax = a[1] * cosLat, ay = a[0], bx = b[1] * cosLat, by = b[0];\n const px = p[1] * cosLat, py = p[0];\n const dx = bx - ax, dy = by - ay;\n const len2 = dx * dx + dy * dy;\n if (len2 === 0) return Math.hypot(px - ax, py - ay);\n const t = Math.max(\n 0,\n Math.min(1, ((px - ax) * dx + (py - ay) * dy) / len2),\n );\n return Math.hypot(px - (ax + t * dx), py - (ay + t * dy));\n };\n const dp = (points: [number, number][], eps: number): [number, number][] => {\n if (points.length < 3) return points;\n let maxD = 0, idx = 0;\n for (let i = 1; i < points.length - 1; i++) {\n const d = perpDist(points[i], points[0], points[points.length - 1]);\n if (d > maxD) {\n maxD = d;\n idx = i;\n }\n }\n if (maxD <= eps) return [points[0], points[points.length - 1]];\n const left = dp(points.slice(0, idx + 1), eps);\n const right = dp(points.slice(idx), eps);\n return left.slice(0, -1).concat(right);\n };\n let eps = 0.00005; // degrees, ~5.5 m\n let out = dp(pts, eps);\n while (out.length > maxPoints) {\n eps *= 1.3;\n out = dp(pts, eps);\n }\n return out;\n}\n\n// Positions of every whole kilometre along the course, measured on the\n// full-resolution GPX. The simplified line cuts corners (about 1% shorter on a\n// 123 km course), so markers must not be derived from it. Index i = km i+1.\nconst MAX_KM_MARKS = 2000;\nfunction kmMarks(pts: [number, number][]): [number, number][] {\n const R = 6371000;\n const rad = (x: number) => (x * Math.PI) / 180;\n const marks: [number, number][] = [];\n let dist = 0;\n let next = 1000;\n for (let i = 1; i < pts.length && marks.length < MAX_KM_MARKS; i++) {\n const a = pts[i - 1], b = pts[i];\n const dLat = rad(b[0] - a[0]), dLon = rad(b[1] - a[1]);\n const h = Math.sin(dLat / 2) ** 2 +\n Math.cos(rad(a[0])) * Math.cos(rad(b[0])) * Math.sin(dLon / 2) ** 2;\n const seg = 2 * R * Math.asin(Math.sqrt(h));\n while (seg > 0 && dist + seg >= next && marks.length < MAX_KM_MARKS) {\n const t = (next - dist) / seg;\n marks.push([a[0] + t * (b[0] - a[0]), a[1] + t * (b[1] - a[1])]);\n next += 1000;\n }\n dist += seg;\n }\n return marks;\n}\n\n// --- Handlers ---\n\nasync function handleLog(slug: string, url: URL): Promise {\n if (!tokenOk(url.searchParams.get(\"key\"), \"WRITE_TOKEN\")) {\n return new Response(\"unauthorized\", { status: 401 });\n }\n if (!SLUG_RE.test(slug)) return bad(\"bad slug\");\n // Trips are created only in /admin — a point for an unknown slug is a\n // misconfigured logger (typo'd slug, deleted trip), so fail loudly.\n const trip = await sqlite.execute({\n sql: `SELECT 1 FROM trips WHERE slug = ?`,\n args: [slug],\n });\n if (!trip.rows.length) return new Response(\"no such trip\", { status: 404 });\n\n const lat = Number(url.searchParams.get(\"lat\"));\n const lon = Number(url.searchParams.get(\"lon\"));\n if (\n url.searchParams.get(\"lat\") === null ||\n url.searchParams.get(\"lon\") === null ||\n !Number.isFinite(lat) || !Number.isFinite(lon)\n ) {\n return bad(\"lat/lon missing or not numeric\");\n }\n // Universal sanity check: valid ranges, and exact 0 on either axis is\n // near-certainly a GPS cold-start artefact, not a real position.\n if (Math.abs(lat) > 90 || Math.abs(lon) > 180 || lat === 0 || lon === 0) {\n return bad(\"implausible coordinates\");\n }\n\n const rawTs = url.searchParams.get(\"ts\");\n let tsMs = rawTs ? Date.parse(rawTs) : NaN;\n if (!Number.isFinite(tsMs)) tsMs = Date.now(); // GPSLogger always sends %TIME; fall back just in case\n if (tsMs > Date.now() + 5 * 60 * 1000) return bad(\"timestamp in the future\");\n const ts = Math.floor(tsMs / 1000);\n\n const count = await sqlite.execute({\n sql: `SELECT COUNT(*) AS c FROM points WHERE trip_slug = ?