[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_198":199,"_200":201},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_138":139,"_35":-7,"_140":-5,"_17":141,"_142":143,"_144":145,"_146":147,"_148":149,"_51":-5,"_150":-5,"_151":-5,"_152":24,"_153":154,"_155":98,"_156":-5,"_157":-5,"_158":159},"routes/_app.x.$handle.$name.branch.$branch.history",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":22,"_23":24,"_25":-5},"handle","shark1","name","revolut-clone-keys","branchName","main","project",{"_29":86,"_13":14,"_33":87,"_88":-5,"_89":24,"_90":91,"_92":91,"_93":94,"_95":-5,"_25":66,"_96":76,"_97":98,"_99":-5,"_100":-5,"_101":20,"_37":38,"_102":103,"_104":105,"_106":107,"_108":-5,"_109":110,"_111":110,"_112":113,"_114":113,"_115":113,"_116":110,"_117":110,"_49":118,"_119":120,"_121":122,"_123":24},"page",0,"history",[26,27,28],"hasNext",false,"userId",{"_29":79,"_31":32,"_33":80,"_35":81,"_37":38,"_39":69,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":82,"_51":83,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":84},{"_29":69,"_31":32,"_33":70,"_35":71,"_37":38,"_39":30,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":72,"_51":73,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":74},{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5,"_56":-5,"_57":58},"id","27c44a4d-8722-4db6-af0c-6faa5dc660e6","branchId","81527311-f8f2-4bfe-b77d-c5770dd86ff9","createdAt",["D",1788889121348],"version",1,"orgId","01a01fe9-ecb4-741f-b93d-9dede04027dc","parentId","incomingCommitId","aiChatMessageId","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle","source","mcp","clientLabel","Claude Code (plugin:valtown:valtown)","user",{"_29":66,"_37":38,"_11":12,"_67":68},"file",{"_60":61,"_13":62,"_63":64,"_65":24},"pull","merge","revert","multiple","commits",[59],{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":-5,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":52,"_53":-5,"_54":-5,"_55":-5},"fileId","21b8045e-abac-11f1-b9ed-1607ee4eb77e","keys.ts","fileType","script","deleted","cc58df9a-f50f-435b-9018-be1782367358","avatar","https://lh3.googleusercontent.com/a/ACg8ocIzln9AxE2CWvWNfXzidC0hM0GwjaSxZH3RbH41m8e-uhxzM3o=s96-c","162e7f2d-181f-4810-84e7-704149be6bac",["D",1788889199255],2,{"_29":66,"_37":38,"_11":12,"_67":68},{"_60":76,"_13":77,"_63":78,"_65":24},[75],{"_29":69,"_31":32,"_33":70,"_35":71,"_37":38,"_39":30,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":72,"_51":73,"_53":-5,"_54":-5,"_55":-5},"50288dfe-abac-11f1-b48d-1607ee4eb77e","main.ts","http","86685a9c-ee6d-441e-8929-d3064e38a12f",["D",1788891002409],3,{"_29":66,"_37":38,"_11":12,"_67":68},{"_60":76,"_13":77,"_63":78,"_65":24},[85],{"_29":79,"_31":32,"_33":80,"_35":81,"_37":38,"_39":69,"_40":-5,"_41":-5,"_42":-5,"_43":-5,"_44":-5,"_45":46,"_47":48,"_49":82,"_51":83,"_53":-5,"_54":-5,"_55":-5},"fc054850-9729-4253-9f3e-cf6621c9893f",["D",1788889121278],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Revolut clone access keys: verify and claim, one device per