[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_183":184,"_185":186},"routes/_app.x.$handle.$name",{"_99":98,"_32":45,"_108":89,"_27":109,"_13":14,"_110":-5,"_11":111,"_112":113,"_114":115,"_116":117,"_118":119,"_20":-5,"_120":-5,"_121":-5,"_122":25,"_123":124,"_125":58,"_126":-5,"_127":-5,"_128":129},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":25},"version",7,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","ae96ef46-7968-11f1-b7df-1607ee4eb77e","name","fileType","http","content","import { staticHTTPServer } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst X_BEARER_TOKEN =\n \"AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNw%2Fqg7b4qFBR5Y3AbgzZbco4g0%3DCF79kW2gNRLSTCAS6saOfT2Oc8s2u6YJUPIncoBH67t6DY7E7a\";\n\nconst PAGE_UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\";\n\nconst GQL_FEATURES = {\n responsive_web_graphql_timeline_navigation_enabled: true,\n unified_cards_ad_metadata_container_dynamic_card_content_query_enabled: true,\n responsive_web_graphql_exclude_directive_enabled: true,\n verified_phone_label_enabled: false,\n creator_subscriptions_tweet_preview_api_enabled: true,\n interactive_text_enabled: true,\n vibe_api_enabled: true,\n responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,\n responsive_web_twitter_article_notes_tab_enabled: false,\n subscriptions_verification_info_is_identity_verified_enabled: true,\n subscriptions_verification_info_verified_since_enabled: true,\n highlights_tweets_tab_ui_enabled: true,\n subscriptions_feature_can_gift_premium: true,\n hidden_profile_likes_enabled: true,\n hidden_profile_subscriptions_enabled: true,\n};\n\nconst GQL_FIELD_TOGGLES = { withAuxiliaryUserLabels: false };\n\nconst FALLBACK_QUERY_IDS = [\n { userMedia: \"oUue9m948p46e7f_u0Yvug\", userByScreenName: \"s_7_S_S_S_S_S_S_S_S_S_S\" },\n { userMedia: \"V8E5T_pN7H5e_nK6kN6zZA\", userByScreenName: \"7N9G2V7c3p6oN5eT4p8sXA\" },\n { userMedia: \"SSoGHi3s7TQ9H3s7TQ9H3s\", userByScreenName: \"GtKpDd7s3qH4a3s7TQ9H3s\" },\n];\n\ntype XMediaItem = {\n id: string;\n tweetId: string;\n tweetText: string;\n createdAt: string;\n favoriteCount: number;\n retweetCount: number;\n replyCount: number;\n mediaUrl: string;\n mediaWidth: number;\n mediaHeight: number;\n username: string;\n userDisplayName: string;\n userAvatarUrl: string;\n};\n\ntype ProxyResponse = {\n items: XMediaItem[];\n error?: string;\n errorType?: string;\n statusCode?: number;\n xError?: string;\n};\n\nfunction cleanCookieValue(value: string): string {\n return value.trim().replace(/^[\"']|[\"']$/g, \"\");\n}\n\nfunction readCookieValue(input: string, name: \"auth_token\" | \"ct0\"): string {\n const trimmed = input.trim().replace(/^cookie:\\s*/i, \"\");\n const pairs = trimmed.split(/[;\\n]/);\n for (const pair of pairs) {\n const eq = pair.indexOf(\"=\");\n if (eq === -1) continue;\n const key = pair.slice(0, eq).trim();\n const value = pair.slice(eq + 1).trim();\n if (key === name) return cleanCookieValue(value);\n }\n return \"\";\n}\n\nfunction normalizeCredentialInputs(authInput: string, csrfInput: string) {\n const authToken =\n readCookieValue(authInput, \"auth_token\") ||\n readCookieValue(csrfInput, \"auth_token\") ||\n cleanCookieValue(authInput);\n const csrfToken =\n readCookieValue(authInput, \"ct0\") ||\n readCookieValue(csrfInput, \"ct0\") ||\n cleanCookieValue(csrfInput);\n return { authToken, csrfToken };\n}\n\nfunction buildCookieString(authToken: string, csrfToken: string): string {\n let c = `auth_token=${cleanCookieValue(authToken)}`;\n if (csrfToken) c += `; ct0=${cleanCookieValue(csrfToken)}`;\n return c;\n}\n\nfunction pageHeaders(authToken: string, csrfToken: string, referer: string): Record {\n return {\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"document\",\n \"sec-fetch-mode\": \"navigate\",\n \"sec-fetch-site\": \"none\",\n cookie: buildCookieString(authToken, csrfToken),\n referer,\n origin: \"https://x.com\",\n \"x-csrf-token\": csrfToken,\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n };\n}\n\nfunction apiHeaders(authToken: string, csrfToken: string): Record {\n return {\n authorization: `Bearer ${X_BEARER_TOKEN}`,\n \"x-csrf-token\": csrfToken,\n cookie: buildCookieString(authToken, csrfToken),\n \"content-type\": \"application/json\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"*/*\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"empty\",\n \"sec-fetch-mode\": \"cors\",\n \"sec-fetch-site\": \"same-site\",\n referer: \"https://x.com/\",\n origin: \"https://x.com\",\n };\n}\n\nfunction extractQueryIds(source: string): Record {\n const ids: Record = {};\n const operationNames = \"(UserMedia|UserByScreenName)\";\n const patterns = [\n new RegExp(`queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"'][\\\\s\\\\S]{0,800}?operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n new RegExp(`operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"'][\\\\s\\\\S]{0,800}?queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`[\"']${operationNames}[\"']\\\\s*,\\\\s*queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']\\\\s*,\\\\s*operationName\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n ];\n for (const pattern of patterns) {\n for (const match of source.matchAll(pattern)) {\n const first = match[1];\n const second = match[2];\n const queryId = /^[a-zA-Z0-9_-]+$/.test(first) && first !== \"UserMedia\" && first !