Email:\\s*(.*?)\\s*-\\s*eTempMail/i);\n msg.subject = m ? m[1] : \"\";\n m = html.match(/<b>Sender<\\/b>:\\s*<a[^>]*data-cfemail=\"([^\"]+)\"/i);\n if (m) msg.from = decodeCfemail(m[1]);\n else {\n m = html.match(/<b>Sender<\\/b>:\\s*([^<]+)/i);\n msg.from = m ? m[1].trim() : \"\";\n }\n m = html.match(/<b>Date<\\/b>:\\s*([^<]+)/i);\n msg.date = m ? m[1].trim() : \"\";\n m = html.match(/<iframe[^>]*src=\"data:text\\/html,([^\"]+)\"/i);\n msg.body = m ? htmlToText(decodeURIComponent(m[1])) : \"\";\n return msg;\n}\n\nexport async function extend(ci: string): Promise<boolean> {\n const r = await postJson(\"/moreMinutes\", undefined, ci);\n return r.status === 200;\n}\n\nexport async function deleteBox(ci: string): Promise<boolean> {\n const r = await postJson(\"/deleteEmailAddress\", undefined, ci);\n return r.status === 200;\n}\n\nexport async function changeDomain(ci: string, domainId: number): Promise<boolean> {\n const r = await postJson(\"/changeEmailAddress\", { id: String(domainId) }, ci);\n return r.status === 200;\n}\n\nexport async function serverTime(ci: string): Promise<string> {\n const r = await postJson(\"/getServerTime\", undefined, ci);\n return String(r.data);\n}\n","deleted",false,"label",[19],{"_33":81,"_13":82,"_35":83,"_37":-5,"_38":39,"_40":84,"_42":43,"_44":85,"_17":46,"_47":24,"_49":86,"_51":52,"_53":-5,"_66":87,"_18":88},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":79,"_18":80},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":-5,"_66":76,"_18":77},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":48,"_49":65,"_51":52,"_53":-5,"_66":67,"_18":68},"c5f61a33-f80c-460e-85eb-4f667b385969","test.ts","84afe23e-b039-11f1-b650-1607ee4eb77e",8,["D",1789391230685],4,"import { initSession, inbox, BASE, UA } from \"./etempmail.ts\";\n\nasync function post(path: string, ci: string, body?: Record<string, string>) {\n const res = await fetch(BASE + path, {\n method: \"POST\",\n headers: {\n \"user-agent\": UA, referer: BASE + \"/\", origin: BASE,\n \"x-requested-with\": \"XMLHttpRequest\",\n \"content-type\": \"application/x-www-form-urlencoded\",\n cookie: `ci_session=${ci}`,\n },\n body: body ? new URLSearchParams(body).toString() : \"\",\n });\n const setCi = res.headers.getSetCookie?.().map((c) => c.match(/ci_session=([^;]+)/)?.[1]).find(Boolean);\n return { ci: setCi ?? ci, status: res.status, text: (await res.text()).slice(0, 300) };\n}\n\nconst rk = \"ROGCPQP11944977\";\nlet ci = await initSession();\n// recover\nlet r = await post(\"/recoverEmailAddress\", ci, { key: rk });\nci = r.ci;\nconsole.log(\"recover:\", r.status, r.text);\n\n// getEmailAddress без токена, но с активной сессией\nr = await post(\"/getEmailAddress\", ci, { cf_token: \"\" });\nci = r.ci;\nconsole.log(\"getEmailAddress no-token:\", r.status, r.text);\n\n// getEmailAddress с фейковым токеном\nr = await post(\"/getEmailAddress\", ci, { cf_token: \"XXXX.faketoken\" });\nconsole.log(\"getEmailAddress fake-token:\", r.status, r.text);\nconsole.log(\"inbox still works:\", JSON.stringify(await inbox(ci)).slice(0, 150));\n","children",[],[60],"2c387a26-a442-4b46-ae3f-3a61da2aca7a","main.ts","a516af18-b038-11f1-8102-1607ee4eb77e",["D",1789389809889],1,"http","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport * as etm from \"./etempmail.ts\";\n\n// ───────────────────────── storage ─────────────────────────\ntype PoolEntry = { recover_key: string; address?: string; ci?: string; updated?: number };\ntype DB = { pool: PoolEntry[] };\n\nasync function db(): Promise<DB> {\n const d = await blob.getJSON<DB>(\"etempmail_db\");\n return d ?? { pool: [] };\n}\nconst save = (d: DB) => blob.setJSON(\"etempmail_db\", d);\n\n// ───────────────────────── helpers ─────────────────────────\nconst json = (data: unknown, status = 200) =>\n Response.json(data, { status, headers: { \"access-control-allow-origin\": \"*\" } });\nconst err = (msg: string, status = 400) => json({ success: false, error: msg }, status);\n\nasync function withBox(key: string, fn: (entry: PoolEntry, ci: string) => Promise<any>) {\n const d = await db();\n const entry = d.pool.find((p) => p.recover_key === key);\n if (!entry) return err(\"unknown recover_key — добавь через POST /pool\", 404);\n\n const attempt = async (ci?: string) => {\n if (!ci) throw new Error(\"SESSION_EXPIRED\");\n return fn(entry, ci);\n };\n try {\n return await attempt(entry.ci);\n } catch (e) {\n if (!