key","imageUrl","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount","tursoName","fc054850972942539f3ecf6621c9893f","tursoHostname","fc054850972942539f3ecf6621c9893f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789499469860],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_11":12,"_137":68},"org",{"_11":12,"_132":133,"_67":68,"_25":66,"_134":135,"_136":24},"branch",{"_35":81,"_13":16,"_29":32,"_124":86,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":14,"_131":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Shark","tier","free","canRestrictVals","profileImageUrl","path","","adoptOrgId",{"_29":86,"_13":14,"_33":193,"_88":-5,"_89":24,"_90":91,"_92":91,"_93":94,"_95":-5,"_25":66,"_96":76,"_97":98,"_99":-5,"_100":-5,"_101":20,"_37":38,"_102":103,"_104":105,"_106":194,"_108":-5,"_109":110,"_111":110,"_112":113,"_114":113,"_115":113,"_116":110,"_117":110,"_49":195,"_119":196,"_121":197,"_123":24},"tree",[184,185],"files",[184,185],"counts",{"_174":20,"_175":36,"_176":20,"_177":178,"_179":180},"contents",[160,161],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_29":170,"_13":62,"_60":61,"_39":-5,"_31":32,"_163":36,"_164":98,"_33":171,"_35":20,"_63":64,"_166":172,"_65":24,"_168":-5,"_138":173},{"_29":162,"_13":77,"_60":76,"_39":-5,"_31":32,"_163":81,"_164":98,"_33":165,"_35":36,"_63":78,"_166":167,"_65":24,"_168":-5,"_138":169},"8fb01f03-3d81-45e7-bfa7-ce52edee856e","branchVersion","latest",["D",1788891002409],"content","// App-facing verifier and claim ledger for the Revolut clone.\n//\n// The app already checks a key's signature locally; this is the one thing it\n// cannot do alone — remember, across devices, that a key has been claimed. A\n// key that verifies on two phones still only activates on the first to arrive.\n//\n// POST / {\"key\":\"MHLX8644E2H7TKL9\",\"deviceId\":\"...\"}\n// 200 {\"ok\":true,\"tier\":\"M\",\"seconds\":2592000,\"expiresAt\":\"...\"}\n// 409 {\"ok\":false,\"reason\":\"claimed_elsewhere\"}\n// 403 {\"ok\":false,\"reason\":\"revoked\"}\n// 400 {\"ok\":false,\"reason\":\"bad_signature\"}\n// GET /?serial=XXXXX inspect one claim\n//\n// Plus an admin API, for the Telegram bot. Val Town gives every val its own\n// SQLite, so the bot cannot read this ledger with a query — it lives in\n// another val's database. It asks over HTTP instead, presenting ADMIN_TOKEN:\n//\n// GET /?op=list x-admin-token: … recent claims\n// GET /?op=check&serial=XXXXX x-admin-token: … one claim\n// POST /?op=revoke&serial=XXXXX x-admin-token: … kill a key\n//\n// Revoking a serial that was never claimed writes a revoked row, so the key\n// is refused the first time it is presented rather than only afterwards.\n//\n// SECRET is set in the val's env and must match Activation.swift.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { DURATION, initDb, tag } from \"./keys.ts\";\n\nfunction json(body: unknown, status = 200): Response {\n return new Response(JSON.stringify(body), {\n status,\n headers: { \"content-type\": \"application/json\" },\n });\n}\n\n/// The admin API. Returns null when this isn't an authenticated admin call,\n/// so the app-facing path below runs untouched.\nasync function admin(req: Request): Promise {\n const token = Deno.env.get(\"ADMIN_TOKEN\");\n if (!token || req.headers.get(\"x-admin-token\") !== token) return null;\n\n const url = new URL(req.url);\n const op = url.searchParams.get(\"op\");\n const serial = (url.searchParams.get(\"serial\") ?? \"\").toUpperCase()\n .replace(/[^A-Z0-9]/g, \"\").slice(0, 5);\n\n if (op === \"list\") {\n const limit = Math.min(Number(url.searchParams.get(\"limit\") ?? 10) || 10, 50);\n const r = await sqlite.execute({\n sql: `SELECT serial, tier, device_id, claimed_at, expires_at, revoked\n FROM revolut_claims ORDER BY claimed_at DESC LIMIT ?`,\n args: [limit],\n });\n return json({ ok: true, claims: r.rows });\n }\n\n if (op === \"check\") {\n if (serial.length !