== \"UserByScreenName\" ? first : second;\n const operation = first === queryId ? second : first;\n if ((operation === \"UserMedia\" || operation === \"UserByScreenName\") && queryId) ids[operation] = queryId;\n }\n }\n return ids;\n}\n\nlet queryIdCache: { userMedia: string; userByScreenName: string } | null | undefined;\nasync function discoverQueryIds(): Promise<{ userMedia: string; userByScreenName: string } | null> {\n if (queryIdCache !== undefined) return queryIdCache;\n try {\n const res = await fetch(\"https://x.com/\", { headers: { \"User-Agent\": PAGE_UA, Accept: \"text/html\" } });\n const html = await res.text();\n const ids = extractQueryIds(html);\n if (ids.UserMedia && ids.UserByScreenName) {\n queryIdCache = { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName };\n return queryIdCache;\n }\n const bundleUrls = new Set();\n for (const match of html.matchAll(/]+src=[\"']([^\"']+)[\"']/g)) {\n try {\n const url = new URL(match[1], \"https://x.com/\");\n if (/\\.(?:js|mjs)(?:$|\\?)/.test(url.pathname) && (url.hostname.endsWith(\"x.com\") || url.hostname.endsWith(\"twimg.com\"))) bundleUrls.add(url.toString());\n } catch {}\n }\n for (const bundleUrl of bundleUrls) {\n if (ids.UserMedia && ids.UserByScreenName) break;\n try {\n const bundleRes = await fetch(bundleUrl, { headers: { \"User-Agent\": PAGE_UA, Accept: \"*/*\" } });\n Object.assign(ids, extractQueryIds(await bundleRes.text()));\n } catch {}\n }\n queryIdCache = ids.UserMedia && ids.UserByScreenName ? { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName } : null;\n return queryIdCache;\n } catch (err) {\n console.error(\"query id discovery failed\", err);\n queryIdCache = null;\n return null;\n }\n}\n\nasync function gqlFetch(method: \"GET\" | \"POST\", url: string, authToken: string, csrfToken: string, body?: Record) {\n let fullUrl = url;\n const opts: RequestInit = { method, headers: apiHeaders(authToken, csrfToken) };\n if (method === \"GET\" && body) {\n const flat: Record = {};\n for (const [k, v] of Object.entries(body)) flat[k] = typeof v === \"object\" ? JSON.stringify(v) : String(v);\n fullUrl = `${url}?${new URLSearchParams(flat).toString()}`;\n } else if (method === \"POST\" && body) {\n opts.body = JSON.stringify(body);\n }\n return fetch(fullUrl, opts);\n}\n\nasync function resolveUserId(username: string, authToken: string, csrfToken: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userByScreenName}/UserByScreenName`;\n const body = { variables: { screen_name: username, withSafetyModeUserFields: true }, features: GQL_FEATURES, fieldToggles: GQL_FIELD_TOGGLES };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) break;\n if (!res.ok) continue;\n try {\n const data = await res.json();\n const uid = data?.data?.user?.result?.rest_id || data?.data?.user_result?.result?.rest_id || null;\n if (uid) return uid;\n } catch {}\n }\n }\n return null;\n}\n\nasync function fetchUserMediaGql(userId: string, username: string, authToken: string, csrfToken: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userMedia}/UserMedia`;\n const body = {\n variables: { userId, count: 24, cursor: null, includePromotedContent: false, withClientEventToken: false, withBirdwatchNotes: false, withVoice: false, withV2Timeline: true },\n features: GQL_FEATURES,\n fieldToggles: GQL_FIELD_TOGGLES,\n };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) return null;\n if (!res.ok) continue;\n try {\n const items = parseGraphQLResponse(await res.json(), username);\n if (items.length) return items;\n } catch {}\n }\n }\n return null;\n}\n\nasync function tryGraphQL(username: string, authToken: string, csrfToken: string): Promise {\n const userId = await resolveUserId(username, authToken, csrfToken);\n if (!userId) return null;\n return fetchUserMediaGql(userId, username, authToken, csrfToken);\n}\n\nfunction parseGraphQLResponse(data: any, username: string): XMediaItem[] {\n const allItems: XMediaItem[] = [];\n const seen = new Set();\n const instructions =\n data?.data?.user?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user?.result?.timeline?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline?.timeline?.instructions ||\n [];\n for (const instruction of instructions) {\n if (instruction.type !== \"TimelineAddEntries\" && instruction.type !== \"TimelineTimelineItem\") continue;\n const entries = instruction.entries || [];\n for (const entry of entries) {\n const content = entry.content || entry;\n const sources: any[] = [];\n const c1 = content.content;\n const ic1 = c1?.itemContent;\n const tr1 = ic1?.tweet_results;\n if (tr1?.result) sources.push(tr1.result);\n const tr2 = content.tweet_results;\n if (tr2?.result) sources.push(tr2.result);\n const ic3 = content.itemContent;\n const tr3 = ic3?.tweet_results;\n if (tr3?.result) sources.push(tr3.result);\n const tr4 = (ic3 || c1 || ic1)?.tweet_results;\n const tweet4 = tr4?.result;\n if (tweet4?.tweet?.legacy) sources.push({ legacy: tweet4.tweet.legacy, core: tweet4.core, rest_id: tweet4.tweet.rest_id || tweet4.rest_id });\n for (const result of sources) allItems.push(...extractMediaFromTweetResult(result, username, seen));\n }\n }\n return allItems;\n}\n\nfunction extractMediaFromTweetResult(result: any, username: string, seen: Set): XMediaItem[] {\n const items: XMediaItem[] = [];\n const legacy = result.legacy;\n const core = result.core;\n if (!legacy) return items;\n const userLegacy = core?.user_results?.result?.legacy;\n const screenName = userLegacy?.screen_name || username;\n const displayName = userLegacy?.name || screenName;\n const restId = result.rest_id || \"\";\n let mediaArr = legacy.retweeted_status_result?.result?.legacy?.extended_entities?.media || legacy.extended_entities?.media || legacy.entities?.media || [];\n const photos = mediaArr.filter((m: any) => m.type === \"photo\");\n for (const photo of photos) {\n const url = photo.media_url_https || photo.