(e instanceof Error && e.message === \"SESSION_EXPIRED\")) throw e;\n }\n // session dead → silent re-recover\n const { ci } = await etm.recover(key);\n entry.ci = ci;\n entry.updated = Date.now();\n await save(d);\n return fn(entry, ci);\n}\n\n// ───────────────────────── routes ─────────────────────────\nexport default async function(req: Request): Promise<Response> {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n const q = url.searchParams;\n const body = req.method === \"POST\" || req.method === \"PUT\" || req.method === \"DELETE\"\n ? await req.json().catch(() => ({}))\n : ({} as any);\n\n // ── docs\n if (path === \"/\" || path === \"/docs\") {\n return json({\n name: \"eTempMail EDU API\",\n note: \"Creating NEW mailboxes requires Cloudflare Turnstile — impossible server-side. Use the recover-key pool: create keys once (nodriver locally) and POST /pool. Recover/inbox/read/extend/delete/change-domain all work turnstile-free.\",\n routes: {\n \"GET /domains\": \"список .edu.pl доменов (id для /domain)\",\n \"GET /pool\": \"пул ключей\",\n \"POST /pool\": \"добавить ключи {keys:[{recover_key,address}]} или {keys:[\\\"RK\\\", ...]}\",\n \"DELETE /pool?key=RK\": \"убрать ключ из пула\",\n \"POST /mailbox\": \"{recover_key} → восстановить ящик (активировать сессию)\",\n \"GET /inbox?key=RK\": \"входящие\",\n \"GET /message?key=RK&id=N\": \"письмо (subject/from/date/body), id = 1-based\",\n \"POST /extend?key=RK\": \"продлить TTL (+20 мин)\",\n \"POST /delete?key=RK\": \"удалить ящик\",\n \"POST /domain?key=RK\": \"{id: 22|23|24} — сменить домен\",\n \"GET /time?key=RK\": \"серверное время (для расчёта TTL)\",\n },\n });\n }\n\n if (path === \"/domains\") {\n return json({ domains: Object.entries(etm.EDU_DOMAINS).map(([domain, id]) => ({ id, domain })) });\n }\n\n // ── pool management\n if (path === \"/pool\") {\n const d = await db();\n if (req.method === \"GET\") {\n return json({ count: d.pool.length, pool: d.pool.map(({ ci, ...rest }) => ({ ...rest, has_session: !!ci })) });\n }\n if (req.method === \"POST\") {\n const raw = body.keys;\n if (!Array.isArray(raw)) return err(\"body: {keys: [...]}\");\n let added = 0;\n for (const item of raw) {\n const e: PoolEntry = typeof item === \"string\"\n ? { recover_key: item }\n : { recover_key: item.recover_key ?? item.recovery, address: item.address };\n if (!e.recover_key) continue;\n if (!d.pool.some((p) => p.recover_key === e.recover_key)) {\n d.pool.push(e);\n added++;\n }\n }\n await save(d);\n return json({ success: true, added, count: d.pool.length });\n }\n if (req.method === \"DELETE\") {\n const key2 = q.get(\"key\") || body.recover_key;\n const before = d.pool.length;\n d.pool = d.pool.filter((p) => p.recover_key !== key2);\n await save(d);\n return json({ success: true, removed: before - d.pool.length });\n }\n return err(\"method not allowed\", 405);\n }\n\n // ── recover: activate a key → session\n if (path === \"/mailbox\" && req.method === \"POST\") {\n const key = body.recover_key ?? body.key;\n if (!key) return err(\"body: {recover_key}\");\n const d = await db();\n const entry = d.pool.find((p) => p.recover_key === key) ?? { recover_key: key };\n if (!d.pool.some((p) => p.recover_key === key)) d.pool.push(entry);\n try {\n const { ci } = await etm.recover(key);\n entry.ci = ci;\n entry.updated = Date.now();\n await save(d);\n return json({\n success: true,\n recover_key: key,\n address: entry.address ?? null,\n hint: entry.address ? undefined : \"адрес неизвестен — добавь address через POST /pool (recover_key не возвращает адрес)\",\n });\n } catch (e) {\n return err(e instanceof Error ? e.message : \"recover failed\", 502);\n }\n }\n\n const key = q.get(\"key\") || body.recover_key;\n if (!key) return err(\"missing ?key=<recover_key>\");\n\n if (path === \"/inbox\" && req.method === \"GET\") {\n return withBox(key, async (_e, ci) => {\n const messages = await etm.inbox(ci);\n return json({ success: true, count: messages.length, messages });\n }).catch((e) => err(e.message, 502));\n }\n\n if (path === \"/message\" && req.method === \"GET\") {\n const id = parseInt(q.get(\"id\") || \"1\", 10);\n return withBox(key, async (_e, ci) => json({ success: true, message: await etm.message(ci, id) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/extend\" && req.method === \"POST\") {\n return withBox(key, async (e, ci) => {\n const ok = await etm.extend(ci);\n if (ok) { e.updated = Date.now(); await save(await db()); }\n return json({ success: ok });\n }).catch((e) => err(e.message, 502));\n }\n\n if (path === \"/delete\" && req.method === \"POST\") {\n return withBox(key, async (_e, ci) => json({ success: await etm.deleteBox(ci) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/domain\" && req.method === \"POST\") {\n const id = parseInt(body.id ?? q.get(\"id\"), 10);\n if (![22, 23, 24].includes(id)) return err(\"id must be 22|23|24\");\n return withBox(key, async (_e, ci) => json({ success: await etm.changeDomain(ci, id) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/time\" && req.method === \"GET\") {\n return withBox(key, async (_e, ci) => json({ success: true, server_time: await etm.serverTime(ci) }))\n .catch((e) => err(e.message, 502));\n }\n\n return err(\"not found — см. GET /docs\", 404);\n}\n",[],[70],["D",1789389621593],[],[19],"99e0e4a4-6d0d-46b7-982f-eb9c20638e62","README.md","3a2db01a-b03e-11f1-9272-1607ee4eb77e",9,["D",1789391673546],"# eTempMail EDU API\n\nREST API для https://etempmail.com (edu.pl temp mail) — реверс + recover-flow.\n\n⚠️ **Создание НОВОГО ящика требует Cloudflare Turnstile** — на сервере это не обходится\n(проверено живьём: без токена → тролль-адрес `...bot.brother@get-a-real-job...`,\nфейковый токен → `403 Bot detected`).\nСхема: **разово** создаёшь пул recover_keys локально (nodriver-скрипт), загружаешь их\nв API — дальше всё (восстановление, приём писем, продление, удаление) работает чистым HTTP.\n`recover_key` постоянный: ящик восстанавливается когда угодно, `/extend` продлевает TTL —\nфактически ящик бессмертный. Каждый ключ = один ящик с фиксированным адресом.\n\n## Endpoints\n\n| Метод | Путь | Описание |\n|---|---|---|\n| GET | `/` | docs |\n| GET | `/domains` | домены: 22 securemail, 23 mats, 24 temporarmail (.edu.pl) |\n| GET | `/pool` | пул ключей |\n| POST | `/pool` | `{keys: [\"RK\", ...]}` или `{keys: [{recover_key, address}, ...]}` |\n| DELETE | `/pool?key=RK` | убрать ключ |\n| POST | `/mailbox` | `{recover_key}` → восстановить/активировать ящик |\n| GET | `/inbox?key=RK` | входящие `[{from,subject,date}]` |\n| GET | `/message?key=RK&id=N` | письмо с телом (id = 1-based позиция в инбоксе) |\n| POST | `/extend?key=RK` | +20 мин TTL (дергай раз в ~15 мин) |\n| POST | `/delete?key=RK` | удалить ящик |\n| POST | `/domain?key=RK` | `{id: 22\\|23\\|24}` — сменить домен |\n| GET | `/time?key=RK` | серверное время (расчёт TTL) |\n\nСессии (`ci_session`) кешируются и **автоматически восстанавливаются** через recover при истечении.\n\n## Пример\n\n```bash\n# 1. загрузить пул (JSON из твоего nodriver pool-скрипта)\ncurl -X POST https://<endpoint>/pool -H 'content-type: application/json' \\\n -d '{\"keys\":[{\"recover_key\":\"CMDVMRT11944975\",\"address\":\"7qcm4insfh@securemail.edu.pl\"}, ...]}'\n\n# 2. активировать ящик\ncurl -X POST https://<endpoint>/mailbox -H 'content-type: application/json' \\\n -d '{\"recover_key\":\"CMDVMRT11944975\"}'\n\n# 3. письма\ncurl 'https://<endpoint>/inbox?key=CMDVMRT11944975'\ncurl 'https://<endpoint>/message?key=CMDVMRT11944975&id=1'\n\n# 4. поддерживать живым\ncurl -X POST 'https://<endpoint>/extend?key=CMDVMRT11944975'\n```\n\nФайлы: `main.ts` (API), `etempmail.ts` (клиент к etempmail.com), `test.ts` (интеграционный тест).\n",[],[82],"7aef4cdf-9ca1-4d85-b385-7e9512990599",["D",1789389275918],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","REST API для eTempMail EDU (.edu.pl) — recover-pool, inbox, body","imageUrl","userId","b4c73ab4-fc74-43bf-b58b-a12e57b3a36e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a09fe4-cd5c-7423-8c1c-66ce77a78c15","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_143":139},"org",{"_11":12,"_136":137,"_138":139,"_99":100,"_140":141,"_142":52},"branch",{"_17":84,"_13":16,"_33":39,"_128":89,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":14,"_135":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Виталий