Wisp endpoint

This val is a wisp protocol server. Connect a wisp client (Galaxy,\nLunar, Scramjet, bare-mux) via WebSocket:

wss://${url.host}/

Plain HTTP GETs hit this status page. Logs go to the val's run log.

\n`,\n { status: 200, headers: { \"content-type\": \"text/html; charset=utf-8\" } },\n );\n}","deleted",false,"label",[38],"b9b245e4-3d16-11f1-8261-42b51c65c3df","proxy.ts","0ba6467c-32d9-11f1-8e75-42b51c65c3df",23,["D",1776730323901],10,"// Val Town HTTP Proxy — Pure API\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// GET /https://example.com → proxied page (HTML rewritten, assets resolved)\n// GET / → 200 JSON { ok: true } (health check)\n// OPTIONS /* → CORS preflight\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n // CORS preflight\n if (request.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\":\n \"GET, POST, PUT, DELETE, PATCH, HEAD, OPTIONS\",\n \"Access-Control-Allow-Headers\":\n request.headers.get(\"Access-Control-Request-Headers\") || \"*\",\n \"Access-Control-Max-Age\": \"86400\",\n },\n });\n }\n\n const targetUrl = extractTargetUrl(url.pathname, url.search);\n\n // Health check — no landing page\n if (!targetUrl) {\n return new Response(JSON.stringify({ ok: true }), {\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n let currentUrl = targetUrl;\n let targetResponse: Response;\n let redirectCount = 0;\n const MAX_REDIRECTS = 10;\n\n const upstreamHeaders: Record = {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n };\n\n const cookie = request.headers.get(\"Cookie\");\n if (cookie) upstreamHeaders[\"Cookie\"] = cookie;\n\n const ct = request.headers.get(\"Content-Type\");\n if (ct) upstreamHeaders[\"Content-Type\"] = ct;\n\n let requestBody: ArrayBuffer | null = null;\n if (request.method !== \"GET\" && request.method !== \"HEAD\") {\n requestBody = await request.arrayBuffer();\n }\n\n while (true) {\n upstreamHeaders[\"Referer\"] = currentUrl;\n const fetchOpts: RequestInit = {\n method: request.method,\n headers: upstreamHeaders,\n redirect: \"manual\",\n };\n if (\n requestBody && request.method !== \"GET\" && request.method !== \"HEAD\"\n ) {\n fetchOpts.body = requestBody;\n }\n\n targetResponse = await fetch(currentUrl, fetchOpts);\n\n if (targetResponse.status >= 300 && targetResponse.status < 400) {\n const location = targetResponse.headers.get(\"Location\");\n if (!location || ++redirectCount > MAX_REDIRECTS) break;\n try {\n currentUrl = new URL(location, currentUrl).href;\n } catch {\n break;\n }\n requestBody = null;\n continue;\n }\n break;\n }\n\n const finalUrl = currentUrl;\n const contentType = targetResponse!.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n const respHeaders = buildHeaders(contentType, targetResponse!);\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse!.text();\n html = rewriteMetaRefresh(html, finalUrl, workerOrigin);\n html = rewriteHtml(html, finalUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse!.text();\n text = rewriteAssetUrls(text, finalUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n }\n\n return new Response(targetResponse!.body, {\n status: targetResponse!.status,\n headers: respHeaders,\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteMetaRefresh(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return html.replace(\n /(]*>)/gi,\n (_match, prefix, delay, rawUrl, suffix) => {\n return prefix + delay +\n resolveAndProxy(rawUrl.trim(), targetBase, workerOrigin) + suffix;\n },\n );\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n // Rewrite HTML attributes with URLs\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n // Rewrite CSS url() references\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n // Base href for relative URL resolution\n const basePath = targetBase.pathname.replace(/[^/]*$/, \"\");\n const baseTag =\n ``;\n html = html.replace(/]*>/gi, \"\");\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n // Navigation interceptor: window.open, location, fetch, XHR, WebSocket\n const navInterceptor =\n ``;\n html = html.replace(/]*>/i, (m) => m + navInterceptor);\n\n // No URL bar, no landing page UI — this is a pure proxy API\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n text = text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n text = text.replace(\n /@import\\s+[\"']([^\"']+)[\"']/gi,\n (_match, rawUrl) =>\n `@import \"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\"`,\n );\n return text;\n}\n\nconst STRIP_HEADERS = new Set([\n \"content-security-policy\",\n \"content-security-policy-report-only\",\n \"x-frame-options\",\n \"x-content-type-options\",\n \"strict-transport-security\",\n \"permissions-policy\",\n \"cross-origin-opener-policy\",\n \"cross-origin-embedder-policy\",\n \"cross-origin-resource-policy\",\n]);\n\nfunction buildHeaders(contentType: string, targetResponse: Response): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n headers.set(\"Access-Control-Expose-Headers\", \"*\");\n\n const cc = targetResponse.headers.get(\"Cache-Control\");\n if (cc) headers.set(\"Cache-Control\", cc);\n\n targetResponse.headers.forEach((value, key) => {\n