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const orig = photo.original_info;\n const large = photo.sizes?.large;\n items.push({\n id: `gql-${restId}-${url.split(\"/\").pop()}`,\n tweetId: restId,\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(screenName).toLowerCase(),\n userDisplayName: displayName,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nasync function scrapePage(username: string, authToken: string, csrfToken: string): Promise<{ items: XMediaItem[]; status: number }> {\n const pageRes = await fetch(`https://x.com/${username}/media`, {\n headers: pageHeaders(authToken, csrfToken, `https://x.com/${username}`),\n redirect: \"follow\",\n });\n if (pageRes.status === 403 || pageRes.status === 429) return { items: [], status: pageRes.status };\n if (!pageRes.ok) return { items: [], status: pageRes.status };\n const finalUrl = pageRes.url || \"\";\n const html = await pageRes.text();\n const isLoginPage = finalUrl.includes(\"login\") || html.length < 500 || html.includes('action=\"/login') || html.includes('href=\"/login') || html.includes('data-testid=\"login') || html.includes(\"Sign in to X\");\n if (isLoginPage) return { items: [], status: 401 };\n const stateScript = html.match(/]*>window\\.__INITIAL_STATE__\\s*=\\s*(\\{[\\s\\S]*?\\});?\\s*<\\/script>/i);\n if (stateScript) {\n try {\n const parsed = extractMediaFromNestedState(JSON.parse(stateScript[1]), username);\n if (parsed.length) return { items: parsed, status: 200 };\n } catch {}\n }\n return { items: extractMediaFromPage(html, username), status: 200 };\n}\n\nfunction extractMediaFromPage(html: string, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const texts = Array.from(html.matchAll(/\"full_text\"\\s*:\\s*\"((?:\\\\.|[^\"\\\\])*)\"/g)).map((m) => parseEscaped(m[1]));\n const dates = Array.from(html.matchAll(/\"created_at\"\\s*:\\s*\"(\\w+\\s+\\w+\\s+\\d+\\s+\\d+:\\d+:\\d+\\s+\\+\\d+\\s+\\d+)\"/g)).map((m) => m[1]);\n const likes = Array.from(html.matchAll(/\"favorite_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const retweets = Array.from(html.matchAll(/\"retweet_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const replies = Array.from(html.matchAll(/\"reply_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const ids = Array.from(html.matchAll(/\"rest_id\"\\s*:\\s*\"(\\d+)\"/g)).map((m) => m[1]);\n const screenNames = Array.from(html.matchAll(/\"screen_name\"\\s*:\\s*\"([^\"]+)\"/g)).map((m) => m[1]);\n for (const m of html.matchAll(/\"media_url_https\"\\s*:\\s*\"([^\"]+)\"/g)) seen.add(m[1]);\n const mediaUrls = Array.from(seen);\n for (let i = 0; i < mediaUrls.length && i < 200; i++) {\n const idx = Math.min(i, Math.max(texts.length, ids.length, 1) - 1);\n items.push({\n id: `page-${ids[idx] || i}-${i}`,\n tweetId: ids[idx] || `tweet-${i}`,\n tweetText: texts[idx] || \"\",\n createdAt: dates[idx] ? convertXDate(dates[idx]) : new Date().toISOString(),\n favoriteCount: likes[idx] || 0,\n retweetCount: retweets[idx] || 0,\n replyCount: replies[idx] || 0,\n mediaUrl: mediaUrls[i],\n mediaWidth: 1200,\n mediaHeight: 800,\n username: (screenNames[idx] || username).toLowerCase(),\n userDisplayName: screenNames[idx] || username,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nfunction parseEscaped(str: string): string {\n return str.replace(/\\\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)))\n .replace(/\\\\n/g, \" \").replace(/\\\\t/g, \" \").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\");\n}\n\nfunction convertXDate(d: string): string {\n const parsed = new Date(d);\n return Number.isNaN(parsed.getTime()) ? new Date().toISOString() : parsed.toISOString();\n}\n\nfunction extractMediaFromNestedState(state: any, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const walk = (obj: any, depth = 0): void => {\n if (depth > 30 || !obj || typeof obj !== \"object\") return;\n if (Array.isArray(obj)) { for (const v of obj) walk(v, depth + 1); return; }\n const legacy = obj.legacy;\n const media = legacy?.extended_entities?.media;\n if (media) {\n for (const ph of media.filter((m: any) => m.type === \"photo\")) {\n const url = ph.media_url_https || ph.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const userLegacy = obj.core?.user_results?.result?.legacy;\n const sn = userLegacy?.screen_name || username;\n const orig = ph.original_info;\n const large = ph.sizes?.large;\n items.push({\n id: `state-${obj.rest_id || \"tweet\"}-${url.split(\"/\").pop()}`,\n tweetId: obj.rest_id || \"\",\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(sn).toLowerCase(),\n userDisplayName: userLegacy?.name || sn,\n userAvatarUrl: \"\",\n });\n }\n }\n for (const val of Object.values(obj)) walk(val, depth + 1);\n };\n walk(state);\n return items;\n}\n\nasync function handleTwitterProxy(request: Request): Promise {\n const start = Date.now();\n try {\n const body = await request.json().catch(() => ({}));\n const username = String(body.username || \"\").trim().toLowerCase().replace(/^@/, \"\");\n const { authToken, csrfToken } = normalizeCredentialInputs(String(body.authToken || \"\"), String(body.csrfToken || \"\"));\n if (!username || !authToken || !csrfToken) {\n return Response.json({\n items: [],\n error: !username ? \"Please provide a username.