Подливкин","avatar","https://lh3.googleusercontent.com/a/ACg8ocJJJKey1qzSPk2-6tNWRNFPcCnTiWXbHJs8yzfkUCO6oVK83A=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":89,"_13":14,"_44":186,"_91":-5,"_92":52,"_93":94,"_95":94,"_96":97,"_98":-5,"_99":100,"_101":71,"_102":43,"_103":-5,"_104":-5,"_105":46,"_106":107,"_108":-5,"_109":-5,"_110":-5,"_111":-5,"_112":113,"_114":113,"_115":116,"_117":116,"_118":116,"_119":113,"_120":113,"_121":187,"_123":188,"_125":189,"_127":52},[174,175,176,177],"files",[174,175,176,177],"counts",{"_165":46,"_166":73,"_167":46,"_32":168,"_169":170},[],{"_33":34,"_38":39,"_35":36,"_13":19,"_49":50,"_47":48,"_17":46,"_37":-5,"_44":163,"_40":41,"_53":-5,"_18":164},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1789389621593],[19],"pulls","branches","forks",{"_171":46,"_173":46},"connections",{"_171":46,"_172":46},"count","unfilledCount","emptyCount",{"_33":81,"_13":82,"_35":83,"_37":-5,"_38":39,"_40":84,"_42":43,"_44":85,"_17":46,"_47":24,"_49":86,"_51":52,"_53":-5,"_66":184,"_18":185},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":182,"_18":183},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":-5,"_66":180,"_18":181},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":48,"_49":65,"_51":52,"_53":-5,"_66":178,"_18":179},[],[60],[],[70],[],[19],[],[82],["D",1789389275918],{"_11":12,"_143":139},{"_11":12,"_136":137,"_138":139,"_99":100,"_140":141,"_142":52},{"_17":84,"_13":16,"_33":39,"_128":89,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":14,"_135":12},"ctx",{"_121":-5,"_160":223,"_224":225,"_226":227,"_228":52,"_229":52,"_230":52,"_231":43,"_232":-5,"_233":-7,"_234":-7,"_235":46,"_236":52,"_237":52,"_238":-5,"_239":52,"_240":52,"_241":52,"_242":-5},"ENV",{"_194":195,"_196":197,"_198":16,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>

[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_190":191,"_192":193},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_144":-5,"_20":145,"_22":146,"_147":148,"_149":150,"_26":151,"_24":152,"_153":-5,"_154":-5,"_155":52,"_156":157,"_158":43,"_159":-5,"_160":-5,"_161":162},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":25,"_26":27,"_28":-5,"_29":-5,"_30":-5,"_31":-5,"_32":-5},"handle","naperdish73","name","etempmail-api","branchName","main","version","path","etempmail.ts","project",{"_33":89,"_13":14,"_44":90,"_91":-5,"_92":52,"_93":94,"_95":94,"_96":97,"_98":-5,"_99":100,"_101":71,"_102":43,"_103":-5,"_104":-5,"_105":46,"_106":107,"_108":-5,"_109":-5,"_110":-5,"_111":-5,"_112":113,"_114":113,"_115":116,"_117":116,"_118":116,"_119":113,"_120":113,"_121":122,"_123":124,"_125":126,"_127":52},"tree",[55,56,57,58],"file",{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":45,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_18":54},"contents",[],"upstream","pull","ahead","behind","envVars","id","fbfa07fd-0cd4-4399-a13f-89aa25ca4147","fileId","7320021a-b039-11f1-b650-1607ee4eb77e","parentId","branchId","6c82a82e-b1e0-4da3-86c0-4a3f9cd79b91","branchVersion",2,"latest",true,"createdAt",["D",1789389621593],0,"fileType","script","content","// eTempMail reverse-engineered client (Deno / Val Town)\n// BASED ON REVERSE DOC: only /getEmailAddress needs Turnstile — everything else\n// is recover-key flow with ci_session cookie.\n\nexport const BASE = \"https://etempmail.com\";\nexport const UA =\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\";\n\nexport const EDU_DOMAINS: Record = {\n \"securemail.edu.pl\": 22,\n \"mats.edu.pl\": 23,\n \"temporarmail.edu.pl\": 24,\n};\n\nconst TROLL = \"get-a-real-job\";\n\nfunction baseHeaders(ci?: string, ajax = true): HeadersInit {\n const h: Record = {\n \"user-agent\": UA,\n \"accept\": \"*/*\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"referer\": BASE + \"/\",\n \"sec-ch-ua\": '\"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not.A/Brand\";v=\"24\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"Windows\"',\n \"sec-fetch-dest\": \"empty\",\n \"sec-fetch-mode\": \"cors\",\n \"sec-fetch-site\": \"same-origin\",\n };\n if (ajax) h[\"x-requested-with\"] = \"XMLHttpRequest\";\n if (ci) h[\"cookie\"] = `ci_session=${ci}`;\n return h;\n}\n\nfunction extractCi(res: Response): string | undefined {\n // Deno exposes getSetCookie on Headers\n try {\n const cookies = res.headers.getSetCookie?.() ?? [];\n for (const c of cookies) {\n const m = c.match(/ci_session=([^;]+)/);\n if (m) return m[1];\n }\n } catch { /* ignore */ }\n return undefined;\n}\n\n/** GET / to obtain a fresh ci_session */\nexport async function initSession(): Promise {\n const res = await fetch(BASE + \"/\", { headers: baseHeaders(undefined, false) });\n const ci = extractCi(res);\n if (!ci) throw new Error(`initSession failed: HTTP ${res.status}, no ci_session (Cloudflare?)