if (key.toLowerCase() === \"set-cookie\") {\n const cleaned = value\n .replace(/;\\s*domain=[^;]*/gi, \"\")\n .replace(/;\\s*secure/gi, \"\")\n .replace(/;\\s*samesite=[^;]*/gi, \"; SameSite=Lax\");\n headers.append(\"Set-Cookie\", cleaned);\n }\n });\n\n return headers;\n}","aab",[60],"0602c00e-3d17-11f1-b3e8-42b51c65c3df","browser-thingy.ts","f92f31dc-3d16-11f1-89e2-42b51c65c3df",28,["D",1776730451940],3,"// Val Town HTTP Proxy\n// Deploy: paste this entire file into a new Val Town HTTP val\n// Your proxy URL will be: https://USERNAME-VALNAME.web.val.run\n//\n// Usage:\n// https://USERNAME-VALNAME.web.val.run/ → landing page\n// https://USERNAME-VALNAME.web.val.run/https://example.com → proxied page\n\nconst FEATURED_SITES = [\n { name: \"Wikipedia\", url: \"https://en.wikipedia.org\", icon: \"\\u{1F4DA}\" },\n {\n name: \"Pokemon Showdown\",\n url: \"https://play.pokemonshowdown.com\",\n icon: \"\\u26A1\",\n },\n { name: \"GN Math\", url: \"https://gn-math.github.io\", icon: \"\\u{1F522}\" },\n {\n name: \"Cool Math Games\",\n url: \"https://www.coolmathgames.com\",\n icon: \"\\u{1F3B2}\",\n },\n { name: \"Smash Karts\", url: \"https://smashkarts.io\", icon: \"\\u{1F3CE}\" },\n];\n\nconst REWRITABLE_TYPES = [\n \"text/html\",\n \"text/css\",\n \"application/javascript\",\n \"text/javascript\",\n];\n\nexport default async function server(request: Request): Promise {\n const url = new URL(request.url);\n const workerOrigin = url.origin;\n\n let targetUrl = extractTargetUrl(url.pathname, url.search);\n\n if (!targetUrl) {\n return new Response(landingPage(workerOrigin), {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n\n try {\n new URL(targetUrl);\n } catch {\n return new Response(\"Invalid URL: \" + targetUrl, { status: 400 });\n }\n\n try {\n // Follow redirects manually so we can track the final URL\n let currentUrl = targetUrl;\n let targetResponse: Response;\n let redirectCount = 0;\n const MAX_REDIRECTS = 10;\n\n while (true) {\n targetResponse = await fetch(currentUrl, {\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\",\n \"Accept\": request.headers.get(\"Accept\") || \"*/*\",\n \"Accept-Language\": \"en-US,en;q=0.9\",\n \"Referer\": currentUrl,\n },\n redirect: \"manual\",\n });\n\n // Follow 3xx redirects server-side\n if (targetResponse.status >= 300 && targetResponse.status < 400) {\n const location = targetResponse.headers.get(\"Location\");\n if (!location || ++redirectCount > MAX_REDIRECTS) break;\n try {\n currentUrl = new URL(location, currentUrl).href;\n } catch {\n break;\n }\n continue;\n }\n break;\n }\n\n // Use the final URL (after redirects) for resolving relative paths\n const finalUrl = currentUrl;\n\n const contentType = targetResponse!.headers.get(\"Content-Type\") || \"\";\n const shouldRewrite = REWRITABLE_TYPES.some((t) => contentType.includes(t));\n\n if (shouldRewrite && contentType.includes(\"text/html\")) {\n let html = await targetResponse!.text();\n // Rewrite meta refresh redirects to stay in proxy\n html = rewriteMetaRefresh(html, finalUrl, workerOrigin);\n html = rewriteHtml(html, finalUrl, workerOrigin);\n return new Response(html, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n if (shouldRewrite) {\n let text = await targetResponse!.text();\n text = rewriteAssetUrls(text, finalUrl, workerOrigin);\n return new Response(text, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n }\n\n return new Response(targetResponse!.body, {\n status: targetResponse!.status,\n headers: buildHeaders(contentType),\n });\n } catch (err: any) {\n return new Response(\"Proxy error: \" + err.message, { status: 502 });\n }\n}\n\nfunction extractTargetUrl(pathname: string, search: string): string | null {\n let path = pathname;\n if (path.startsWith(\"/browse/\")) path = \"/\" + path.slice(8);\n path = path.slice(1);\n if (!path || (!path.startsWith(\"http://\") && !path.startsWith(\"https://\"))) {\n return null;\n }\n return path + (search || \"\");\n}\n\nfunction rewriteMetaRefresh(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n // Rewrite to stay in proxy\n return html.replace(\n /(]*>)/gi,\n (_match, prefix, delay, rawUrl, suffix) => {\n return prefix + delay +\n resolveAndProxy(rawUrl.trim(), targetBase, workerOrigin) + suffix;\n },\n );\n}\n\nfunction rewriteHtml(\n html: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n\n html = html.replace(\n /((?:href|src|action|poster|data-src)\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, rawUrl, suffix) =>\n prefix + resolveAndProxy(rawUrl, targetBase, workerOrigin) + suffix,\n );\n\n html = html.replace(\n /(srcset\\s*=\\s*[\"'])([^\"']*)([\"'])/gi,\n (_match, prefix, srcset, suffix) => {\n const rewritten = srcset.split(\",\").map((entry: string) => {\n const parts = entry.trim().split(/\\s+/);\n if (parts.length >= 1) {\n parts[0] = resolveAndProxy(parts[0], targetBase, workerOrigin);\n }\n return parts.join(\" \");\n }).join(\", \");\n return prefix + rewritten + suffix;\n },\n );\n\n html = html.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n\n const baseTag = ``;\n html = html.replace(/]*>/i, (m) => m + baseTag);\n\n // Inject navigation interceptor: window.open, location, fetch, XHR, location.href\n const navInterceptor =\n ``;\n html = html.replace(/]*>/i, (m) => m + navInterceptor);\n\n // Inject minimizable URL bar banner\n const currentPageUrl = targetBase.href;\n const urlBar =\n `