\" : !authToken ? \"No auth_token provided. Add your X session cookie in Settings.\" : \"No ct0 provided. Add the X CSRF cookie in Settings.\",\n errorType: !username ? \"not-found\" : \"no-auth\",\n } satisfies ProxyResponse);\n }\n console.log(`search @${username}; auth present=${Boolean(authToken)}; ct0 present=${Boolean(csrfToken)}`);\n const gqlItems = await tryGraphQL(username, authToken, csrfToken);\n if (gqlItems?.length) {\n const deduped = gqlItems.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`graphql success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped } satisfies ProxyResponse);\n }\n const { items, status } = await scrapePage(username, authToken, csrfToken);\n if (status === 403) return Response.json({ items: [], error: \"Error 403: X blocked this Val Town server IP. Your tokens may still be valid.\", errorType: \"ip-block\", statusCode: 403 } satisfies ProxyResponse);\n if (status === 401) return Response.json({ items: [], error: \"Error 401: X rejected the session tokens. Update both auth_token and ct0.\", errorType: \"invalid-token\", statusCode: 401 } satisfies ProxyResponse);\n if (status === 429) return Response.json({ items: [], error: \"Error 429: X is rate-limiting this session. Wait a few minutes and try again.\", errorType: \"rate-limited\", statusCode: 429 } satisfies ProxyResponse);\n if (status !== 200) return Response.json({ items: [], error: `Error ${status}: X returned an unexpected response.`, errorType: \"server-error\", statusCode: status } satisfies ProxyResponse);\n if (!items.length) return Response.json({ items: [], error: `No photos found for @${username}.`, errorType: \"not-found\" } satisfies ProxyResponse);\n const deduped = items.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`page scrape success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped } satisfies ProxyResponse);\n } catch (err) {\n console.error(\"proxy error\", err);\n return Response.json({ items: [], error: `Proxy error: ${err instanceof Error ? err.message : \"Unknown failure\"}.`, errorType: \"server-error\" } satisfies ProxyResponse);\n }\n}\n\nexport default staticHTTPServer(import.meta.url, async (request: Request) => {\n const { pathname } = new URL(request.url);\n if (pathname === \"/api/twitter-proxy\" && request.method === \"POST\") return handleTwitterProxy(request);\n if (pathname === \"/api/twitter-proxy\") return Response.json({ items: [], error: \"Use POST with username, authToken, and csrfToken.\" }, { status: 405 });\n return null;\n});\n","import { staticHTTPServer } from \"https://esm.town/v/std/utils/index.ts\";\n\nconst X_BEARER_TOKEN =\n \"AAAAAAAAAAAAAAAAAAAAANRILgAAAAAAnNw%2Fqg7b4qFBR5Y3AbgzZbco4g0%3DCF79kW2gNRLSTCAS6saOfT2Oc8s2u6YJUPIncoBH67t6DY7E7a\";\n\nconst PAGE_UA =\n \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36\";\n\nconst GQL_FEATURES = {\n responsive_web_graphql_timeline_navigation_enabled: true,\n unified_cards_ad_metadata_container_dynamic_card_content_query_enabled: true,\n responsive_web_graphql_exclude_directive_enabled: true,\n verified_phone_label_enabled: false,\n creator_subscriptions_tweet_preview_api_enabled: true,\n interactive_text_enabled: true,\n vibe_api_enabled: true,\n responsive_web_graphql_skip_user_profile_image_extensions_enabled: false,\n responsive_web_twitter_article_notes_tab_enabled: false,\n subscriptions_verification_info_is_identity_verified_enabled: true,\n subscriptions_verification_info_verified_since_enabled: true,\n highlights_tweets_tab_ui_enabled: true,\n subscriptions_feature_can_gift_premium: true,\n hidden_profile_likes_enabled: true,\n hidden_profile_subscriptions_enabled: true,\n};\n\nconst GQL_FIELD_TOGGLES = { withAuxiliaryUserLabels: false };\n\nconst FALLBACK_QUERY_IDS = [\n { userMedia: \"oUue9m948p46e7f_u0Yvug\", userByScreenName: \"s_7_S_S_S_S_S_S_S_S_S_S\" },\n { userMedia: \"V8E5T_pN7H5e_nK6kN6zZA\", userByScreenName: \"7N9G2V7c3p6oN5eT4p8sXA\" },\n { userMedia: \"SSoGHi3s7TQ9H3s7TQ9H3s\", userByScreenName: \"GtKpDd7s3qH4a3s7TQ9H3s\" },\n];\n\ntype XMediaItem = {\n id: string;\n tweetId: string;\n tweetText: string;\n createdAt: string;\n favoriteCount: number;\n retweetCount: number;\n replyCount: number;\n mediaUrl: string;\n mediaWidth: number;\n mediaHeight: number;\n username: string;\n userDisplayName: string;\n userAvatarUrl: string;\n};\n\ntype ProxyResponse = {\n items: XMediaItem[];\n nextCursor?: string | null;\n error?: string;\n errorType?: string;\n statusCode?: number;\n xError?: string;\n};\n\ntype MediaPage = {\n items: XMediaItem[];\n nextCursor: string | null;\n};\n\nfunction cleanCookieValue(value: string): string {\n return value.trim().replace(/^[\"']|[\"']$/g, \"\");\n}\n\nfunction readCookieValue(input: string, name: \"auth_token\" | \"ct0\"): string {\n const trimmed = input.trim().replace(/^cookie:\\s*/i, \"\");\n const pairs = trimmed.split(/[;\\n]/);\n for (const pair of pairs) {\n const eq = pair.indexOf(\"=\");\n if (eq === -1) continue;\n const key = pair.slice(0, eq).trim();\n const value = pair.slice(eq + 1).trim();\n if (key === name) return cleanCookieValue(value);\n }\n return \"\";\n}\n\nfunction normalizeCredentialInputs(authInput: string, csrfInput: string) {\n const authToken =\n readCookieValue(authInput, \"auth_token\") ||\n readCookieValue(csrfInput, \"auth_token\") ||\n