`);\n return ci;\n}\n\nexport type JsonResult = { status: number; ok: boolean; data: any; ci?: string };\n\nasync function postJson(path: string, body?: Record, ci?: string): Promise {\n const res = await fetch(BASE + path, {\n method: \"POST\",\n headers: ci\n ? { ...baseHeaders(ci), origin: BASE, \"content-type\": \"application/x-www-form-urlencoded\" }\n : { ...baseHeaders(), origin: BASE, \"content-type\": \"application/x-www-form-urlencoded\" },\n body: body ? new URLSearchParams(body).toString() : \"\",\n });\n const text = await res.text();\n let data: any = text;\n try { data = JSON.parse(text); } catch { /* plain text */ }\n return { status: res.status, ok: res.ok, data, ci: extractCi(res) ?? ci };\n}\n\n/** Recover a mailbox by its permanent recover_key (NO Turnstile needed) */\nexport async function recover(recoverKey: string): Promise<{ ci: string; address?: string }> {\n const ci = await initSession();\n const r = await postJson(\"/recoverEmailAddress\", { key: recoverKey }, ci);\n if (r.status !== 200 || r.data?.success === false) {\n throw new Error(`recover failed: HTTP ${r.status} ${JSON.stringify(r.data).slice(0, 200)}`);\n }\n // recover response doesn't contain the address; caller passes it or reads / whoami\n return { ci: r.ci ?? ci };\n}\n\nexport async function inbox(ci: string): Promise {\n const r = await postJson(\"/getInbox\", undefined, ci);\n if (r.status === 403) throw new Error(\"SESSION_EXPIRED\");\n if (r.status !== 200) throw new Error(`getInbox HTTP ${r.status}`);\n const t = (r.data ?? \"\").toString();\n if (!t || t === '\"\"') return [];\n if (Array.isArray(r.data)) return r.data;\n try { const p = JSON.parse(t); return Array.isArray(p) ? p : []; } catch { return []; }\n}\n\nfunction decodeCfemail(hex: string): string {\n const key = parseInt(hex.slice(0, 2), 16);\n let out = \"\";\n for (let i = 2; i < hex.length; i += 2) {\n out += String.fromCharCode(parseInt(hex.slice(i, i + 2), 16) ^ key);\n }\n return out;\n}\n\nfunction htmlToText(raw: string): string {\n return raw\n .replace(/]*>/gi, \"\")\n .replace(/]*>/gi, \"\")\n .replace(//gi, \"\\n\")\n .replace(/<\\/p>/gi, \"\\n\\n\")\n .replace(/<[^>]+>/g, \"\")\n .replace(/&/g, \"&\").replace(/</g, \"<\").replace(/>/g, \">\")\n .replace(/"/g, '\"').replace(/'/g, \"'\").replace(/ /g, \" \")\n .replace(/\\n{3,}/g, \"\\n\\n\")\n .trim();\n}\n\n/** Read one message (id = 1-based index in inbox) — parses subject/from/date/body */\nexport async function message(ci: string, id: number): Promise> {\n const res = await fetch(`${BASE}/email?id=${id}`, {\n headers: baseHeaders(ci, false),\n });\n if (res.status === 403) throw new Error(\"SESSION_EXPIRED\");\n const html = await res.text();\n const msg: Record = { id: String(id) };\n let m = html.match(/Email:\\s*(.*?)\\s*-\\s*eTempMail/i);\n msg.subject = m ? m[1] : \"\";\n m = html.match(/<b>Sender<\\/b>:\\s*<a[^>]*data-cfemail=\"([^\"]+)\"/i);\n if (m) msg.from = decodeCfemail(m[1]);\n else {\n m = html.match(/<b>Sender<\\/b>:\\s*([^<]+)/i);\n msg.from = m ? m[1].trim() : \"\";\n }\n m = html.match(/<b>Date<\\/b>:\\s*([^<]+)/i);\n msg.date = m ? m[1].trim() : \"\";\n m = html.match(/<iframe[^>]*src=\"data:text\\/html,([^\"]+)\"/i);\n msg.body = m ? htmlToText(decodeURIComponent(m[1])) : \"\";\n return msg;\n}\n\nexport async function extend(ci: string): Promise<boolean> {\n const r = await postJson(\"/moreMinutes\", undefined, ci);\n return r.status === 200;\n}\n\nexport async function deleteBox(ci: string): Promise<boolean> {\n const r = await postJson(\"/deleteEmailAddress\", undefined, ci);\n return r.status === 200;\n}\n\nexport async function changeDomain(ci: string, domainId: number): Promise<boolean> {\n const r = await postJson(\"/changeEmailAddress\", { id: String(domainId) }, ci);\n return r.status === 200;\n}\n\nexport async function serverTime(ci: string): Promise<string> {\n const r = await postJson(\"/getServerTime\", undefined, ci);\n return String(r.data);\n}\n","deleted",false,"label",[19],{"_33":81,"_13":82,"_35":83,"_37":-5,"_38":39,"_40":84,"_42":43,"_44":85,"_17":46,"_47":24,"_49":86,"_51":52,"_53":-5,"_66":87,"_18":88},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":79,"_18":80},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":-5,"_66":76,"_18":77},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":48,"_49":65,"_51":52,"_53":-5,"_66":67,"_18":68},"c5f61a33-f80c-460e-85eb-4f667b385969","test.ts","84afe23e-b039-11f1-b650-1607ee4eb77e",8,["D",1789391230685],4,"import { initSession, inbox, BASE, UA } from \"./etempmail.ts\";\n\nasync function post(path: string, ci: string, body?: Record<string, string>) {\n const res = await fetch(BASE + path, {\n method: \"POST\",\n headers: {\n \"user-agent\": UA, referer: BASE + \"/\", origin: BASE,\n \"x-requested-with\": \"XMLHttpRequest\",\n \"content-type\": \"application/x-www-form-urlencoded\",\n cookie: `ci_session=${ci}`,\n },\n body: body ? new URLSearchParams(body).toString() : \"\",\n });\n const setCi = res.headers.getSetCookie?.