[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":53,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":58,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",8,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","bf5f3b50-a32d-11f1-8be0-1607ee4eb77e","name","fileType","http","content","/**\n * BMZ link status checker - Val.town HTTP val\n *\n * Deployed at val.town, NOT part of the website build. The CI `pages:` job only\n * copies css/icons/js/workers/index.html, so this directory never ships - it\n * lives here for version control alongside the code that calls it.\n *\n * WHY THIS EXISTS\n * A browser cannot read the HTTP status of a cross-origin response: CORS gives\n * back an opaque result with status forced to 0. The extensions get real status\n * codes because host permissions exempt them; the website cannot. So a dead\n * bookmark shows green on the website and red in the extension.\n *\n * This val does the fetch server-side and returns just the status code with\n * permissive CORS, which the page IS allowed to read.\n *\n * WHY IT IS CHEAP\n * It never relays a body. HEAD first; if the server refuses HEAD (plenty do,\n * with 405/501) it falls back to GET and cancels the body stream the moment\n * headers arrive. Responses are ~120 bytes instead of a ~250KB page, which is\n * the difference between ~14 and ~1700 full library scans per 10GB.\n *\n * BATCH MODE MATTERS\n * Val.town free tier allows 1000 requests/minute, shared across every BMZ user\n * because they all call this one val. Checking 2909 bookmarks one request at a\n * time would burn 2909 of those. POST a batch of 50 and it costs 59 instead.\n */\n\n// Set with: POST /v2/vals/{val_id}/environment_variables/ {\"key\":\"BMZ_TOKEN\",...}\n// or through the val.town UI. Deliberately NOT hardcoded: free-tier vals are\n// public, so a literal here would be readable by anyone, but environment\n// variables are not source and stay secret even on a public val.\n//\n// It is still sent from browser JS, so anyone reading the deployed page's\n// network traffic can see it - it deters drive-by scanners, not a determined\n// user. The cache, the batch cap and the SSRF guard are the real protection.\nconst TOKEN = Deno.env.get(\"BMZ_TOKEN\");\nconst CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour\nconst REQUEST_TIMEOUT_MS = 8000; // dead hosts must not hold a slot for long\nconst MAX_REDIRECTS = 5;\n// Same 1-minute ceiling applies here: 50/15 = 4 rounds x 8s = ~32s worst case.\n// At the original concurrency of 10 it was 5 rounds = 40s, which left too little\n// margin once a batch arrives with many slow hosts in it.\nconst MAX_BATCH = 50;\nconst BATCH_CONCURRENCY = 15;\n\n// url -> { status, finalUrl, redirects, expires }\n// Survives between invocations while the worker is warm. Across a real user\n// base many people bookmark the same sites, so this collapses duplicate\n// upstream fetches to one.\nconst cache = new Map();\n\nconst CORS = {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n};\n\nfunction json(body: unknown, status = 200) {\n return new Response(JSON.stringify(body), {\n status,\n headers: { ...CORS, \"Content-Type\": \"application/json\" },\n });\n}\n\n/**\n * SSRF guard. This endpoint fetches whatever it is told to, so it must refuse\n * anything that could reach infrastructure rather than the public web.\n */\nfunction isFetchable(raw: string): boolean {\n let u: URL;\n try {\n u = new URL(raw);\n } catch {\n return false;\n }\n\n if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return false;\n\n const host = u.hostname.toLowerCase();\n\n if (\n host === \"localhost\" ||\n host === \"0.0.0.0\" ||\n host.endsWith(\".localhost\") ||\n host.endsWith(\".internal\") ||\n host.endsWith(\".val.run\") ||\n host.endsWith(\".val.town\")\n ) return false;\n\n // Literal private / loopback / link-local / metadata addresses\n if (/^127\\./.test(host)) return false;\n if (/^10\\./.test(host)) return false;\n if (/^192\\.168\\./.test(host)) return false;\n if (/^172\\.