`;\n html = html.replace(/]*>/i, (m) => m + urlBar);\n\n return html;\n}\n\nfunction resolveAndProxy(\n rawUrl: string,\n targetBase: URL,\n workerOrigin: string,\n): string {\n if (\n !rawUrl || rawUrl.startsWith(\"data:\") || rawUrl.startsWith(\"#\") ||\n rawUrl.startsWith(\"javascript:\") || rawUrl.startsWith(\"mailto:\") ||\n rawUrl.startsWith(\"tel:\")\n ) return rawUrl;\n try {\n const resolved = new URL(rawUrl, targetBase);\n return workerOrigin + \"/\" + resolved.href;\n } catch {\n return rawUrl;\n }\n}\n\nfunction rewriteAssetUrls(\n text: string,\n targetUrl: string,\n workerOrigin: string,\n): string {\n const targetBase = new URL(targetUrl);\n return text.replace(\n /url\$\\s*[\"']?([^\"')]+)[\"']?\\s*\$/gi,\n (match, rawUrl) => {\n if (rawUrl.startsWith(\"data:\")) return match;\n return `url(\"${resolveAndProxy(rawUrl, targetBase, workerOrigin)}\")`;\n },\n );\n}\n\nfunction buildHeaders(contentType: string): Headers {\n const headers = new Headers();\n headers.set(\"Content-Type\", contentType);\n headers.set(\"Access-Control-Allow-Origin\", \"*\");\n return headers;\n}\n\nfunction landingPage(workerOrigin: string): string {\n const links = FEATURED_SITES.map((s) =>\n `${s.icon} ${s.name}`\n ).join(\"\\n \");\n\n return `\n\n\n \n \n Web Proxy\n \n\n\n

Web Proxy

Enter a URL to browse through this proxy

\n \n

\n ${links}\n

\n\n`;\n}","quizlet",[69],"c0c4f87c-3d16-11f1-a24c-42b51c65c3df","auth.ts","330273ca-3208-11f1-8a4a-42dde27851f2",24,["D",1776730335772],12,"// Val Town Game Auth Server\n//\n// This is the security backbone. It stores all secrets server-side.\n// The secure HTML files contain NOTHING sensitive — no repo URLs,\n// no encryption keys, no config URLs. Just a password prompt and\n// this endpoint's URL.\n//\n// Deploy: Paste into a new Val Town HTTP val.\n// Then set these environment variables in Val Town:\n// GITHUB_PAT — GitHub personal access token (repo read/write)\n// GITHUB_REPO — e.g. \"username/repo-name\"\n// GAME_KEYS_JSON — JSON: { \"drive-mad\": \"hex-key\", \"mr-mine\": \"hex-key\", ... }\n// (copy from .game-keys file)\n// AUTH_SECRET — A password for admin panel access (optional extra layer)\n//\n// Endpoints:\n// POST /auth — Authenticate a game session\n// GET /config — Read config (admin panel)\n// POST /config — Write config (admin panel)\n// POST /block-all — Invalidate all current file versions\n// POST /block-ip — Block an IP address (globally)\n// POST /unblock-ip — Remove a global IP block\n// POST /block-ip-game — Block an IP for a specific game only\n// POST /unblock-ip-game — Remove a per-game IP block\n// POST /allow-ip-game — Allow an IP for a specific game (overrides global blocklist)\n// POST /unallow-ip-game — Remove a per-game IP allow\n// GET /ip-log — Read the IP access log (requires x-auth-secret header)\n// POST /visit — Log a game page visit (no auth required, fire-and-forget)\n// POST /track — Log a panel access beacon (no auth required)\n\nconst CORS_HEADERS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type, x-auth-secret\",\n};\n\n// ─── Types ───────────────────────────────────────────────────\n\ntype IpLogEntry = {\n ip: string;\n gameId: string;\n at: string;\n type?: \"auth\" | \"visit\";\n};\ntype PanelLogEntry = { p: string; r: string; ts: number; at: string };\n\n// ─── Rate Limiter (in-memory, resets on cold start) ──────────\n// 5 failed password attempts in 5 minutes → 429 for 15 minutes\n\nconst RATE_LIMIT_WINDOW = 5 * 60 * 1000; // 5 minutes\nconst RATE_LIMIT_MAX = 5; // max failures in window\nconst RATE_LIMIT_BLOCK = 15 * 60 * 1000; // 15-minute lockout\n\ntype RateLimitEntry = { failures: number[]; blockedUntil: number };\nconst rateLimitMap = new Map();\n\nfunction checkRateLimit(ip: string): { blocked: boolean; retryAfter?: number } {\n if (!ip) return { blocked: false };\n\n const now = Date.now();\n const entry = rateLimitMap.get(ip);\n\n if (entry) {\n // Currently blocked?\n if (entry.blockedUntil > now) {\n return {\n blocked: true,\n retryAfter: Math.ceil((entry.blockedUntil - now) / 1000),\n };\n }\n // Prune old failures outside the window\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n }\n\n return { blocked: false };\n}\n\nfunction recordFailure(ip: string): void {\n if (!ip) return;\n\n const now = Date.now();\n let entry = rateLimitMap.get(ip);\n\n if (!entry) {\n entry = { failures: [], blockedUntil: 0 };\n rateLimitMap.set(ip, entry);\n }\n\n // Prune old failures\n entry.failures = entry.failures.filter((t) => now - t < RATE_LIMIT_WINDOW);\n entry.failures.push(now);\n\n // Trigger lockout if threshold reached\n if (entry.failures.length >= RATE_LIMIT_MAX) {\n entry.blockedUntil = now + RATE_LIMIT_BLOCK;\n entry.failures = []; // reset counter for after lockout\n }\n\n // Housekeeping: prune stale IPs every 100 calls\n