().map((c) => c.match(/ci_session=([^;]+)/)?.[1]).find(Boolean);\n return { ci: setCi ?? ci, status: res.status, text: (await res.text()).slice(0, 300) };\n}\n\nconst rk = \"ROGCPQP11944977\";\nlet ci = await initSession();\n// recover\nlet r = await post(\"/recoverEmailAddress\", ci, { key: rk });\nci = r.ci;\nconsole.log(\"recover:\", r.status, r.text);\n\n// getEmailAddress без токена, но с активной сессией\nr = await post(\"/getEmailAddress\", ci, { cf_token: \"\" });\nci = r.ci;\nconsole.log(\"getEmailAddress no-token:\", r.status, r.text);\n\n// getEmailAddress с фейковым токеном\nr = await post(\"/getEmailAddress\", ci, { cf_token: \"XXXX.faketoken\" });\nconsole.log(\"getEmailAddress fake-token:\", r.status, r.text);\nconsole.log(\"inbox still works:\", JSON.stringify(await inbox(ci)).slice(0, 150));\n","children",[],[60],"2c387a26-a442-4b46-ae3f-3a61da2aca7a","main.ts","a516af18-b038-11f1-8102-1607ee4eb77e",["D",1789389809889],1,"http","import { blob } from \"https://esm.town/v/std/blob/main.ts\";\nimport * as etm from \"./etempmail.ts\";\n\n// ───────────────────────── storage ─────────────────────────\ntype PoolEntry = { recover_key: string; address?: string; ci?: string; updated?: number };\ntype DB = { pool: PoolEntry[] };\n\nasync function db(): Promise<DB> {\n const d = await blob.getJSON<DB>(\"etempmail_db\");\n return d ?? { pool: [] };\n}\nconst save = (d: DB) => blob.setJSON(\"etempmail_db\", d);\n\n// ───────────────────────── helpers ─────────────────────────\nconst json = (data: unknown, status = 200) =>\n Response.json(data, { status, headers: { \"access-control-allow-origin\": \"*\" } });\nconst err = (msg: string, status = 400) => json({ success: false, error: msg }, status);\n\nasync function withBox(key: string, fn: (entry: PoolEntry, ci: string) => Promise<any>) {\n const d = await db();\n const entry = d.pool.find((p) => p.recover_key === key);\n if (!entry) return err(\"unknown recover_key — добавь через POST /pool\", 404);\n\n const attempt = async (ci?: string) => {\n if (!ci) throw new Error(\"SESSION_EXPIRED\");\n return fn(entry, ci);\n };\n try {\n return await attempt(entry.ci);\n } catch (e) {\n if (!(e instanceof Error && e.message === \"SESSION_EXPIRED\")) throw e;\n }\n // session dead → silent re-recover\n const { ci } = await etm.recover(key);\n entry.ci = ci;\n entry.updated = Date.now();\n await save(d);\n return fn(entry, ci);\n}\n\n// ───────────────────────── routes ─────────────────────────\nexport default async function(req: Request): Promise<Response> {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n const q = url.searchParams;\n const body = req.method === \"POST\" || req.method === \"PUT\" || req.method === \"DELETE\"\n ? await req.json().catch(() => ({}))\n : ({} as any);\n\n // ── docs\n if (path === \"/\" || path === \"/docs\") {\n return json({\n name: \"eTempMail EDU API\",\n note: \"Creating NEW mailboxes requires Cloudflare Turnstile — impossible server-side. Use the recover-key pool: create keys once (nodriver locally) and POST /pool. Recover/inbox/read/extend/delete/change-domain all work turnstile-free.\",\n routes: {\n \"GET /domains\": \"список .edu.pl доменов (id для /domain)\",\n \"GET /pool\": \"пул ключей\",\n \"POST /pool\": \"добавить ключи {keys:[{recover_key,address}]} или {keys:[\\\"RK\\\", ...]