\n \n \n

Twitter Photo Gallery

Enter an X username to browse their photos using your session.

\n\n \n\n

You need to add your X session token in Settings before searching. The app uses your session to fetch real photos from X.

\n \n Recent searches\n

\n\n

\n\n \n \n\n \n\n\n","label",[18],"pulls","branches",1,"forks","envVars",{"_274":26,"_276":26},"connections",{"_274":26,"_275":26},"count","unfilledCount","emptyCount",{"_46":293,"_13":294,"_75":295,"_56":-5,"_48":49,"_259":296,"_260":197,"_50":297,"_52":26,"_77":298,"_262":-5,"_78":24,"_264":-5,"_287":299,"_17":300},{"_46":258,"_13":18,"_75":76,"_56":-5,"_48":49,"_259":178,"_260":197,"_50":290,"_52":136,"_77":21,"_262":263,"_78":24,"_264":-5,"_287":291,"_17":292},{"_46":280,"_13":281,"_75":195,"_56":-5,"_48":49,"_259":282,"_260":197,"_50":283,"_52":284,"_77":285,"_262":286,"_78":24,"_264":14,"_287":288,"_17":289},"fbedd968-adc1-4417-8cac-0b81b13d53c4","main.ts",9,["D",1783363821535],3,"http","import { staticHTTPServer } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst X_BEARER_TOKEN =\n \"AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNw%2Fqg7b4qFBR5Y3AbgzZbco4g0%3DCF79kW2gNRLSTCAS6saOfT2Oc8s2u6YJUPIncoBH67t6DY7E7a\";\n\nconst PAGE_UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\";\n\nconst GQL_FEATURES = {\n responsive_web_graphql_timeline_navigation_enabled: true,\n unified_cards_ad_metadata_container_dynamic_card_content_query_enabled: true,\n responsive_web_graphql_exclude_directive_enabled: true,\n verified_phone_label_enabled: false,\n creator_subscriptions_tweet_preview_api_enabled: true,\n interactive_text_enabled: true,\n vibe_api_enabled: true,\n responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,\n responsive_web_twitter_article_notes_tab_enabled: false,\n subscriptions_verification_info_is_identity_verified_enabled: true,\n subscriptions_verification_info_verified_since_enabled: true,\n highlights_tweets_tab_ui_enabled: true,\n subscriptions_feature_can_gift_premium: true,\n hidden_profile_likes_enabled: true,\n hidden_profile_subscriptions_enabled: true,\n};\n\nconst GQL_FIELD_TOGGLES = { withAuxiliaryUserLabels: false };\n\nconst FALLBACK_QUERY_IDS = [\n { userMedia: \"oUue9m948p46e7f_u0Yvug\", userByScreenName: \"s_7_S_S_S_S_S_S_S_S_S_S\" },\n { userMedia: \"V8E5T_pN7H5e_nK6kN6zZA\", userByScreenName: \"7N9G2V7c3p6oN5eT4p8sXA\" },\n { userMedia: \"SSoGHi3s7TQ9H3s7TQ9H3s\", userByScreenName: \"GtKpDd7s3qH4a3s7TQ9H3s\" },\n];\n\ntype XMediaItem = {\n id: string;\n tweetId: string;\n tweetText: string;\n createdAt: string;\n favoriteCount: number;\n retweetCount: number;\n replyCount: number;\n mediaUrl: string;\n mediaWidth: number;\n mediaHeight: number;\n username: string;\n userDisplayName: string;\n userAvatarUrl: string;\n};\n\ntype ProxyResponse = {\n items: XMediaItem[];\n nextCursor?: string | null;\n error?: string;\n errorType?: string;\n statusCode?: number;\n xError?: string;\n};\n\ntype MediaPage = {\n items: XMediaItem[];\n nextCursor: string | null;\n};\n\nfunction cleanCookieValue(value: string): string {\n return value.trim().replace(/^[\"']|[\"']$/g, \"\");\n}\n\nfunction readCookieValue(input: string, name: \"auth_token\" | \"ct0\"): string {\n const trimmed = input.trim().replace(/^cookie:\\s*/i, \"\");\n const pairs = trimmed.split(/[;\\n]/);\n for (const pair of pairs) {\n const eq = pair.indexOf(\"=\");\n if (eq === -1) continue;\n const key = pair.slice(0, eq).trim();\n const value = pair.slice(eq + 1).trim();\n if (key === name) return cleanCookieValue(value);\n }\n return \"\";\n}\n\nfunction normalizeCredentialInputs(authInput: string, csrfInput: string) {\n const authToken =\n readCookieValue(authInput, \"auth_token\") ||\n readCookieValue(csrfInput, \"auth_token\") ||\n cleanCookieValue(authInput);\n const csrfToken =\n readCookieValue(authInput, \"ct0\") ||\n readCookieValue(csrfInput, \"ct0\") ||\n cleanCookieValue(csrfInput);\n