(1[6-9]|2\\d|3[01])\\./.test(host)) return false;\n if (/^169\\.254\\./.test(host)) return false;\n if (host === \"[::1]\" || host === \"::1\") return false;\n\n return true;\n}\n\nasync function fetchStatus(target: string) {\n const cached = cache.get(target);\n if (cached && cached.expires > Date.now()) {\n return { ...cached.value, cached: true };\n }\n\n if (!isFetchable(target)) {\n return { url: target, status: null, error: \"unfetchable\" };\n }\n\n let current = target;\n let redirects = 0;\n\n try {\n while (redirects <= MAX_REDIRECTS) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n let res: Response;\n try {\n res = await fetch(current, {\n method: \"HEAD\",\n redirect: \"manual\",\n signal: controller.signal,\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; BMZ link check)\" },\n });\n\n // Many servers reject HEAD outright. Retry as GET, but cancel the body\n // as soon as the headers are in - the status line is all we want.\n if (res.status === 405 || res.status === 501) {\n res = await fetch(current, {\n method: \"GET\",\n redirect: \"manual\",\n signal: controller.signal,\n headers: {\n \"User-Agent\": \"Mozilla/5.0 (compatible; BMZ link check)\",\n },\n });\n }\n } finally {\n clearTimeout(timer);\n }\n\n // Never download the body, whichever method got us here\n try {\n await res.body?.cancel();\n } catch { /* already closed */ }\n\n const location = res.headers.get(\"location\");\n if (res.status >= 300 && res.status < 400 && location) {\n const next = new URL(location, current).toString();\n if (!isFetchable(next)) {\n const value = {\n url: target,\n status: null,\n error: \"redirect-blocked\",\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n current = next;\n redirects++;\n continue;\n }\n\n const value = {\n url: target,\n status: res.status,\n finalUrl: current,\n redirects,\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n\n const value = { url: target, status: null, error: \"too-many-redirects\" };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n } catch (err: any) {\n // A refused connection or DNS failure is real information: the host did not\n // answer. Distinguished from a status code so the caller can decide.\n const value = {\n url: target,\n status: null,\n error: err?.name === \"AbortError\" ? \"timeout\" : \"unreachable\",\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n}\n\n// Bounded parallelism: the val has a 1 minute execution ceiling, so a batch of\n// 50 at 8s worst case each must not run serially.\nasync function checkAll(urls: string[]) {\n const results: any[] = new Array(urls.length);\n let next = 0;\n\n const workers = Array.from(\n { length: Math.min(BATCH_CONCURRENCY, urls.length) },\n async () => {\n while (true) {\n const i = next++;\n if (i >= urls.length) return;\n results[i] = await fetchStatus(urls[i]);\n }\n },\n );\n\n await Promise.all(workers);\n return results;\n}\n\n/**\n * URLVoid detection count.\n *\n * The website reaches URLVoid through public CORS proxies today and they have\n * all rotted: corsproxy.io 403s every request without exception, codetabs\n * returns 522, and allorigins works intermittently but hangs for 19-20 seconds\n * before failing. That hanging is the single largest cost in a scan.\n *\n * Counting happens HERE and only the number crosses the wire - the page is\n * ~36KB and the answer is one integer, so this stays cheap the same way the\n * status route does.\n *\n * The count is occurrences of the word \"detected\" in the page. Crude, but it is\n * what the extensions already use and it is calibrated: google.com 0,\n * pastes.io 3, netfilm.app 5.\n */\n// Sized against the val's 1 MINUTE execution ceiling, not against comfort.\n// Worst case is (batch / concurrency) rounds x timeout: 10/5 = 2 rounds x 15s =\n// 30s, leaving headroom. The obvious-looking 25/5 with a 20s timeout would be 5\n// rounds = 100s and the val would be killed part way through the batch.\nconst URLVOID_TIMEOUT_MS = 15000;\nconst URLVOID_MAX_BATCH = 10;\nconst URLVOID_CONCURRENCY = 5;\n\nasync function urlvoidCount(domain: string) {\n const clean = String(domain || \"\").trim().toLowerCase();\n if (!clean || !/^[a-z0-9.