}\",\n \"DELETE /pool?key=RK\": \"убрать ключ из пула\",\n \"POST /mailbox\": \"{recover_key} → восстановить ящик (активировать сессию)\",\n \"GET /inbox?key=RK\": \"входящие\",\n \"GET /message?key=RK&id=N\": \"письмо (subject/from/date/body), id = 1-based\",\n \"POST /extend?key=RK\": \"продлить TTL (+20 мин)\",\n \"POST /delete?key=RK\": \"удалить ящик\",\n \"POST /domain?key=RK\": \"{id: 22|23|24} — сменить домен\",\n \"GET /time?key=RK\": \"серверное время (для расчёта TTL)\",\n },\n });\n }\n\n if (path === \"/domains\") {\n return json({ domains: Object.entries(etm.EDU_DOMAINS).map(([domain, id]) => ({ id, domain })) });\n }\n\n // ── pool management\n if (path === \"/pool\") {\n const d = await db();\n if (req.method === \"GET\") {\n return json({ count: d.pool.length, pool: d.pool.map(({ ci, ...rest }) => ({ ...rest, has_session: !!ci })) });\n }\n if (req.method === \"POST\") {\n const raw = body.keys;\n if (!Array.isArray(raw)) return err(\"body: {keys: [...]}\");\n let added = 0;\n for (const item of raw) {\n const e: PoolEntry = typeof item === \"string\"\n ? { recover_key: item }\n : { recover_key: item.recover_key ?? item.recovery, address: item.address };\n if (!e.recover_key) continue;\n if (!d.pool.some((p) => p.recover_key === e.recover_key)) {\n d.pool.push(e);\n added++;\n }\n }\n await save(d);\n return json({ success: true, added, count: d.pool.length });\n }\n if (req.method === \"DELETE\") {\n const key2 = q.get(\"key\") || body.recover_key;\n const before = d.pool.length;\n d.pool = d.pool.filter((p) => p.recover_key !== key2);\n await save(d);\n return json({ success: true, removed: before - d.pool.length });\n }\n return err(\"method not allowed\", 405);\n }\n\n // ── recover: activate a key → session\n if (path === \"/mailbox\" && req.method === \"POST\") {\n const key = body.recover_key ?? body.key;\n if (!key) return err(\"body: {recover_key}\");\n const d = await db();\n const entry = d.pool.find((p) => p.recover_key === key) ?? { recover_key: key };\n if (!d.pool.some((p) => p.recover_key === key)) d.pool.push(entry);\n try {\n const { ci } = await etm.recover(key);\n entry.ci = ci;\n entry.updated = Date.now();\n await save(d);\n return json({\n success: true,\n recover_key: key,\n address: entry.address ?? null,\n hint: entry.address ? undefined : \"адрес неизвестен — добавь address через POST /pool (recover_key не возвращает адрес)\",\n });\n } catch (e) {\n return err(e instanceof Error ? e.message : \"recover failed\", 502);\n }\n }\n\n const key = q.get(\"key\") || body.recover_key;\n if (!key) return err(\"missing ?key=<recover_key>\");\n\n if (path === \"/inbox\" && req.method === \"GET\") {\n return withBox(key, async (_e, ci) => {\n const messages = await etm.inbox(ci);\n return json({ success: true, count: messages.length, messages });\n }).catch((e) => err(e.message, 502));\n }\n\n if (path === \"/message\" && req.method === \"GET\") {\n const id = parseInt(q.get(\"id\") || \"1\", 10);\n return withBox(key, async (_e, ci) => json({ success: true, message: await etm.message(ci, id) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/extend\" && req.method === \"POST\") {\n return withBox(key, async (e, ci) => {\n const ok = await etm.extend(ci);\n if (ok) { e.updated = Date.now(); await save(await db()); }\n return json({ success: ok });\n }).catch((e) => err(e.message, 502));\n }\n\n if (path === \"/delete\" && req.method === \"POST\") {\n return withBox(key, async (_e, ci) => json({ success: await etm.deleteBox(ci) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/domain\" && req.method === \"POST\") {\n const id = parseInt(body.id ?? q.get(\"id\"), 10);\n if (![22, 23, 24].includes(id)) return err(\"id must be 22|23|24\");\n return withBox(key, async (_e, ci) => json({ success: await etm.changeDomain(ci, id) }))\n .catch((e) => err(e.message, 502));\n }\n\n if (path === \"/time\" && req.method === \"GET\") {\n return withBox(key, async (_e, ci) => json({ success: true, server_time: await etm.serverTime(ci) }))\n .catch((e) => err(e.message, 502));\n }\n\n return err(\"not found — см. GET /docs\", 404);\n}\n",[],[70],["D",1789389621593],[],[19],"99e0e4a4-6d0d-46b7-982f-eb9c20638e62","README.md","3a2db01a-b03e-11f1-9272-1607ee4eb77e",9,["D",1789391673546],"# eTempMail EDU API\n\nREST API для https://etempmail.com (edu.pl temp mail) — реверс + recover-flow.\n\n⚠️ **Создание НОВОГО ящика требует Cloudflare Turnstile** — на сервере это не обходится\n(проверено живьём: без токена → тролль-адрес `...bot.brother@get-a-real-job...`,\nфейковый токен → `403 Bot detected`).\nСхема: **разово** создаёшь пул recover_keys локально (nodriver-скрипт), загружаешь их\nв API — дальше всё (восстановление, приём писем, продление, удаление) работает чистым HTTP.\n`recover_key` постоянный: ящик восстанавливается когда угодно, `/extend` продлевает TTL —\nфактически ящик бессмертный. Каждый ключ = один ящик с фиксированным адресом.