return { authToken, csrfToken };\n}\n\nfunction buildCookieString(authToken: string, csrfToken: string): string {\n let c = `auth_token=${cleanCookieValue(authToken)}`;\n if (csrfToken) c += `; ct0=${cleanCookieValue(csrfToken)}`;\n return c;\n}\n\nfunction pageHeaders(authToken: string, csrfToken: string, referer: string): Record {\n return {\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"document\",\n \"sec-fetch-mode\": \"navigate\",\n \"sec-fetch-site\": \"none\",\n cookie: buildCookieString(authToken, csrfToken),\n referer,\n origin: \"https://x.com\",\n \"x-csrf-token\": csrfToken,\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n };\n}\n\nfunction apiHeaders(authToken: string, csrfToken: string): Record {\n return {\n authorization: `Bearer ${X_BEARER_TOKEN}`,\n \"x-csrf-token\": csrfToken,\n cookie: buildCookieString(authToken, csrfToken),\n \"content-type\": \"application/json\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"*/*\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"empty\",\n \"sec-fetch-mode\": \"cors\",\n \"sec-fetch-site\": \"same-site\",\n referer: \"https://x.com/\",\n origin: \"https://x.com\",\n };\n}\n\nfunction extractQueryIds(source: string): Record {\n const ids: Record = {};\n const operationNames = \"(UserMedia|UserByScreenName)\";\n const patterns = [\n new RegExp(`queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"'][\\\\s\\\\S]{0,800}?operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n new RegExp(`operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"'][\\\\s\\\\S]{0,800}?queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`[\"']${operationNames}[\"']\\\\s*,\\\\s*queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']\\\\s*,\\\\s*operationName\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n ];\n for (const pattern of patterns) {\n for (const match of source.matchAll(pattern)) {\n const first = match[1];\n const second = match[2];\n const queryId = /^[a-zA-Z0-9_-]+$/.test(first) && first !== \"UserMedia\" && first !== \"UserByScreenName\" ? first : second;\n const operation = first === queryId ? second : first;\n if ((operation === \"UserMedia\" || operation === \"UserByScreenName\") && queryId) ids[operation] = queryId;\n }\n }\n return ids;\n}\n\nlet queryIdCache: { userMedia: string; userByScreenName: string } | null | undefined;\nasync function discoverQueryIds(): Promise<{ userMedia: string; userByScreenName: string } | null> {\n if (queryIdCache !== undefined) return queryIdCache;\n try {\n const res = await fetch(\"https://x.com/\", { headers: { \"User-Agent\": PAGE_UA, Accept: \"text/html\" } });\n const html = await res.text();\n const ids = extractQueryIds(html);\n if (ids.UserMedia && ids.UserByScreenName) {\n queryIdCache = { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName };\n return queryIdCache;\n }\n const bundleUrls = new Set();\n for (const match of html.matchAll(/]+src=[\"']([^\"']+)[\"']/g)) {\n try {\n const url = new URL(match[1], \"https://x.com/\");\n if (/\\.(?:js|mjs)(?:$|\\?)/.test(url.pathname) && (url.hostname.endsWith(\"x.com\") || url.hostname.endsWith(\"twimg.com\"))) bundleUrls.add(url.toString());\n } catch {}\n }\n for (const bundleUrl of bundleUrls) {\n if (ids.UserMedia && ids.UserByScreenName) break;\n try {\n const bundleRes = await fetch(bundleUrl, { headers: { \"User-Agent\": PAGE_UA, Accept: \"*/*\" } });\n Object.assign(ids, extractQueryIds(await bundleRes.text()));\n } catch {}\n }\n queryIdCache = ids.UserMedia && ids.UserByScreenName ? { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName } : null;\n return queryIdCache;\n } catch (err) {\n console.error(\"query id discovery failed\", err);\n queryIdCache = null;\n return null;\n }\n}\n\nasync function gqlFetch(method: \"GET\" | \"POST\", url: string, authToken: string, csrfToken: string, body?: Record) {\n let fullUrl = url;\n const opts: RequestInit = { method, headers: apiHeaders(authToken, csrfToken) };\n if (method === \"GET\" && body) {\n const flat: Record = {};\n for (const [k, v] of Object.entries(body)) flat[k] = typeof v === \"object\" ? JSON.stringify(v) : String(v);\n fullUrl = `${url}?