cleanCookieValue(authInput);\n const csrfToken =\n readCookieValue(authInput, \"ct0\") ||\n readCookieValue(csrfInput, \"ct0\") ||\n cleanCookieValue(csrfInput);\n return { authToken, csrfToken };\n}\n\nfunction buildCookieString(authToken: string, csrfToken: string): string {\n let c = `auth_token=${cleanCookieValue(authToken)}`;\n if (csrfToken) c += `; ct0=${cleanCookieValue(csrfToken)}`;\n return c;\n}\n\nfunction pageHeaders(authToken: string, csrfToken: string, referer: string): Record {\n return {\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"document\",\n \"sec-fetch-mode\": \"navigate\",\n \"sec-fetch-site\": \"none\",\n cookie: buildCookieString(authToken, csrfToken),\n referer,\n origin: \"https://x.com\",\n \"x-csrf-token\": csrfToken,\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n };\n}\n\nfunction apiHeaders(authToken: string, csrfToken: string): Record {\n return {\n authorization: `Bearer ${X_BEARER_TOKEN}`,\n \"x-csrf-token\": csrfToken,\n cookie: buildCookieString(authToken, csrfToken),\n \"content-type\": \"application/json\",\n \"x-twitter-active-user\": \"yes\",\n \"x-twitter-client-language\": \"en\",\n \"x-twitter-auth-type\": \"OAuth2Session\",\n \"user-agent\": PAGE_UA,\n \"sec-ch-ua\": '\"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"',\n \"sec-ch-ua-mobile\": \"?0\",\n \"sec-ch-ua-platform\": '\"macOS\"',\n accept: \"*/*\",\n \"accept-language\": \"en-US,en;q=0.9\",\n \"cache-control\": \"no-cache\",\n pragma: \"no-cache\",\n \"sec-fetch-dest\": \"empty\",\n \"sec-fetch-mode\": \"cors\",\n \"sec-fetch-site\": \"same-site\",\n referer: \"https://x.com/\",\n origin: \"https://x.com\",\n };\n}\n\nfunction extractQueryIds(source: string): Record {\n const ids: Record = {};\n const operationNames = \"(UserMedia|UserByScreenName)\";\n const patterns = [\n new RegExp(`queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"'][\\\\s\\\\S]{0,800}?operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n new RegExp(`operationName[\"']?\\\\s*:\\\\s*[\"']${operationNames}[\"'][\\\\s\\\\S]{0,800}?queryId[\"']?\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`[\"']${operationNames}[\"']\\\\s*,\\\\s*queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']`, \"g\"),\n new RegExp(`queryId\\\\s*:\\\\s*[\"']([a-zA-Z0-9_-]+)[\"']\\\\s*,\\\\s*operationName\\\\s*:\\\\s*[\"']${operationNames}[\"']`, \"g\"),\n ];\n for (const pattern of patterns) {\n for (const match of source.matchAll(pattern)) {\n const first = match[1];\n const second = match[2];\n const queryId = /^[a-zA-Z0-9_-]+$/.test(first) && first !== \"UserMedia\" && first !== \"UserByScreenName\" ? first : second;\n const operation = first === queryId ? second : first;\n if ((operation === \"UserMedia\" || operation === \"UserByScreenName\") && queryId) ids[operation] = queryId;\n }\n }\n return ids;\n}\n\nlet queryIdCache: { userMedia: string; userByScreenName: string } | null | undefined;\nasync function discoverQueryIds(): Promise<{ userMedia: string; userByScreenName: string } | null> {\n if (queryIdCache !== undefined) return queryIdCache;\n try {\n const res = await fetch(\"https://x.com/\", { headers: { \"User-Agent\": PAGE_UA, Accept: \"text/html\" } });\n const html = await res.text();\n const ids = extractQueryIds(html);\n if (ids.UserMedia && ids.UserByScreenName) {\n queryIdCache = { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName };\n return queryIdCache;\n }\n const bundleUrls = new Set();\n for (const match of html.matchAll(/]+src=[\"']([^\"']+)[\"']/g)) {\n try {\n const url = new URL(match[1], \"https://x.com/\");\n if (/\\.(?:js|mjs)(?:$|\\?)/.test(url.pathname) && (url.hostname.endsWith(\"x.com\") || url.hostname.endsWith(\"twimg.com\"))) bundleUrls.add(url.toString());\n } catch {}\n }\n for (const bundleUrl of bundleUrls) {\n if (ids.UserMedia && ids.UserByScreenName) break;\n try {\n const bundleRes = await fetch(bundleUrl, { headers: { \"User-Agent\": PAGE_UA, Accept: \"*/*\" } });\n Object.assign(ids, extractQueryIds(await bundleRes.text()));\n } catch {}\n }\n queryIdCache = ids.UserMedia && ids.UserByScreenName ? { userMedia: ids.UserMedia, userByScreenName: ids.UserByScreenName } : null;\n return queryIdCache;\n } catch (err) {\n console.error(\"query id discovery failed\", err);\n queryIdCache = null;\n return null;\n }\n}\n\nasync function gqlFetch(method: \"GET\" | \"POST\", url: string, authToken: string, csrfToken: string, body?: Record) {\n let fullUrl = url;\n const opts: RequestInit = { method, headers: apiHeaders(authToken, csrfToken) };\n if (method === \"GET\" && body) {\n const flat: Record = {};\n for (const [k, v] of Object.entries(body)) flat[k] = typeof v === \"object\" ? JSON.stringify(v) : String(v);\n fullUrl = `${url}?