\n\n## Endpoints\n\n| Метод | Путь | Описание |\n|---|---|---|\n| GET | `/` | docs |\n| GET | `/domains` | домены: 22 securemail, 23 mats, 24 temporarmail (.edu.pl) |\n| GET | `/pool` | пул ключей |\n| POST | `/pool` | `{keys: [\"RK\", ...]}` или `{keys: [{recover_key, address}, ...]}` |\n| DELETE | `/pool?key=RK` | убрать ключ |\n| POST | `/mailbox` | `{recover_key}` → восстановить/активировать ящик |\n| GET | `/inbox?key=RK` | входящие `[{from,subject,date}]` |\n| GET | `/message?key=RK&id=N` | письмо с телом (id = 1-based позиция в инбоксе) |\n| POST | `/extend?key=RK` | +20 мин TTL (дергай раз в ~15 мин) |\n| POST | `/delete?key=RK` | удалить ящик |\n| POST | `/domain?key=RK` | `{id: 22\\|23\\|24}` — сменить домен |\n| GET | `/time?key=RK` | серверное время (расчёт TTL) |\n\nСессии (`ci_session`) кешируются и **автоматически восстанавливаются** через recover при истечении.\n\n## Пример\n\n```bash\n# 1. загрузить пул (JSON из твоего nodriver pool-скрипта)\ncurl -X POST https://<endpoint>/pool -H 'content-type: application/json' \\\n -d '{\"keys\":[{\"recover_key\":\"CMDVMRT11944975\",\"address\":\"7qcm4insfh@securemail.edu.pl\"}, ...]}'\n\n# 2. активировать ящик\ncurl -X POST https://<endpoint>/mailbox -H 'content-type: application/json' \\\n -d '{\"recover_key\":\"CMDVMRT11944975\"}'\n\n# 3. письма\ncurl 'https://<endpoint>/inbox?key=CMDVMRT11944975'\ncurl 'https://<endpoint>/message?key=CMDVMRT11944975&id=1'\n\n# 4. поддерживать живым\ncurl -X POST 'https://<endpoint>/extend?key=CMDVMRT11944975'\n```\n\nФайлы: `main.ts` (API), `etempmail.ts` (клиент к etempmail.com), `test.ts` (интеграционный тест).\n",[],[82],"7aef4cdf-9ca1-4d85-b385-7e9512990599",["D",1789389275918],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","REST API для eTempMail EDU (.edu.pl) — recover-pool, inbox, body","imageUrl","userId","b4c73ab4-fc74-43bf-b58b-a12e57b3a36e","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a09fe4-cd5c-7423-8c1c-66ce77a78c15","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_143":139},"org",{"_11":12,"_136":137,"_138":139,"_99":100,"_140":141,"_142":52},"branch",{"_17":84,"_13":16,"_33":39,"_128":89,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":14,"_135":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Виталий Подливкин","avatar","https://lh3.googleusercontent.com/a/ACg8ocJJJKey1qzSPk2-6tNWRNFPcCnTiWXbHJs8yzfkUCO6oVK83A=s96-c","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":89,"_13":14,"_44":186,"_91":-5,"_92":52,"_93":94,"_95":94,"_96":97,"_98":-5,"_99":100,"_101":71,"_102":43,"_103":-5,"_104":-5,"_105":46,"_106":107,"_108":-5,"_109":-5,"_110":-5,"_111":-5,"_112":113,"_114":113,"_115":116,"_117":116,"_118":116,"_119":113,"_120":113,"_121":187,"_123":188,"_125":189,"_127":52},[174,175,176,177],"files",[174,175,176,177],"counts",{"_165":46,"_166":73,"_167":46,"_32":168,"_169":170},[],{"_33":34,"_38":39,"_35":36,"_13":19,"_49":50,"_47":48,"_17":46,"_37":-5,"_44":163,"_40":41,"_53":-5,"_18":164},"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},["D",1789389621593],[19],"pulls","branches","forks",{"_171":46,"_173":46},"connections",{"_171":46,"_172":46},"count","unfilledCount","emptyCount",{"_33":81,"_13":82,"_35":83,"_37":-5,"_38":39,"_40":84,"_42":43,"_44":85,"_17":46,"_47":24,"_49":86,"_51":52,"_53":-5,"_66":184,"_18":185},{"_33":34,"_13":19,"_35":36,"_37":-5,"_38":39,"_40":41,"_42":43,"_44":78,"_17":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_66":182,"_18":183},{"_33":69,"_13":70,"_35":71,"_37":-5,"_38":39,"_40":64,"_42":43,"_44":72,"_17":73,"_47":74,"_49":75,"_51":52,"_53":-5,"_66":180,"_18":181},{"_33":59,"_13":60,"_35":61,"_37":-5,"_38":39,"_40":62,"_42":43,"_44":63,"_17":64,"_47":48,"_49":65,"_51":52,"_53":-5,"_66":178,"_18":179},[],[60],[],[70],[],[19],[],[82],["D",1789389275918],{"_11":12,"_143":139},{"_11":12,"_136":137,"_138":139,"_99":100,"_140":141,"_142":52},{"_17":84,"_13":16,"_33":39,"_128":89,"_129":-5,"_130":-5,"_131":-5,"_132":-5,"_133":-5,"_134":14,"_135":12},"ctx",{"_121":-5,"_160":223,"_224":225,"_226":227,"_228":52,"_229":52,"_230":52,"_231":43,"_232":-5,"_233":-7,"_234":-7,"_235":46,"_236":52,"_237":52,"_238":-5,"_239":52,"_240":52,"_241":52,"_242":-5},"ENV",{"_194":195,"_196":197,"_198":16,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"] </article></body></html>