${new URLSearchParams(flat).toString()}`;\n } else if (method === \"POST\" && body) {\n opts.body = JSON.stringify(body);\n }\n return fetch(fullUrl, opts);\n}\n\nasync function resolveUserId(username: string, authToken: string, csrfToken: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userByScreenName}/UserByScreenName`;\n const body = { variables: { screen_name: username, withSafetyModeUserFields: true }, features: GQL_FEATURES, fieldToggles: GQL_FIELD_TOGGLES };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) break;\n if (!res.ok) continue;\n try {\n const data = await res.json();\n const uid = data?.data?.user?.result?.rest_id || data?.data?.user_result?.result?.rest_id || null;\n if (uid) return uid;\n } catch {}\n }\n }\n return null;\n}\n\nasync function fetchUserMediaGql(userId: string, username: string, authToken: string, csrfToken: string, cursor?: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userMedia}/UserMedia`;\n const body = {\n variables: { userId, count: 24, cursor: cursor || null, includePromotedContent: false, withClientEventToken: false, withBirdwatchNotes: false, withVoice: false, withV2Timeline: true },\n features: GQL_FEATURES,\n fieldToggles: GQL_FIELD_TOGGLES,\n };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) return null;\n if (!res.ok) continue;\n try {\n const page = parseGraphQLResponse(await res.json(), username);\n if (page.items.length || page.nextCursor) return page;\n } catch {}\n }\n }\n return null;\n}\n\nasync function tryGraphQL(username: string, authToken: string, csrfToken: string, cursor?: string): Promise {\n const userId = await resolveUserId(username, authToken, csrfToken);\n if (!userId) return null;\n return fetchUserMediaGql(userId, username, authToken, csrfToken, cursor);\n}\n\nfunction parseGraphQLResponse(data: any, username: string): MediaPage {\n const allItems: XMediaItem[] = [];\n const seen = new Set();\n let nextCursor: string | null = null;\n const instructions =\n data?.data?.user?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user?.result?.timeline?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline?.timeline?.instructions ||\n [];\n for (const instruction of instructions) {\n if (instruction.type !== \"TimelineAddEntries\" && instruction.type !== \"TimelineTimelineItem\") continue;\n const entries = instruction.entries || (instruction.entry ? [instruction.entry] : [instruction]);\n for (const entry of entries) {\n const content = entry.content || entry;\n const cursorValue = content.value || content.cursor?.value;\n const cursorType = String(content.cursorType || content.cursor?.cursorType || \"\");\n const entryId = String(entry.entryId || \"\");\n if (cursorValue && (cursorType.toLowerCase() === \"bottom\" || entryId.includes(\"cursor-bottom\"))) {\n nextCursor = String(cursorValue);\n continue;\n }\n\n const sources: any[] = [];\n const c1 = content.content;\n const ic1 = c1?.itemContent;\n const tr1 = ic1?.tweet_results;\n if (tr1?.result) sources.push(tr1.result);\n const tr2 = content.tweet_results;\n if (tr2?.result) sources.push(tr2.result);\n const ic3 = content.itemContent;\n const tr3 = ic3?.tweet_results;\n if (tr3?.result) sources.push(tr3.result);\n const tr4 = (ic3 || c1 || ic1)?.tweet_results;\n const tweet4 = tr4?.result;\n if (tweet4?.tweet?.legacy) sources.push({ legacy: tweet4.tweet.legacy, core: tweet4.core, rest_id: tweet4.tweet.rest_id || tweet4.rest_id });\n for (const result of sources) allItems.push(...extractMediaFromTweetResult(result, username, seen));\n }\n }\n return { items: allItems, nextCursor };\n}\n\nfunction extractMediaFromTweetResult(result: any, username: string, seen: Set): XMediaItem[] {\n const items: XMediaItem[] = [];\n const legacy = result.legacy;\n const core = result.core;\n if (!legacy) return items;\n const userLegacy = core?.user_results?.result?.legacy;\n const screenName = userLegacy?.screen_name || username;\n const displayName = userLegacy?.name || screenName;\n const restId = result.rest_id || \"\";\n let mediaArr = legacy.retweeted_status_result?.result?.legacy?.extended_entities?.media || legacy.extended_entities?.media || legacy.entities?.media || [];\n const photos = mediaArr.filter((m: any) => m.type === \"photo\");\n for (const photo of photos) {\n const url = photo.media_url_https || photo.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const orig = photo.original_info;\n const large = photo.sizes?.large;\n items.push({\n id: `gql-${restId}-${url.split(\"/\").pop()}`,\n tweetId: restId,\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(screenName).toLowerCase(),\n userDisplayName: displayName,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nasync function scrapePage(username: string, authToken: string, csrfToken: string): Promise<{ items: XMediaItem[]; status: number }> {\n const pageRes = await fetch(`https://x.com/${username}/media`, {\n headers: pageHeaders(authToken, csrfToken, `https://x.com/${username}`),\n redirect: \"follow\",\n });\n if (pageRes.status === 403 || pageRes.status === 429) return { items: [], status: pageRes.status };\n if (!pageRes.ok) return { items: [], status: pageRes.status };\n const finalUrl = pageRes.url || \"\";\n const html = await pageRes.text();\n const isLoginPage = finalUrl.includes(\"login\") || html.length < 500 || html.includes('action=\"/login') || html.includes('href=\"/login') || html.includes('data-testid=\"login') || html.includes(\"Sign in to X\");\n if (isLoginPage) return { items: [], status: 401 };\n const stateScript = html.match(/]*>window\\.__INITIAL_STATE__\\s*=\\s*(\\{[\\s\\S]*?\\});?\\s*<\\/script>/i);\n if (stateScript) {\n try {\n const parsed = extractMediaFromNestedState(JSON.parse(stateScript[1]), username);\n if (parsed.length) return { items: parsed, status: 200 };\n } catch {}\n }\n return { items: extractMediaFromPage(html, username), status: 200 };\n}\n\nfunction extractMediaFromPage(html: string, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const texts = Array.from(html.matchAll(/\"full_text\"\\s*:\\s*\"((?:\\\\.|[^\"\\\\])*)\"/g)).map((m) => parseEscaped(m[1]));\n const dates = Array.from(html.matchAll(/\"created_at\"\\s*:\\s*\"(\\w+\\s+\\w+\\s+\\d+\\s+\\d+:\\d+:\\d+\\s+\\+\\d+\\s+\\d+)\"/g)).map((m) => m[1]);\n const likes = Array.from(html.matchAll(/\"favorite_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const retweets = Array.from(html.matchAll(/\"retweet_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const replies = Array.from(html.matchAll(/\"reply_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const ids = Array.from(html.matchAll(/\"rest_id\"\\s*:\\s*\"(\\d+)\"/g)).map((m) => m[1]);\n const screenNames = Array.from(html.matchAll(/\"screen_name\"\\s*:\\s*\"([^\"]+)\"/g)).map((m) => m[1]);\n for (const m of html.matchAll(/\"media_url_https\"\\s*:\\s*\"([^\"]+)\"/g)) seen.add(m[1]);\n const mediaUrls = Array.from(seen);\n for (let i = 0; i < mediaUrls.length && i < 200; i++) {\n const idx = Math.min(i, Math.max(texts.length, ids.length, 1) - 1);\n items.push({\n id: `page-${ids[idx] || i}-${i}`,\n tweetId: ids[idx] || `tweet-${i}`,\n tweetText: texts[idx] || \"\",\n createdAt: dates[idx] ? convertXDate(dates[idx]) : new Date().toISOString(),\n favoriteCount: likes[idx] || 0,\n retweetCount: retweets[idx] || 0,\n replyCount: replies[idx] || 0,\n mediaUrl: mediaUrls[i],\n mediaWidth: 1200,\n mediaHeight: 800,\n username: (screenNames[idx] || username).toLowerCase(),\n userDisplayName: screenNames[idx] || username,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nfunction parseEscaped(str: string): string {\n return str.replace(/\\\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)))\n .replace(/\\\\n/g, \" \").replace(/\\\\t/g, \" \").