-]+$/.test(clean)) {\n return { domain, count: null, error: \"bad-domain\" };\n }\n\n const cacheKey = `urlvoid:${clean}`;\n const cached = cache.get(cacheKey);\n if (cached && cached.expires > Date.now()) {\n return { ...cached.value, cached: true };\n }\n\n try {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), URLVOID_TIMEOUT_MS);\n\n let res: Response;\n try {\n res = await fetch(\n `https://www.urlvoid.com/scan/${encodeURIComponent(clean)}/`,\n {\n signal: controller.signal,\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\",\n },\n },\n );\n } finally {\n clearTimeout(timer);\n }\n\n if (!res.ok) {\n try {\n await res.body?.cancel();\n } catch { /* already closed */ }\n return { domain: clean, count: null, error: `http-${res.status}` };\n }\n\n const html = await res.text();\n\n // URLVoid answers 200 with a \"Report Not Found\" page for any domain it has\n // never scanned. That page contains no \"detected\" either, so a naive count\n // reads it as ZERO DETECTIONS = clean, when it actually means \"no data\".\n // That is a silent false-clean, and it is the failure direction that matters\n // for a safety check. Detected by the page's own marker rather than by size:\n // the same page measured 12688 bytes locally and 12834 from the val, so a\n // byte threshold would be brittle.\n if (/Report Not Found/i.test(html)) {\n const value = {\n domain: clean,\n count: null,\n error: \"no-report\",\n bytes: html.length,\n };\n cache.set(cacheKey, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n\n const count = (html.match(/detected/gi) || []).length;\n\n // `bytes` is returned so the caller can still sanity-check that a real scan\n // page came back, in case URLVoid introduces another shape of empty answer.\n const value = { domain: clean, count, bytes: html.length };\n cache.set(cacheKey, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n } catch (err: any) {\n return {\n domain: clean,\n count: null,\n error: err?.name === \"AbortError\" ? \"timeout\" : \"unreachable\",\n };\n }\n}\n\nasync function urlvoidAll(domains: string[]) {\n const results: any[] = new Array(domains.length);\n let next = 0;\n\n const workers = Array.from(\n { length: Math.min(URLVOID_CONCURRENCY, domains.length) },\n async () => {\n while (true) {\n const i = next++;\n if (i >= domains.length) return;\n results[i] = await urlvoidCount(domains[i]);\n }\n },\n );\n\n await Promise.all(workers);\n return results;\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") return new Response(null, { headers: CORS });\n\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") {\n return json({ status: \"ok\", cached: cache.size });\n }\n\n // Fail closed. If BMZ_TOKEN was never set, an undefined TOKEN would otherwise\n // match a caller who simply omitted ?key= and leave this wide open.\n if (!TOKEN) return json({ error: \"server not configured\" }, 503);\n\n const key = url.searchParams.get(\"key\");\n if (key !== TOKEN) return json({ error: \"bad key\" }, 403);\n\n // URLVoid: GET ?domain=... or POST { domains: [...] }\n if (url.pathname === \"/urlvoid\") {\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"bad json\" }, 400);\n }\n\n const domains = Array.isArray(body?.domains) ? body.domains : null;\n if (!domains) return json({ error: \"expected { domains: [...] }\" }, 400);\n if (domains.length > URLVOID_MAX_BATCH) {\n return json(\n { error: `max ${URLVOID_MAX_BATCH} domains per request` },\n 400,\n );\n }\n\n return json({ results: await urlvoidAll(domains) });\n }\n\n const domain = url.searchParams.get(\"domain\");\n if (!domain) return json({ error: \"missing domain\" }, 400);\n return json(await urlvoidCount(domain));\n }\n\n // Batch: POST { urls: [...] }\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"bad json\" }, 400);\n }\n\n const urls = Array.isArray(body?.urls) ? body.urls : null;\n if (!urls) return json({ error: \"expected { urls: [...] }\" }, 400);\n if (urls.length > MAX_BATCH) {\n return json({ error: `max ${MAX_BATCH} urls per request` }, 400);\n }\n\n return json({ results: await checkAll(urls) });\n }\n\n // Single: GET ?url=...\n const target = url.searchParams.get(\"url\");\n if (!target) return json({ error: \"missing url\" }, 400);\n\n return json(await fetchStatus(target));\n}","/**\n * BMZ link status checker - Val.town HTTP val\n *\n * Deployed at val.town, NOT part of the website build. The CI `pages:` job only\n * copies css/icons/js/workers/index.html, so this directory never ships - it\n * lives here for version control alongside the code that calls it.