if (rateLimitMap.size > 500) {\n for (const [key, val] of rateLimitMap) {\n if (val.blockedUntil < now && val.failures.length === 0) {\n rateLimitMap.delete(key);\n }\n }\n }\n}\n\nexport default async function server(request: Request): Promise {\n if (request.method === \"OPTIONS\") {\n return new Response(null, { headers: CORS_HEADERS });\n }\n\n const url = new URL(request.url);\n const path = url.pathname;\n\n try {\n if (path === \"/auth\" && request.method === \"POST\") {\n return handleAuth(request);\n }\n if (path === \"/config\" && request.method === \"GET\") {\n return handleReadConfig(request);\n }\n if (path === \"/config\" && request.method === \"POST\") {\n return handleWriteConfig(request);\n }\n if (path === \"/block-all\" && request.method === \"POST\") {\n return handleBlockAll(request);\n }\n if (path === \"/block-ip\" && request.method === \"POST\") {\n return handleBlockIp(request);\n }\n if (path === \"/unblock-ip\" && request.method === \"POST\") {\n return handleUnblockIp(request);\n }\n if (path === \"/block-ip-game\" && request.method === \"POST\") {\n return handleBlockIpGame(request);\n }\n if (path === \"/unblock-ip-game\" && request.method === \"POST\") {\n return handleUnblockIpGame(request);\n }\n if (path === \"/allow-ip-game\" && request.method === \"POST\") {\n return handleAllowIpGame(request);\n }\n if (path === \"/unallow-ip-game\" && request.method === \"POST\") {\n return handleUnallowIpGame(request);\n }\n if (path === \"/ip-log\" && request.method === \"GET\") {\n return handleReadIpLog(request);\n }\n if (path === \"/visit\" && request.method === \"POST\") {\n return handleVisit(request);\n }\n if (path === \"/track\" && request.method === \"POST\") {\n return handleTrack(request);\n }\n if (path === \"/proxy-url\" && request.method === \"GET\") {\n return handleProxyUrl();\n }\n if (path === \"/proxy-url\" && request.method === \"POST\") {\n return handleSetProxyUrl(request);\n }\n if (path === \"/announcement\" && request.method === \"GET\") {\n return handleGetAnnouncement();\n }\n if (path === \"/announcement\" && request.method === \"POST\") {\n return handleSetAnnouncement(request);\n }\n if (path === \"/nuclear\" && request.method === \"POST\") {\n return handleNuclear(request);\n }\n return jsonResponse({ error: \"not_found\" }, 404);\n } catch (err: any) {\n return jsonResponse({ error: \"server_error\", message: err.message }, 500);\n }\n}\n\n// ─── Auth: The core endpoint ─────────────────────────────────\n// Called by secure HTML files when user enters password.\n// Returns encrypted game data + key if approved.\n// Returns error if denied. No secrets leak on denial.\n\nasync function handleAuth(request: Request): Promise {\n const body = await request.json() as {\n gameId?: string;\n password?: string;\n ip?: string;\n fileVersion?: number;\n };\n\n const gameId = normalizeGameId(body.gameId || \"\");\n const password = (body.password || \"\").trim();\n const clientIp = (body.ip || \"\").trim();\n const fileVersion = body.fileVersion || 0;\n\n // Rate limit check (before any expensive work)\n const rateCheck = checkRateLimit(clientIp);\n if (rateCheck.blocked) {\n return jsonResponse(\n { error: \"denied\", reason: \"Too many attempts. Try again later.\" },\n 429,\n );\n }\n\n if (!gameId) {\n return jsonResponse({ error: \"denied\", reason: \"Invalid game ID\" });\n }\n if (!password) {\n return jsonResponse({ error: \"denied\", reason: \"No password\" });\n }\n\n // Fetch current config from GitHub\n const config = await fetchConfig();\n if (!config) {\n return jsonResponse({ error: \"denied\", reason: \"Config unavailable\" });\n }\n\n // Check password\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n recordFailure(clientIp);\n return jsonResponse({ error: \"denied\", reason: \"Wrong password\" });\n }\n\n // ── IP override logic ──────────────────────────────────────\n // Per-game IP rules override global rules:\n // perGameAllowedIps set → those IPs + global allowedIps are OK; global blockedIps ignored\n // perGameBlockedIps set → those IPs + global blockedIps are blocked; global allowedIps ignored\n // Neither set → fall back to global allowedIps/blockedIps as normal\n\n const globalAllowed = normalizeAllowedIps(config.allowedIps);\n const globalBlocked = config.blockedIps || {};\n const perGameAllowed = (config.perGameAllowedIps || {})[gameId] || {};\n const perGameBlocked = (config.perGameBlockedIps || {})[gameId] || {};\n const hasPerGameAllow = Object.keys(perGameAllowed).length > 0;\n const hasPerGameBlock = Object.keys(perGameBlocked).length > 0;\n\n if (clientIp) {\n if (hasPerGameAllow) {\n // Per-game allow mode: only per-game allowed + global allowed can access\n // Global blocklist is overridden (ignored)\n if (!perGameAllowed[clientIp] && !globalAllowed[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP not allowed for this game\",\n });\n }\n } else if (hasPerGameBlock) {\n // Per-game block mode: per-game blocked + global blocked are denied\n // Global allowlist is overridden (ignored)\n if (perGameBlocked[clientIp] || globalBlocked[clientIp]) {\n