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\");\n}\n\nfunction convertXDate(d: string): string {\n const parsed = new Date(d);\n return Number.isNaN(parsed.getTime()) ? new Date().toISOString() : parsed.toISOString();\n}\n\nfunction extractMediaFromNestedState(state: any, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const walk = (obj: any, depth = 0): void => {\n if (depth > 30 || !obj || typeof obj !== \"object\") return;\n if (Array.isArray(obj)) { for (const v of obj) walk(v, depth + 1); return; }\n const legacy = obj.legacy;\n const media = legacy?.extended_entities?.media;\n if (media) {\n for (const ph of media.filter((m: any) => m.type === \"photo\")) {\n const url = ph.media_url_https || ph.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const userLegacy = obj.core?.user_results?.result?.legacy;\n const sn = userLegacy?.screen_name || username;\n const orig = ph.original_info;\n const large = ph.sizes?.large;\n items.push({\n id: `state-${obj.rest_id || \"tweet\"}-${url.split(\"/\").pop()}`,\n tweetId: obj.rest_id || \"\",\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(sn).toLowerCase(),\n userDisplayName: userLegacy?.name || sn,\n userAvatarUrl: \"\",\n });\n }\n }\n for (const val of Object.values(obj)) walk(val, depth + 1);\n };\n walk(state);\n return items;\n}\n\nasync function handleTwitterProxy(request: Request): Promise {\n const start = Date.now();\n try {\n const body = await request.json().catch(() => ({}));\n const username = String(body.username || \"\").trim().toLowerCase().replace(/^@/, \"\");\n const cursor = typeof body.cursor === \"string\" && body.cursor.trim() ? body.cursor.trim() : \"\";\n const { authToken, csrfToken } = normalizeCredentialInputs(String(body.authToken || \"\"), String(body.csrfToken || \"\"));\n if (!username || !authToken || !csrfToken) {\n return Response.json({\n items: [],\n error: !username ? \"Please provide a username.\" : !authToken ? \"No auth_token provided. Add your X session cookie in Settings.\" : \"No ct0 provided. Add the X CSRF cookie in Settings.\",\n errorType: !username ? \"not-found\" : \"no-auth\",\n } satisfies ProxyResponse);\n }\n console.log(`search @${username}; cursor present=${Boolean(cursor)}; auth present=${Boolean(authToken)}; ct0 present=${Boolean(csrfToken)}`);\n const gqlPage = await tryGraphQL(username, authToken, csrfToken, cursor);\n if (gqlPage && (gqlPage.items.length || cursor)) {\n const deduped = gqlPage.items.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`graphql success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped, nextCursor: gqlPage.nextCursor } satisfies ProxyResponse);\n }\n if (cursor) return Response.json({ items: [], nextCursor: null } satisfies ProxyResponse);\n\n const { items, status } = await scrapePage(username, authToken, csrfToken);\n if (status === 403) return Response.json({ items: [], error: \"Error 403: X blocked this Val Town server IP. Your tokens may still be valid.\", errorType: \"ip-block\", statusCode: 403 } satisfies ProxyResponse);\n if (status === 401) return Response.json({ items: [], error: \"Error 401: X rejected the session tokens. Update both auth_token and ct0.\", errorType: \"invalid-token\", statusCode: 401 } satisfies ProxyResponse);\n if (status === 429) return Response.json({ items: [], error: \"Error 429: X is rate-limiting this session. Wait a few minutes and try again.\", errorType: \"rate-limited\", statusCode: 429 } satisfies ProxyResponse);\n if (status !== 200) return Response.json({ items: [], error: `Error ${status}: X returned an unexpected response.`, errorType: \"server-error\", statusCode: status } satisfies ProxyResponse);\n if (!items.length) return Response.json({ items: [], error: `No photos found for @${username}.