\n *\n * WHY THIS EXISTS\n * A browser cannot read the HTTP status of a cross-origin response: CORS gives\n * back an opaque result with status forced to 0. The extensions get real status\n * codes because host permissions exempt them; the website cannot. So a dead\n * bookmark shows green on the website and red in the extension.\n *\n * This val does the fetch server-side and returns just the status code with\n * permissive CORS, which the page IS allowed to read.\n *\n * WHY IT IS CHEAP\n * It never relays a body. HEAD first; if the server refuses HEAD (plenty do,\n * with 405/501) it falls back to GET and cancels the body stream the moment\n * headers arrive. Responses are ~120 bytes instead of a ~250KB page, which is\n * the difference between ~14 and ~1700 full library scans per 10GB.\n *\n * BATCH MODE MATTERS\n * Val.town free tier allows 1000 requests/minute, shared across every BMZ user\n * because they all call this one val. Checking 2909 bookmarks one request at a\n * time would burn 2909 of those. POST a batch of 50 and it costs 59 instead.\n */\n\n// Set with: POST /v2/vals/{val_id}/environment_variables/ {\"key\":\"BMZ_TOKEN\",...}\n// or through the val.town UI. Deliberately NOT hardcoded: free-tier vals are\n// public, so a literal here would be readable by anyone, but environment\n// variables are not source and stay secret even on a public val.\n//\n// It is still sent from browser JS, so anyone reading the deployed page's\n// network traffic can see it - it deters drive-by scanners, not a determined\n// user. The cache, the batch cap and the SSRF guard are the real protection.\nconst TOKEN = Deno.env.get(\"BMZ_TOKEN\");\nconst CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour\nconst REQUEST_TIMEOUT_MS = 8000; // dead hosts must not hold a slot for long\nconst MAX_REDIRECTS = 5;\n// Same 1-minute ceiling applies here: 50/15 = 4 rounds x 8s = ~32s worst case.\n// At the original concurrency of 10 it was 5 rounds = 40s, which left too little\n// margin once a batch arrives with many slow hosts in it.\nconst MAX_BATCH = 50;\nconst BATCH_CONCURRENCY = 15;\n\n// url -> { status, finalUrl, redirects, expires }\n// Survives between invocations while the worker is warm. Across a real user\n// base many people bookmark the same sites, so this collapses duplicate\n// upstream fetches to one.\nconst cache = new Map();\n\n/* [ZeroLabs] 2026-08-28 - added: reflect known origins instead of \"*\" */\n// BMZ is open source and the token ships in the page, so this endpoint is\n// effectively public. The realistic abuse is someone pointing their own site at\n// it and spending Zero's shared 1000/min quota through their visitors' browsers.\n//\n// Reflecting only known origins stops exactly that: a browser will refuse to let\n// a page read a response whose Access-Control-Allow-Origin does not match it.\n//\n// It does NOT stop curl or a server, which can send any Origin they like or none.\n// That is accepted rather than defended against: there is nothing user-specific\n// here to leak, the SSRF guard stops it being aimed at infrastructure, and the\n// worst case is quota burn - fixed in two minutes by rotating BMZ_TOKEN in the\n// val.town UI and the matching constant in workers/scanner-worker.js.\n// ---------------------------------------------------------------------------\n// SELF-HOSTING: change these.\n//\n// This list is specific to the author's deployment. If you are running your own\n// copy of BMZ, replace the two https entries with your own domain(s), or empty\n// the array entirely if you do not want any origin restriction - an empty list\n// simply means every browser request gets \"null\" and is refused, so do not leave\n// it empty by accident. To allow anything, return \"*\" from corsFor() instead.\n//\n// You will also need your OWN val rather than pointing at the author's, which\n// will refuse your origin anyway. Deploy this file as an HTTP val, set a\n// BMZ_TOKEN environment variable on it, then update these two constants near the\n// top of workers/scanner-worker.js to match:\n//\n// const LINK_VAL_URL = 'https://--.web.val.run';\n// const LINK_VAL_TOKEN = '';\n//\n// The localhost entries are for running the site from a local HTTP server during\n// development; harmless to keep, since a page served from localhost is yours.