return jsonResponse({\n error: \"denied\",\n reason: \"IP is blocked for this game\",\n });\n }\n } else {\n // No per-game rules — use global lists normally\n if (globalBlocked[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"IP is blocked\" });\n }\n }\n }\n\n // Check if game is blocked\n const blocked = config.blocked || {};\n const blockVal = blocked[gameId];\n if (\n blockVal === true ||\n (typeof blockVal === \"string\" && new Date(blockVal) > new Date())\n ) {\n // Check if IP is in effective allow list (per-game or global depending on mode)\n const effectiveAllowed = hasPerGameAllow\n ? { ...globalAllowed, ...perGameAllowed }\n : globalAllowed;\n if (!clientIp || !effectiveAllowed[clientIp]) {\n return jsonResponse({ error: \"denied\", reason: \"Game is blocked\" });\n }\n }\n\n // Check minimum file version (version invalidation)\n const minFileVersion = config.minFileVersion || 0;\n if (fileVersion > 0 && fileVersion < minFileVersion) {\n return jsonResponse({\n error: \"denied\",\n reason: \"Outdated version. Get the latest files.\",\n });\n }\n\n // All checks passed — return the game data + decryption key\n const gameKeys = getGameKeys();\n const gameKey = gameKeys[gameId];\n if (!gameKey) {\n return jsonResponse({ error: \"denied\", reason: \"Game not configured\" });\n }\n\n // Fetch encrypted game data from GitHub (server-side, client never sees repo URL)\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const gameDataUrl =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/game-data/${gameId}.enc.json`;\n\n const gameDataResp = await fetch(gameDataUrl, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!gameDataResp.ok) {\n return jsonResponse({ error: \"denied\", reason: \"Game data unavailable\" });\n }\n\n const gameData = await gameDataResp.json();\n\n // Fire-and-forget: log this access (don't await, don't fail auth if it errors)\n if (clientIp) {\n appendToIpLog({\n ip: clientIp,\n gameId,\n at: new Date().toISOString(),\n type: \"auth\",\n }).catch(() => {});\n }\n\n return jsonResponse({\n ok: true,\n gameData: gameData, // { iv, authTag, ciphertext }\n key: gameKey, // hex-encoded AES-256 key\n });\n}\n\n// ─── Config read/write (admin panel) ─────────────────────────\n\nasync function handleReadConfig(request: Request): Promise {\n const url = new URL(request.url);\n const password = url.searchParams.get(\"password\") || \"\";\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n return jsonResponse(config);\n}\n\nasync function handleWriteConfig(request: Request): Promise {\n const body = await request.json() as { password?: string; config?: any };\n const password = (body.password || \"\").trim();\n\n const currentConfig = await fetchConfig();\n if (!currentConfig) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(currentConfig);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n const newConfig = body.config;\n if (!newConfig || typeof newConfig !== \"object\") {\n return jsonResponse({ error: \"Invalid config\" }, 400);\n }\n\n await writeConfigToGitHub(newConfig);\n return jsonResponse({ ok: true });\n}\n\n// ─── Block all versions ──────────────────────────────────────\n\nasync function handleBlockAll(request: Request): Promise {\n const body = await request.json() as { password?: string };\n const password = (body.password || \"\").trim();\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Set minFileVersion to current timestamp — all older files are blocked\n config.minFileVersion = Date.now();\n await writeConfigToGitHub(config);\n\n return jsonResponse({\n ok: true,\n minFileVersion: config.minFileVersion,\n message:\n \"All current versions blocked. Regenerate files to create valid versions.\",\n });\n}\n\n// ─── Global IP blocking ──────────────────────────────────────\n\nasync function handleBlockIp(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.blockedIps) config.blockedIps = {};\n config.blockedIps[ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps });\n}\n\nasync function handleUnblockIp(request: Request): Promise {\n const body = await request.json() as { password?: string; ip?: string };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.blockedIps) {\n delete config.blockedIps[ip];\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, blockedIps: config.blockedIps || {} });\n}\n\n// ─── Per-game IP blocking ─────────────────────────────────────\n\nasync function handleBlockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameBlockedIps) config.perGameBlockedIps = {};\n if (!config.perGameBlockedIps[gameId]) config.perGameBlockedIps[gameId] = {};\n config.perGameBlockedIps[gameId][ip] = {\n label: label || ip,\n blockedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps,\n });\n}\n\nasync function handleUnblockIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameBlockedIps && config.perGameBlockedIps[gameId]) {\n delete config.perGameBlockedIps[gameId][ip];\n // Clean up empty game entry\n if (Object.keys(config.perGameBlockedIps[gameId]).length === 0) {\n delete config.perGameBlockedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameBlockedIps: config.perGameBlockedIps || {},\n });\n}\n\n// ─── Per-game IP allowing ────────────────────────────────────────\n\nasync function handleAllowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n label?