`,\n args: [slug],\n });\n if (Number(rowVal(count.rows[0], \"c\", 0)) >= MAX_POINTS_PER_TRIP) {\n return bad(\"trip point limit reached\");\n }\n\n await sqlite.execute({\n sql:\n `INSERT OR IGNORE INTO points (trip_slug, ts, lat, lon, acc, speed, batt)\n VALUES (?, ?, ?, ?, ?, ?, ?)`,\n args: [\n slug,\n ts,\n lat,\n lon,\n numOrNull(url.searchParams.get(\"acc\")),\n numOrNull(url.searchParams.get(\"spd\")),\n numOrNull(url.searchParams.get(\"batt\")),\n ],\n });\n return new Response(\"ok\");\n}\n\nasync function handleRouteUpload(\n slug: string,\n req: Request,\n url: URL,\n): Promise {\n if (req.method !== \"POST\") {\n return new Response(\"POST a GPX file to this URL\", { status: 405 });\n }\n if (!tokenOk(url.searchParams.get(\"key\"), \"ADMIN_TOKEN\")) {\n return new Response(\"unauthorized\", { status: 401 });\n }\n if (!SLUG_RE.test(slug)) return bad(\"bad slug\");\n const trip = await sqlite.execute({\n sql: `SELECT 1 FROM trips WHERE slug = ?`,\n args: [slug],\n });\n if (!trip.rows.length) {\n return new Response(\"no such trip — create it in /admin first\", {\n status: 404,\n });\n }\n const body = await req.text();\n if (body.length > MAX_GPX_BYTES) {\n return new Response(\"file too large\", { status: 413 });\n }\n const pts = parseGpx(body);\n if (pts.length < 2) return bad(\"no track/route points found in GPX\");\n const simplified = simplifyRoute(pts, MAX_ROUTE_POINTS);\n const routeStr = simplified.map(([la, lo]) =>\n `${la.toFixed(5)},${lo.toFixed(5)}`\n ).join(\" \");\n const marks = kmMarks(pts);\n const marksStr = marks.map(([la, lo]) => `${la.toFixed(5)},${lo.toFixed(5)}`)\n .join(\" \");\n await sqlite.execute({\n sql: `UPDATE trips SET route = ?, km_marks = ? WHERE slug = ?`,\n args: [routeStr, marksStr, slug],\n });\n return new Response(\n `ok: ${pts.length} GPX points stored as ${simplified.length}-point route, ${marks.length} km markers`,\n );\n}\n\nasync function handlePoints(slug: string, url: URL): Promise {\n if (!SLUG_RE.test(slug)) {\n return new Response(\"[]\", {\n headers: { \"content-type\": \"application/json\" },\n });\n }\n const since = Number(url.searchParams.get(\"since\")) || 0;\n const result = await sqlite.execute({\n sql: `SELECT ts, lat, lon, acc, speed, batt FROM points\n WHERE trip_slug = ? AND ts > ? ORDER BY ts ASC`,\n args: [slug, since],\n });\n const out = result.rows.map((r) => [\n rowVal(r, \"ts\", 0),\n rowVal(r, \"lat\", 1),\n rowVal(r, \"lon\", 2),\n rowVal(r, \"acc\", 3),\n rowVal(r, \"speed\", 4),\n rowVal(r, \"batt\", 5),\n ]);\n return new Response(JSON.stringify(out), {\n headers: {\n \"content-type\": \"application/json\",\n \"cache-control\": \"no-store\",\n },\n });\n}\n\nasync function handleMap(slug: string): Promise {\n if (!SLUG_RE.test(slug)) return new Response(\"Not found\", { status: 404 });\n const trip = await sqlite.execute({\n sql: `SELECT route, name, km_marks FROM trips WHERE slug = ?`,\n args: [slug],\n });\n // Route strings are generated server-side from parsed floats (\"lat,lon lat,lon\"),\n // so they are safe to interpolate; slug is regex-validated above.\n const route = trip.rows.length\n ? String(rowVal(trip.rows[0], \"route\", 0) ?? \"\")\n : \"\";\n const name = trip.rows.length\n ? String(rowVal(trip.rows[0], \"name\", 1) ?? \"Ride Tracker\")\n : \"Ride Tracker\";\n const km = trip.rows.length\n ? String(rowVal(trip.rows[0], \"km_marks\", 2) ?? \"\")\n : \"\";\n const html = `\n\n\n\n\n${escapeHtml(name)}\n\n\n