== 5) return json({ ok: false, reason: \"bad_serial\" }, 400);\n const r = await sqlite.execute({\n sql: `SELECT serial, tier, device_id, claimed_at, expires_at, revoked\n FROM revolut_claims WHERE serial = ?`,\n args: [serial],\n });\n return json({ ok: true, claim: r.rows[0] ?? null });\n }\n\n if (op === \"revoke\") {\n if (serial.length !== 5) return json({ ok: false, reason: \"bad_serial\" }, 400);\n const existing = await sqlite.execute({\n sql: \"SELECT serial FROM revolut_claims WHERE serial = ?\",\n args: [serial],\n });\n if (existing.rows.length) {\n await sqlite.execute({\n sql: \"UPDATE revolut_claims SET revoked = 1 WHERE serial = ?\",\n args: [serial],\n });\n return json({ ok: true, revoked: serial, claimed: true });\n }\n const now = new Date().toISOString();\n await sqlite.execute({\n sql: `INSERT INTO revolut_claims (serial, tier, device_id, claimed_at, expires_at, revoked)\n VALUES (?, ?, ?, ?, ?, 1)`,\n args: [serial, \"?\", \"revoked\", now, now],\n });\n return json({ ok: true, revoked: serial, claimed: false });\n }\n\n return json({ ok: false, reason: \"unknown_op\" }, 400);\n}\n\nexport default async function (req: Request): Promise {\n const secret = Deno.env.get(\"SECRET\");\n if (!secret) return json({ ok: false, reason: \"server_not_configured\" }, 500);\n await initDb();\n\n const administered = await admin(req);\n if (administered) return administered;\n\n if (req.method === \"GET\") {\n const serial = new URL(req.url).searchParams.get(\"serial\");\n if (!serial) {\n return json({ ok: true, service: \"revolut clone activation\", hint: \"POST {key, deviceId}\" });\n }\n const r = await sqlite.execute({\n sql: \"SELECT serial, tier, device_id, claimed_at, expires_at, revoked FROM revolut_claims WHERE serial = ?\",\n args: [serial.toUpperCase()],\n });\n return json({ ok: true, claim: r.rows[0] ?? null });\n }\n\n if (req.method !== \"POST\") return json({ ok: false, reason: \"method\" }, 405);\n\n let body: { key?: string; deviceId?: string };\n try { body = await req.json(); } catch { return json({ ok: false, reason: \"bad_json\" }, 400); }\n\n const key = (body.key ?? \"\").toUpperCase().replace(/[^A-Z0-9]/g, \"\");\n const deviceId = (body.deviceId ?? \"\").trim();\n if (key.length !== 16 || !deviceId) return json({ ok: false, reason: \"bad_request\" }, 400);\n\n const payload = key.slice(0, 6);\n const tier = key[0];\n const serial = key.slice(1, 6);\n if (!DURATION[tier]) return json({ ok: false, reason: \"unknown_tier\" }, 400);\n if (await tag(payload, secret) !== key.slice(6)) return json({ ok: false, reason: \"bad_signature\" }, 400);\n\n const existing = await sqlite.execute({\n sql: \"SELECT device_id, expires_at, revoked FROM revolut_claims WHERE serial = ?\",\n args: [serial],\n });\n\n if (existing.rows.length > 0) {\n const row = existing.rows[0] as Record;\n if (Number(row.revoked)) return json({ ok: false, reason: \"revoked\" }, 403);\n // The same device asking again is fine — a reinstall re-check returns the\n // claim it already owns rather than being told the key is taken.\n if (String(row.device_id) !== deviceId) return json({ ok: false, reason: \"claimed_elsewhere\" }, 409);\n return json({ ok: true, tier, seconds: DURATION[tier], expiresAt: String(row.expires_at) });\n }\n\n // First claim wins. The clock starts now, not when the key was minted.