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n const label = (body.label || \"\").trim();\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.perGameAllowedIps) config.perGameAllowedIps = {};\n if (!config.perGameAllowedIps[gameId]) config.perGameAllowedIps[gameId] = {};\n config.perGameAllowedIps[gameId][ip] = {\n label: label || ip,\n addedAt: new Date().toISOString(),\n };\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps,\n });\n}\n\nasync function handleUnallowIpGame(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n ip?: string;\n gameId?: string;\n };\n const password = (body.password || \"\").trim();\n const ip = (body.ip || \"\").trim();\n const gameId = normalizeGameId(body.gameId || \"\");\n\n if (!ip) return jsonResponse({ error: \"No IP provided\" }, 400);\n if (!gameId) return jsonResponse({ error: \"No game ID provided\" }, 400);\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (config.perGameAllowedIps && config.perGameAllowedIps[gameId]) {\n delete config.perGameAllowedIps[gameId][ip];\n if (Object.keys(config.perGameAllowedIps[gameId]).length === 0) {\n delete config.perGameAllowedIps[gameId];\n }\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n perGameAllowedIps: config.perGameAllowedIps || {},\n });\n}\n\n// ─── IP log read ──────────────────────────────────────────────\n\nasync function handleReadIpLog(request: Request): Promise {\n const secret = request.headers.get(\"x-auth-secret\") || \"\";\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || secret !== expectedSecret) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n const log = await fetchIpLog();\n return jsonResponse({ ok: true, entries: log });\n}\n\n// ─── Game visit beacon (fires on page open, before auth) ─────\n\nasync function handleVisit(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as { gameId?: string; ip?: string };\n const gameId = normalizeGameId(body.gameId || \"\");\n const ip = (body.ip || \"\").trim();\n if (gameId && ip) {\n appendToIpLog({ ip, gameId, at: new Date().toISOString(), type: \"visit\" })\n .catch(() => {});\n }\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Panel access tracking beacon ─────────────────────────────\n\nasync function handleTrack(request: Request): Promise {\n // Fire-and-forget — always return 200, never fail the caller\n try {\n const body = await request.json() as {\n p?: string;\n r?: string;\n ts?: number;\n };\n const entry: PanelLogEntry = {\n p: (body.p || \"\").trim(),\n r: (body.r || \"\").trim(),\n ts: body.ts || 0,\n at: new Date().toISOString(),\n };\n appendToPanelLog(entry).catch(() => {});\n } catch {\n // Ignore parse errors — always 200\n }\n return jsonResponse({ ok: true });\n}\n\n// ─── Proxy URL (public, no auth — games call this) ──────────\n\nasync function handleProxyUrl(): Promise {\n const config = await fetchConfig();\n const proxyUrl = config?.proxyUrl || \"\";\n return jsonResponse({ proxyUrl });\n}\n\nasync function handleSetProxyUrl(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n proxyUrl?: string;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Tier 2 and above can update proxy URL (it needs to be fast — school blocks in ~30min)\n if (tier > 2) {\n return jsonResponse({ error: \"Tier 3 cannot update proxy URL\" }, 403);\n }\n\n config.proxyUrl = (body.proxyUrl || \"\").trim();\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, proxyUrl: config.proxyUrl });\n}\n\n// ─── Announcements ──────────────────────────────────────────\n\nasync function handleGetAnnouncement(): Promise {\n const config = await fetchConfig();\n const ann = config?.announcement || { text: \"\", tier2CanEdit: false };\n return jsonResponse({\n text: ann.text || \"\",\n tier2CanEdit: !!ann.tier2CanEdit,\n });\n}\n\nasync function handleSetAnnouncement(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n text?: string;\n tier2CanEdit?: boolean;\n tier?: number;\n };\n const password = (body.password || \"\").trim();\n const tier = body.tier || 3;\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n if (!config.announcement) {\n config.announcement = { text: \"\", tier2CanEdit: false };\n }\n\n // Tier 2 can only edit text, and only if tier1 allows it\n if (tier === 2) {\n if (!config.announcement.tier2CanEdit) {\n return jsonResponse({\n error: \"Tier 2 not authorized to edit announcements\",\n }, 403);\n }\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n // Tier 2 cannot change tier2CanEdit\n } else if (tier === 1) {\n // Tier 1 can do everything\n if (typeof body.text === \"string\") config.announcement.text = body.text;\n if (typeof body.tier2CanEdit === \"boolean\") {\n config.announcement.tier2CanEdit = body.tier2CanEdit;\n }\n } else {\n return jsonResponse({ error: \"Tier 3 cannot edit announcements\" }, 403);\n }\n\n await writeConfigToGitHub(config);\n return jsonResponse({ ok: true, announcement: config.announcement });\n}\n\n// ─── Nuclear: Tier 1 full reset ─────────────────────────────\n\nasync function handleNuclear(request: Request): Promise {\n const body = await request.json() as {\n password?: string;\n authSecret?: string;\n };\n const password = (body.password || \"\").trim();\n const authSecret = (body.authSecret || \"\").trim();\n\n // Require BOTH password AND auth secret for nuclear option\n const expectedSecret = getEnv(\"AUTH_SECRET\");\n if (!expectedSecret || authSecret !