${new URLSearchParams(flat).toString()}`;\n } else if (method === \"POST\" && body) {\n opts.body = JSON.stringify(body);\n }\n return fetch(fullUrl, opts);\n}\n\nasync function resolveUserId(username: string, authToken: string, csrfToken: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userByScreenName}/UserByScreenName`;\n const body = { variables: { screen_name: username, withSafetyModeUserFields: true }, features: GQL_FEATURES, fieldToggles: GQL_FIELD_TOGGLES };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) break;\n if (!res.ok) continue;\n try {\n const data = await res.json();\n const uid = data?.data?.user?.result?.rest_id || data?.data?.user_result?.result?.rest_id || null;\n if (uid) return uid;\n } catch {}\n }\n }\n return null;\n}\n\nasync function fetchUserMediaGql(userId: string, username: string, authToken: string, csrfToken: string, cursor?: string): Promise {\n const discovered = await discoverQueryIds();\n const candidates = discovered ? [discovered, ...FALLBACK_QUERY_IDS] : FALLBACK_QUERY_IDS;\n for (const ids of candidates) {\n const baseUrl = `https://x.com/i/api/graphql/${ids.userMedia}/UserMedia`;\n const body = {\n variables: { userId, count: 24, cursor: cursor || null, includePromotedContent: false, withClientEventToken: false, withBirdwatchNotes: false, withVoice: false, withV2Timeline: true },\n features: GQL_FEATURES,\n fieldToggles: GQL_FIELD_TOGGLES,\n };\n for (const method of [\"POST\", \"GET\"] as const) {\n const res = await gqlFetch(method, baseUrl, authToken, csrfToken, body);\n if (res.status === 429) return null;\n if (!res.ok) continue;\n try {\n const page = parseGraphQLResponse(await res.json(), username);\n if (page.items.length || page.nextCursor) return page;\n } catch {}\n }\n }\n return null;\n}\n\nasync function tryGraphQL(username: string, authToken: string, csrfToken: string, cursor?: string): Promise {\n const userId = await resolveUserId(username, authToken, csrfToken);\n if (!userId) return null;\n return fetchUserMediaGql(userId, username, authToken, csrfToken, cursor);\n}\n\nfunction parseGraphQLResponse(data: any, username: string): MediaPage {\n const allItems: XMediaItem[] = [];\n const seen = new Set();\n let nextCursor: string | null = null;\n const instructions =\n data?.data?.user?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_response?.timeline?.instructions ||\n data?.data?.user?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline_v2?.timeline?.instructions ||\n data?.data?.user?.result?.timeline?.timeline?.instructions ||\n data?.data?.user_result?.result?.timeline?.timeline?.instructions ||\n [];\n for (const instruction of instructions) {\n if (instruction.type !== \"TimelineAddEntries\" && instruction.type !== \"TimelineTimelineItem\") continue;\n const entries = instruction.entries || (instruction.entry ? [instruction.entry] : [instruction]);\n for (const entry of entries) {\n const content = entry.content || entry;\n const cursorValue = content.value || content.cursor?.value;\n const cursorType = String(content.cursorType || content.cursor?.cursorType || \"\");\n const entryId = String(entry.entryId || \"\");\n if (cursorValue && (cursorType.toLowerCase() === \"bottom\" || entryId.includes(\"cursor-bottom\"))) {\n nextCursor = String(cursorValue);\n continue;\n }\n\n const sources: any[] = [];\n const c1 = content.content;\n const ic1 = c1?.itemContent;\n const tr1 = ic1?.tweet_results;\n if (tr1?.result) sources.push(tr1.result);\n const tr2 = content.tweet_results;\n if (tr2?.result) sources.push(tr2.result);\n const ic3 = content.itemContent;\n const tr3 = ic3?.tweet_results;\n if (tr3?.result) sources.push(tr3.result);\n const tr4 = (ic3 || c1 || ic1)?.tweet_results;\n const tweet4 = tr4?.result;\n if (tweet4?.tweet?.legacy) sources.push({ legacy: tweet4.tweet.legacy, core: tweet4.core, rest_id: tweet4.tweet.rest_id || tweet4.rest_id });\n for (const result of sources) allItems.push(...extractMediaFromTweetResult(result, username, seen));\n }\n }\n return { items: allItems, nextCursor };\n}\n\nfunction extractMediaFromTweetResult(result: any, username: string, seen: Set): XMediaItem[] {\n const items: XMediaItem[] = [];\n const legacy = result.legacy;\n const core = result.core;\n if (!legacy) return items;\n const userLegacy = core?.user_results?.result?.legacy;\n const screenName = userLegacy?.screen_name || username;\n const displayName = userLegacy?.name || screenName;\n const restId = result.rest_id || \"\";\n let mediaArr = legacy.retweeted_status_result?.result?.legacy?.extended_entities?.media || legacy.extended_entities?.media || legacy.entities?.media || [];\n const photos = mediaArr.filter((m: any) => m.type === \"photo\");\n for (const photo of photos) {\n const url = photo.media_url_https || photo.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const orig = photo.original_info;\n const large = photo.sizes?.large;\n items.push({\n id: `gql-${restId}-${url.split(\"/\").pop()}`,\n tweetId: restId,\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(screenName).toLowerCase(),\n userDisplayName: displayName,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nasync function scrapePage(username: string, authToken: string, csrfToken: string): Promise<{ items: XMediaItem[]; status: number }> {\n const pageRes = await fetch(`https://x.com/${username}/media`, {\n headers: pageHeaders(authToken, csrfToken, `https://x.com/${username}`),\n redirect: \"follow\",\n });\n if (pageRes.status === 403 || pageRes.status === 429) return { items: [], status: pageRes.status };\n if (!pageRes.ok) return { items: [], status: pageRes.status };\n const finalUrl = pageRes.url || \"\";\n const html = await pageRes.text();\n const isLoginPage = finalUrl.includes(\"login\") || html.length < 500 || html.includes('action=\"/login') || html.includes('href=\"/login') || html.includes('data-testid=\"login') || html.includes(\"Sign in to X\");\n if (isLoginPage) return { items: [], status: 401 };\n const stateScript = html.match(/]*>window\\.__INITIAL_STATE__\\s*=\\s*(\\{[\\s\\S]*?\\});?