`, errorType: \"not-found\" } satisfies ProxyResponse);\n const deduped = items.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`page scrape success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped, nextCursor: null } satisfies ProxyResponse);\n } catch (err) {\n console.error(\"proxy error\", err);\n return Response.json({ items: [], error: `Proxy error: ${err instanceof Error ? err.message : \"Unknown failure\"}.`, errorType: \"server-error\" } satisfies ProxyResponse);\n }\n}\n\nfunction safeDownloadFilename(input: string | null, imageUrl: URL, contentType: string): string {\n const extensionFromType =\n contentType.includes(\"png\") ? \"png\" :\n contentType.includes(\"webp\") ? \"webp\" :\n contentType.includes(\"gif\") ? \"gif\" :\n \"jpg\";\n const base = (input || imageUrl.pathname.split(\"/\").pop() || \"x-photo\")\n .replace(/\\.[a-z0-9]{2,5}$/i, \"\")\n .replace(/[^a-z0-9._-]+/gi, \"-\")\n .replace(/^-+|-+$/g, \"\")\n .slice(0, 90) || \"x-photo\";\n return `${base}.${extensionFromType}`;\n}\n\nasync function handleImageDownload(request: Request): Promise {\n try {\n const { searchParams } = new URL(request.url);\n const rawUrl = searchParams.get(\"url\") || \"\";\n const imageUrl = new URL(rawUrl);\n const allowedHost = imageUrl.hostname === \"pbs.twimg.com\" || imageUrl.hostname.endsWith(\".twimg.com\");\n if (imageUrl.protocol !== \"https:\" || !allowedHost) {\n return new Response(\"Unsupported image URL.\", { status: 400 });\n }\n\n const imageRes = await fetch(imageUrl.toString(), {\n headers: {\n \"user-agent\": PAGE_UA,\n accept: \"image/avif,image/webp,image/png,image/jpeg,image/*,*/*;q=0.8\",\n referer: \"https://x.com/\",\n },\n });\n if (!imageRes.ok) return new Response(\"Image fetch failed.\", { status: imageRes.status });\n\n const contentType = imageRes.headers.get(\"content-type\") || \"image/jpeg\";\n if (!contentType.startsWith(\"image/\")) return new Response(\"URL did not return an image.\", { status: 415 });\n\n const filename = safeDownloadFilename(searchParams.get(\"filename\"), imageUrl, contentType);\n const body = await imageRes.arrayBuffer();\n return new Response(body, {\n headers: {\n \"content-type\": contentType,\n \"content-length\": String(body.byteLength),\n \"content-disposition\": `attachment; filename=\"${filename}\"`,\n \"cache-control\": \"private, max-age=3600\",\n },\n });\n } catch (err) {\n console.error(\"download error\", err);\n return new Response(\"Could not prepare image download.\", { status: 400 });\n }\n}\n\nexport default staticHTTPServer(import.meta.url, async (request: Request) => {\n const { pathname } = new URL(request.url);\n if (pathname === \"/api/download\" && request.method === \"GET\") return handleImageDownload(request);\n if (pathname === \"/api/twitter-proxy\" && request.method === \"POST\") return handleTwitterProxy(request);\n if (pathname === \"/api/twitter-proxy\") return Response.json({ items: [], error: \"Use POST with username, authToken, and csrfToken.\" }, { status: 405 });\n return null;\n});\n","children",[],[281],["D",1784513343196],[],[18],"286e4941-2132-4260-8a39-4aeef40abbcd","fonts","a4a9ec80-7969-11f1-adfa-1607ee4eb77e",4,["D",1783363006620],"directory",[],[294],["D",1783362593740],["D",1789522836959],{"_11":12,"_236":81},{"_11":12,"_231":232,"_80":81,"_30":79,"_233":234,"_235":24},{"_52":178,"_13":16,"_46":49,"_223":184,"_224":-5,"_225":-5,"_226":-5,"_227":-5,"_228":-5,"_229":14,"_230":12},"ctx",{"_65":-5,"_255":339,"_340":341,"_342":343,"_344":24,"_345":24,"_346":24,"_347":197,"_348":-5,"_349":-7,"_350":-7,"_351":26,"_352":24,"_353":24,"_354":-5,"_355":24,"_356":24,"_357":24,"_358":-5},"ENV",{"_310":311,"_312":313,"_314":16,"_315":316,"_317":318,"_319":320,"_321":322,"_323":324,"_325":326,"_327":328,"_329":330,"_331":332,"_333":334,"_335":336,"_337":338},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · index.html