== expectedSecret) {\n return jsonResponse(\n { error: \"Auth secret required for nuclear option\" },\n 403,\n );\n }\n\n const config = await fetchConfig();\n if (!config) return jsonResponse({ error: \"Config unavailable\" }, 500);\n\n const passwords = normalizePasswordList(config);\n if (!passwords.includes(password)) {\n return jsonResponse({ error: \"Unauthorized\" }, 401);\n }\n\n // Nuclear: invalidate all files, rotate keys concept\n config.minFileVersion = Date.now();\n // Clear all sessions — blocked IPs reset, per-game blocks reset\n config.blockedIps = {};\n config.perGameBlockedIps = {};\n // Force new password requirement\n config.nuclearAt = new Date().toISOString();\n\n await writeConfigToGitHub(config);\n return jsonResponse({\n ok: true,\n message:\n \"Nuclear activated. All current secure files invalidated. Regenerate files with new keys to restore access.\",\n minFileVersion: config.minFileVersion,\n nuclearAt: config.nuclearAt,\n });\n}\n\n// ─── GitHub API helpers ──────────────────────────────────────\n\nasync function fetchConfig(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/config.json?t=${Date.now()}`;\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n\n if (!resp.ok) return null;\n return resp.json();\n}\n\nasync function writeConfigToGitHub(config: any): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) throw new Error(\"GITHUB_REPO and GITHUB_PAT required\");\n\n // Get current file SHA\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/config.json`;\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n }\n\n // Write updated config\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(config, null, 2) + \"\\n\")),\n );\n const putResp = await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Update config via auth server\",\n content: content,\n sha: sha || undefined,\n }),\n });\n\n if (!putResp.ok) {\n const err = await putResp.text();\n throw new Error(\"GitHub write failed: \" + err);\n }\n}\n\n// ─── IP log helpers ───────────────────────────────────────────\n\nasync function fetchIpLog(): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n const url =\n `https://raw.githubusercontent.com/${repo}/main/Technical%20Stuff/ip-log.json?t=${Date.now()}`;\n try {\n const resp = await fetch(url, {\n headers: pat ? { Authorization: `token ${pat}` } : {},\n });\n if (!resp.ok) return [];\n return resp.json();\n } catch {\n return [];\n }\n}\n\nasync function appendToIpLog(entry: IpLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/ip-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: IpLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log game access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Panel log helpers ────────────────────────────────────────\n\nasync function appendToPanelLog(entry: PanelLogEntry): Promise {\n const repo = getEnv(\"GITHUB_REPO\");\n const pat = getEnv(\"GITHUB_PAT\");\n\n if (!repo || !pat) return;\n\n const apiUrl =\n `https://api.github.com/repos/${repo}/contents/Technical%20Stuff/panel-access-log.json`;\n\n // Read current log + SHA\n const getResp = await fetch(apiUrl, {\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n },\n });\n\n let currentLog: PanelLogEntry[] = [];\n let sha = \"\";\n if (getResp.ok) {\n const data = await getResp.json() as any;\n sha = data.sha;\n try {\n currentLog = JSON.parse(atob(data.content.replace(/\\n/g, \"\")));\n } catch {\n currentLog = [];\n }\n }\n\n // Prepend new entry and cap at 1000\n const updated = [entry, ...currentLog].slice(0, 1000);\n\n const content = btoa(\n unescape(encodeURIComponent(JSON.stringify(updated, null, 2) + \"\\n\")),\n );\n await fetch(apiUrl, {\n method: \"PUT\",\n headers: {\n Authorization: `token ${pat}`,\n Accept: \"application/vnd.github.v3+json\",\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: \"Log panel access\",\n content,\n sha: sha || undefined,\n }),\n });\n}\n\n// ─── Helpers ─────────────────────────────────────────────────\n\nfunction getEnv(key: string): string {\n return (Deno.env.get(key) || \"\").trim();\n}\n\nfunction getGameKeys(): Record {\n try {\n return JSON.parse(getEnv(\"GAME_KEYS_JSON\"));\n } catch {\n return {};\n }\n}\n\nfunction normalizeGameId(value: string): string {\n let normalized = value.trim().toLowerCase();\n if (!normalized) return \"\";\n normalized = normalized.replace(/\\.html$/i, \"\");\n normalized = normalized.replace(/eaglrcraft/g, \"eaglercraft\");\n normalized = normalized.replace(/open[-\\s]*in[-\\s]*new[-\\s]*tab/g, \" \");\n normalized = normalized.replace(\n /-(regular|locked|locked-b64|secure|base)/g,\n \" \",\n );\n normalized = normalized.replace(/[-_\\s]+/g, \"-\").replace(/^-+|-+$/g, \"\");\n return normalized;\n}\n\nfunction normalizePasswordList(config: any): string[] {\n if (!config) return [];\n const passwords: string[] = [];\n if (config.password) passwords.push(config.password.trim());\n if (Array.isArray(config.passwords)) {\n config.passwords.forEach((p: string) => {\n const trimmed = (p || \"\").trim();\n if (trimmed && !passwords.includes(trimmed)) passwords.push(trimmed);\n });\n }\n return passwords;\n}\n\nfunction normalizeAllowedIps(raw: any): Record {\n if (!raw || typeof raw !