\\s*<\\/script>/i);\n if (stateScript) {\n try {\n const parsed = extractMediaFromNestedState(JSON.parse(stateScript[1]), username);\n if (parsed.length) return { items: parsed, status: 200 };\n } catch {}\n }\n return { items: extractMediaFromPage(html, username), status: 200 };\n}\n\nfunction extractMediaFromPage(html: string, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const texts = Array.from(html.matchAll(/\"full_text\"\\s*:\\s*\"((?:\\\\.|[^\"\\\\])*)\"/g)).map((m) => parseEscaped(m[1]));\n const dates = Array.from(html.matchAll(/\"created_at\"\\s*:\\s*\"(\\w+\\s+\\w+\\s+\\d+\\s+\\d+:\\d+:\\d+\\s+\\+\\d+\\s+\\d+)\"/g)).map((m) => m[1]);\n const likes = Array.from(html.matchAll(/\"favorite_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const retweets = Array.from(html.matchAll(/\"retweet_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const replies = Array.from(html.matchAll(/\"reply_count\"\\s*:\\s*(\\d+)/g)).map((m) => parseInt(m[1]));\n const ids = Array.from(html.matchAll(/\"rest_id\"\\s*:\\s*\"(\\d+)\"/g)).map((m) => m[1]);\n const screenNames = Array.from(html.matchAll(/\"screen_name\"\\s*:\\s*\"([^\"]+)\"/g)).map((m) => m[1]);\n for (const m of html.matchAll(/\"media_url_https\"\\s*:\\s*\"([^\"]+)\"/g)) seen.add(m[1]);\n const mediaUrls = Array.from(seen);\n for (let i = 0; i < mediaUrls.length && i < 200; i++) {\n const idx = Math.min(i, Math.max(texts.length, ids.length, 1) - 1);\n items.push({\n id: `page-${ids[idx] || i}-${i}`,\n tweetId: ids[idx] || `tweet-${i}`,\n tweetText: texts[idx] || \"\",\n createdAt: dates[idx] ? convertXDate(dates[idx]) : new Date().toISOString(),\n favoriteCount: likes[idx] || 0,\n retweetCount: retweets[idx] || 0,\n replyCount: replies[idx] || 0,\n mediaUrl: mediaUrls[i],\n mediaWidth: 1200,\n mediaHeight: 800,\n username: (screenNames[idx] || username).toLowerCase(),\n userDisplayName: screenNames[idx] || username,\n userAvatarUrl: \"\",\n });\n }\n return items;\n}\n\nfunction parseEscaped(str: string): string {\n return str.replace(/\\\\u([0-9a-fA-F]{4})/g, (_, h) => String.fromCharCode(parseInt(h, 16)))\n .replace(/\\\\n/g, \" \").replace(/\\\\t/g, \" \").replace(/\\\\\"/g, '\"').replace(/\\\\\\\\/g, \"\\\\\");\n}\n\nfunction convertXDate(d: string): string {\n const parsed = new Date(d);\n return Number.isNaN(parsed.getTime()) ? new Date().toISOString() : parsed.toISOString();\n}\n\nfunction extractMediaFromNestedState(state: any, username: string): XMediaItem[] {\n const items: XMediaItem[] = [];\n const seen = new Set();\n const walk = (obj: any, depth = 0): void => {\n if (depth > 30 || !obj || typeof obj !== \"object\") return;\n if (Array.isArray(obj)) { for (const v of obj) walk(v, depth + 1); return; }\n const legacy = obj.legacy;\n const media = legacy?.extended_entities?.media;\n if (media) {\n for (const ph of media.filter((m: any) => m.type === \"photo\")) {\n const url = ph.media_url_https || ph.media_url || \"\";\n if (!url || seen.has(url)) continue;\n seen.add(url);\n const userLegacy = obj.core?.user_results?.result?.legacy;\n const sn = userLegacy?.screen_name || username;\n const orig = ph.original_info;\n const large = ph.sizes?.large;\n items.push({\n id: `state-${obj.rest_id || \"tweet\"}-${url.split(\"/\").pop()}`,\n tweetId: obj.rest_id || \"\",\n tweetText: legacy.full_text || \"\",\n createdAt: convertXDate(legacy.created_at || \"\"),\n favoriteCount: legacy.favorite_count || 0,\n retweetCount: legacy.retweet_count || 0,\n replyCount: legacy.reply_count || 0,\n mediaUrl: url,\n mediaWidth: orig?.width || large?.w || 1200,\n mediaHeight: orig?.height || large?.h || 800,\n username: String(sn).toLowerCase(),\n userDisplayName: userLegacy?.name || sn,\n userAvatarUrl: \"\",\n });\n }\n }\n for (const val of Object.values(obj)) walk(val, depth + 1);\n };\n walk(state);\n return items;\n}\n\nasync function handleTwitterProxy(request: Request): Promise {\n const start = Date.now();\n try {\n const body = await request.json().catch(() => ({}));\n const username = String(body.username || \"\").trim().toLowerCase().replace(/^@/, \"\");\n const cursor = typeof body.cursor === \"string\" && body.cursor.trim() ? body.cursor.trim() : \"\";\n const { authToken, csrfToken } = normalizeCredentialInputs(String(body.authToken || \"\"), String(body.csrfToken || \"\"));\n if (!username || !authToken || !csrfToken) {\n return Response.json({\n items: [],\n error: !username ? \"Please provide a username.\" : !authToken ? \"No auth_token provided. Add your X session cookie in Settings.\" : \"No ct0 provided. Add the X CSRF cookie in Settings.\",\n errorType: !username ? \"not-found\" : \"no-auth\",\n } satisfies ProxyResponse);\n }\n console.log(`search @${username}; cursor present=${Boolean(cursor)}; auth present=${Boolean(authToken)}; ct0 present=${Boolean(csrfToken)}`);\n const gqlPage = await tryGraphQL(username, authToken, csrfToken, cursor);\n if (gqlPage && (gqlPage.items.length || cursor)) {\n const deduped = gqlPage.items.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`graphql success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped, nextCursor: gqlPage.nextCursor } satisfies ProxyResponse);\n }\n if (cursor) return Response.json({ items: [], nextCursor: null } satisfies ProxyResponse);\n\n const { items, status } = await scrapePage(username, authToken, csrfToken);\n if (status === 403) return Response.json({ items: [], error: \"Error 403: X blocked this Val Town server IP. Your tokens may still be valid.\", errorType: \"ip-block\", statusCode: 403 } satisfies ProxyResponse);\n if (status === 401) return Response.json({ items: [], error: \"Error 401: X rejected the session tokens. Update both auth_token and ct0.