\n const expiresAt = new Date(Date.now() + DURATION[tier] * 1000).toISOString();\n await sqlite.execute({\n sql: `INSERT INTO revolut_claims (serial, tier, device_id, claimed_at, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [serial, tier, deviceId, new Date().toISOString(), expiresAt],\n });\n return json({ ok: true, tier, seconds: DURATION[tier], expiresAt });\n}\n","label",[77],"866c42aa-7ea6-44c2-a56c-6da10de526c9",["D",1788889121348],"// Shared core for the Revolut clone's access-key system.\n//\n// A key is self-proving: tier + serial + a truncated HMAC over the two, using\n// SECRET. The same construction lives in the iOS app (Activation.swift) and\n// tools/mint-keys.py — all three must agree byte-for-byte or keys won't verify.\n//\n// The secret here is this app's own. The Wise clone has a different one, so\n// neither app's keys open the other.\n\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\n// No 0/O/1/I — the pairs people mistype when copying a key.\nexport const ALPHABET = \"ABCDEFGHJKLMNPQRSTUVWXYZ23456789\";\n\n// Seconds each tier grants. T is a 60-second tier for watching expiry happen;\n// L is a hundred-year grant — \"lifetime\" in practice.\nexport const DURATION: Record = { D: 86400, W: 604800, M: 2592000, T: 60, L: 3153600000 };\nexport const TIER_LABEL: Record = { D: \"1 day\", W: \"7 days\", M: \"1 month\", T: \"60 seconds\", L: \"Lifetime\" };\n\nexport async function initDb(): Promise {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS revolut_claims (\n serial TEXT PRIMARY KEY,\n tier TEXT NOT NULL,\n device_id TEXT NOT NULL,\n claimed_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n revoked INTEGER NOT NULL DEFAULT 0\n )`);\n}\n\n/** First 50 bits of HMAC-SHA256(payload), as ten five-bit characters. */\nexport async function tag(payload: string, secret: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\", new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" }, false, [\"sign\"],\n );\n const mac = new Uint8Array(await crypto.subtle.sign(\"HMAC\", key, new TextEncoder().encode(payload)));\n let out = \"\", acc = 0, bits = 0, i = 0;\n while (out.length < 10) {\n if (bits < 5) { acc = (acc << 8) | mac[i]; bits += 8; i += 1; }\n out += ALPHABET[(acc >> (bits - 5)) & 0b11111];\n bits -= 5;\n }\n return out;\n}\n\n/** XXXX-XXXX-XXXX-XXXX */\nexport function grouped(key: string): string {\n return (key.match(/.{1,4}/g) ?? [key]).join(\"-\");\n}\n",[62],"pulls","branches","forks","envVars",{"_181":71,"_183":20},"connections",{"_181":20,"_182":20},"count","unfilledCount","emptyCount",{"_29":170,"_13":62,"_60":61,"_39":-5,"_31":32,"_163":36,"_164":98,"_33":190,"_35":20,"_63":64,"_166":172,"_65":24,"_168":-5,"_187":191,"_138":192},{"_29":162,"_13":77,"_60":76,"_39":-5,"_31":32,"_163":81,"_164":98,"_33":186,"_35":36,"_63":78,"_166":167,"_65":24,"_168":-5,"_187":188,"_138":189},["D",1788891002409],"children",[],[77],["D",1788889121348],[],[62],["D",1788889121278],["D",1789499469860],{"_11":12,"_137":68},{"_11":12,"_132":133,"_67":68,"_25":66,"_134":135,"_136":24},{"_35":81,"_13":16,"_29":32,"_124":86,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":-5,"_130":14,"_131":12},"ctx",{"_49":-5,"_157":231,"_232":233,"_234":235,"_236":24,"_237":24,"_238":24,"_239":98,"_240":-5,"_241":-7,"_242":-7,"_243":20,"_244":24,"_245":24,"_246":-5,"_247":24,"_248":24,"_249":24,"_250":-5},"ENV",{"_202":203,"_204":205,"_206":16,"_207":208,"_209":210,"_211":212,"_213":214,"_215":216,"_217":218,"_219":220,"_221":222,"_223":224,"_225":226,"_227":228,"_229":230},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History