== \"object\") return {};\n const result: Record = {};\n Object.keys(raw).forEach((ip) => {\n const trimmed = ip.trim();\n if (trimmed) result[trimmed] = raw[ip];\n });\n return result;\n}\n\nfunction jsonResponse(data: any, status = 200): Response {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n ...CORS_HEADERS,\n },\n });\n}","pythoncoderauth",[78],{"_36":77,"_13":78,"_39":79,"_41":-5,"_42":43,"_44":80,"_46":47,"_48":100,"_17":82,"_51":52,"_53":83,"_55":56,"_57":84,"_91":101,"_18":102},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":97,"_17":73,"_51":52,"_53":74,"_55":56,"_57":75,"_91":98,"_18":99},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":94,"_17":64,"_51":52,"_53":65,"_55":56,"_57":66,"_91":95,"_18":96},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":90,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_91":92,"_18":93},["D",1778431317838],"children",[],[38],["D",1776730323901],[],[60],["D",1776730451940],[],[69],["D",1776730335772],[],[78],"32fc1ab6-3208-11f1-8a4a-42dde27851f2",["D",1775514622169],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Helps me study (I love Wikipedia!)","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/c1d6fc2c-ffb0-47e2-10ae-a4fdf1ff0000/square512?exp=1789590427&sig=85e48948bfdba3e1d762e1a70c4d8e73782946c20a6cf3462cc46c4a9150e5df","userId","019d275b-d06b-734f-8e50-762c85009c4d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019d275b-d06b-734f-8e50-7b6137063a35","tursoName","32fc1ab6320811f18a4a42dde27851f2","tursoHostname","32fc1ab6320811f18a4a42dde27851f2-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789538451310],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_161":157},"org",{"_11":12,"_155":-5,"_156":157,"_114":115,"_158":159,"_160":56},"branch",{"_17":45,"_13":16,"_36":43,"_147":103,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":14,"_154":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoicHJveHkiLCJzcmMiOiJodHRwczovL2ltYWdlcy5jbGVyay5kZXYvb2F1dGhfZ2l0aHViL2ltZ18zQlNVQUVMTkx3QmljWDhIOVVPZjIwbVRSYjkifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_36":103,"_13":14,"_48":210,"_105":-5,"_106":56,"_107":108,"_109":108,"_110":111,"_112":113,"_114":115,"_116":70,"_117":47,"_118":-5,"_119":-5,"_120":121,"_122":123,"_124":125,"_126":127,"_128":211,"_130":-5,"_131":132,"_133":132,"_134":135,"_136":135,"_137":135,"_138":132,"_139":132,"_140":212,"_142":213,"_144":214,"_146":56},[198,199,200,201],"files",[198,199,200,201],"counts",{"_188":121,"_189":190,"_191":121,"_31":192,"_193":194},[180,181,182,183],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_36":77,"_13":78,"_39":79,"_41":-5,"_42":43,"_44":80,"_46":47,"_48":81,"_17":82,"_51":52,"_53":83,"_55":56,"_57":84,"_18":187},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":72,"_17":73,"_51":52,"_53":74,"_55":56,"_57":75,"_18":186},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":63,"_17":64,"_51":52,"_53":65,"_55":56,"_57":66,"_18":185},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":49,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_18":184},[38],[60],[69],[78],"pulls","branches",1,"forks",{"_195":50,"_197":121},"connections",{"_195":121,"_196":121},"count","unfilledCount","emptyCount",{"_36":77,"_13":78,"_39":79,"_41":-5,"_42":43,"_44":80,"_46":47,"_48":100,"_17":82,"_51":52,"_53":83,"_55":56,"_57":84,"_91":208,"_18":209},{"_36":68,"_13":69,"_39":70,"_41":-5,"_42":43,"_44":71,"_46":47,"_48":97,"_17":73,"_51":52,"_53":74,"_55":56,"_57":75,"_91":206,"_18":207},{"_36":59,"_13":60,"_39":61,"_41":-5,"_42":43,"_44":62,"_46":47,"_48":94,"_17":64,"_51":52,"_53":65,"_55":56,"_57":66,"_91":204,"_18":205},{"_36":37,"_13":38,"_39":40,"_41":-5,"_42":43,"_44":45,"_46":47,"_48":90,"_17":50,"_51":52,"_53":54,"_55":56,"_57":-5,"_91":202,"_18":203},[],[38],[],[60],[],[69],[],[78],["D",1775514622169],["D",1789538451310],{"_11":12,"_161":157},{"_11":12,"_155":-5,"_156":157,"_114":115,"_158":159,"_160":56},{"_17":45,"_13":16,"_36":43,"_147":103,"_148":-5,"_149":-5,"_150":-5,"_151":-5,"_152":-5,"_153":14,"_154":12},"ctx",{"_140":-5,"_177":248,"_249":250,"_251":252,"_253":56,"_254":56,"_255":56,"_256":47,"_257":-5,"_258":-7,"_259":-7,"_260":121,"_261":56,"_262":56,"_263":-5,"_264":56,"_265":56,"_266":56,"_267":-5},"ENV",{"_219":220,"_221":222,"_223":16,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245,"_246":247},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","811aa22498c9b0b5a47e8d778de579cdb990f332","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code