\", errorType: \"invalid-token\", statusCode: 401 } satisfies ProxyResponse);\n if (status === 429) return Response.json({ items: [], error: \"Error 429: X is rate-limiting this session. Wait a few minutes and try again.\", errorType: \"rate-limited\", statusCode: 429 } satisfies ProxyResponse);\n if (status !== 200) return Response.json({ items: [], error: `Error ${status}: X returned an unexpected response.`, errorType: \"server-error\", statusCode: status } satisfies ProxyResponse);\n if (!items.length) return Response.json({ items: [], error: `No photos found for @${username}.`, errorType: \"not-found\" } satisfies ProxyResponse);\n const deduped = items.filter((item, idx, self) => idx === self.findIndex((t) => t.mediaUrl === item.mediaUrl));\n console.log(`page scrape success ${deduped.length} items in ${Date.now() - start}ms`);\n return Response.json({ items: deduped, nextCursor: null } satisfies ProxyResponse);\n } catch (err) {\n console.error(\"proxy error\", err);\n return Response.json({ items: [], error: `Proxy error: ${err instanceof Error ? err.message : \"Unknown failure\"}.`, errorType: \"server-error\" } satisfies ProxyResponse);\n }\n}\n\nexport default staticHTTPServer(import.meta.url, async (request: Request) => {\n const { pathname } = new URL(request.url);\n if (pathname === \"/api/twitter-proxy\" && request.method === \"POST\") return handleTwitterProxy(request);\n if (pathname === \"/api/twitter-proxy\") return Response.json({ items: [], error: \"Use POST with username, authToken, and csrfToken.\" }, { status: 405 });\n return null;\n});\n","createdAt",["D",1783363731405],"branchVersion","branchId","c2d7377f-b009-4ecd-875c-02b71de8155c","id","46434d98-7d30-48a2-a400-46a9c050a868","x-photo-gallery-temp-20260706",["D",1783362593740],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Temporary X photo gallery wrapper","imageUrl","4415b31e-7137-48dd-a702-ba6ff1d9bd0b","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019ef236-fc96-74eb-95f7-9a47681ead32","tursoName","46434d987d3048a2a40046a9c050a868","tursoHostname","46434d987d3048a2a40046a9c050a868-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789522836959],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_107":103},"org",{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},"branch",{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"isOwned",20,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","raskin","handle","displayName","Perry Raskin","avatar","https://avatars.githubusercontent.com/u/17967465?v=4","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_43":44,"_32":45,"_38":178,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":179,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":180,"_83":181,"_85":182,"_87":25},"tree",[165,166,167],"files",[165,166,167],"counts",{"_154":62,"_155":156,"_157":62,"_158":159,"_160":161},"contents",[130,131,132],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":147,"_32":148,"_30":149,"_134":-5,"_41":42,"_40":150,"_135":58,"_38":151,"_13":62,"_33":152,"_35":-5,"_24":25,"_138":-5,"_27":153},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":25,"_38":144,"_13":137,"_33":20,"_35":145,"_24":25,"_138":-5,"_27":146},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":136,"_13":137,"_33":34,"_35":37,"_24":25,"_138":45,"_27":139},"447a7aa8-8a64-419a-94d6-08f2730c0b85","parentId","latest",["D",1783363731405],2,"label",[28],"af1c958b-6860-4ed4-bcca-c74c5a47bc13","index.html","24f10564-7969-11f1-8a85-1607ee4eb77e",6,["D",1783363083030],"\n\n\n \n \n Twitter Photo Gallery - Temporary Val Town Deploy\n \n \n \n\n\n \n\n

\n \n \n

Twitter Photo Gallery

Enter an X username to browse their photos using your session.

\n\n \n\n

You need to add your X session token in Settings before searching. The app uses your session to fetch real photos from X.

\n \n Recent searches\n

\n\n

\n\n \n \n\n \n\n\n",[141],"286e4941-2132-4260-8a39-4aeef40abbcd","fonts","a4a9ec80-7969-11f1-adfa-1607ee4eb77e",4,["D",1783363006620],"directory",[148],"pulls","branches",1,"forks","envVars",{"_162":62,"_164":62},"connections",{"_162":62,"_163":62},"count","unfilledCount","emptyCount",{"_43":147,"_32":148,"_30":149,"_134":-5,"_41":42,"_40":150,"_135":58,"_38":175,"_13":62,"_33":152,"_35":-5,"_24":25,"_138":-5,"_169":176,"_27":177},{"_43":140,"_32":141,"_30":142,"_134":-5,"_41":42,"_40":143,"_135":25,"_38":172,"_13":137,"_33":20,"_35":145,"_24":25,"_138":-5,"_169":173,"_27":174},{"_43":133,"_32":28,"_30":31,"_134":-5,"_41":42,"_40":14,"_135":25,"_38":168,"_13":137,"_33":34,"_35":37,"_24":25,"_138":45,"_169":170,"_27":171},["D",1783363731405],"children",[],[28],["D",1783363083030],[],[141],["D",1783363006620],[],[148],["D",1783362593740],["D",1789522836959],{"_99":98,"_107":103},{"_99":98,"_100":101,"_102":103,"_18":55,"_104":105,"_106":25},{"_13":88,"_32":89,"_43":42,"_90":44,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":45,"_97":98},"ctx",{"_81":-5,"_127":216,"_217":218,"_219":220,"_221":25,"_222":25,"_223":25,"_224":58,"_225":-5,"_226":-7,"_227":-7,"_228":62,"_229":25,"_230":25,"_231":-5,"_232":25,"_233":25,"_234":25,"_235":-5},"ENV",{"_187":188,"_189":190,"_191":89,"_192":193,"_194":195,"_196":197,"_198":199,"_200":201,"_202":203,"_204":205,"_206":207,"_208":209,"_210":211,"_212":213,"_214":215},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v7