\n// ---------------------------------------------------------------------------\nconst ALLOWED_ORIGINS = [\n \"https://bmzweb.absolutezero.fyi\",\n \"https://bookmarkmanagerzero.absolutezero.fyi\",\n \"http://127.0.0.1:8000\",\n \"http://localhost:8000\",\n];\n\nfunction corsFor(req: Request) {\n const origin = req.headers.get(\"origin\") || \"\";\n const allowed = ALLOWED_ORIGINS.includes(origin);\n return {\n // No Origin at all (curl, a server) gets \"*\": harmless, since there is no\n // browser to protect and nothing user-specific in any response.\n \"Access-Control-Allow-Origin\": allowed ? origin : (origin ? \"null\" : \"*\"),\n \"Vary\": \"Origin\",\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type\",\n \"Access-Control-Max-Age\": \"86400\",\n };\n}\n\nfunction json(body: unknown, status = 200, req?: Request) {\n return new Response(JSON.stringify(body), {\n status,\n headers: {\n ...(req ? corsFor(req) : { \"Access-Control-Allow-Origin\": \"*\" }),\n \"Content-Type\": \"application/json\",\n },\n });\n}\n\n/**\n * SSRF guard. This endpoint fetches whatever it is told to, so it must refuse\n * anything that could reach infrastructure rather than the public web.\n */\nfunction isFetchable(raw: string): boolean {\n let u: URL;\n try {\n u = new URL(raw);\n } catch {\n return false;\n }\n\n if (u.protocol !== \"http:\" && u.protocol !== \"https:\") return false;\n\n const host = u.hostname.toLowerCase();\n\n if (\n host === \"localhost\" ||\n host === \"0.0.0.0\" ||\n host.endsWith(\".localhost\") ||\n host.endsWith(\".internal\") ||\n host.endsWith(\".val.run\") ||\n host.endsWith(\".val.town\")\n ) return false;\n\n // Literal private / loopback / link-local / metadata addresses\n if (/^127\\./.test(host)) return false;\n if (/^10\\./.test(host)) return false;\n if (/^192\\.168\\./.test(host)) return false;\n if (/^172\\.(1[6-9]|2\\d|3[01])\\./.test(host)) return false;\n if (/^169\\.254\\./.test(host)) return false;\n if (host === \"[::1]\" || host === \"::1\") return false;\n\n return true;\n}\n\nasync function fetchStatus(target: string) {\n const cached = cache.get(target);\n if (cached && cached.expires > Date.now()) {\n return { ...cached.value, cached: true };\n }\n\n if (!isFetchable(target)) {\n return { url: target, status: null, error: \"unfetchable\" };\n }\n\n let current = target;\n let redirects = 0;\n\n try {\n while (redirects <= MAX_REDIRECTS) {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS);\n\n let res: Response;\n try {\n res = await fetch(current, {\n method: \"HEAD\",\n redirect: \"manual\",\n signal: controller.signal,\n headers: { \"User-Agent\": \"Mozilla/5.0 (compatible; BMZ link check)\" },\n });\n\n // Many servers reject HEAD outright. Retry as GET, but cancel the body\n // as soon as the headers are in - the status line is all we want.\n if (res.status === 405 || res.status === 501) {\n res = await fetch(current, {\n method: \"GET\",\n redirect: \"manual\",\n signal: controller.signal,\n headers: {\n \"User-Agent\": \"Mozilla/5.0 (compatible; BMZ link check)\",\n },\n });\n }\n } finally {\n clearTimeout(timer);\n }\n\n // Never download the body, whichever method got us here\n try {\n await res.body?.cancel();\n } catch { /* already closed */ }\n\n const location = res.headers.get(\"location\");\n if (res.status >= 300 && res.status < 400 && location) {\n const next = new URL(location, current).toString();\n if (!isFetchable(next)) {\n const value = {\n url: target,\n status: null,\n error: \"redirect-blocked\",\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n current = next;\n redirects++;\n continue;\n }\n\n const value = {\n url: target,\n status: res.status,\n finalUrl: current,\n redirects,\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n\n const value = { url: target, status: null, error: \"too-many-redirects\" };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n } catch (err: any) {\n // A refused connection or DNS failure is real information: the host did not\n // answer. Distinguished from a status code so the caller can decide.\n const value = {\n url: target,\n status: null,\n error: err?.name === \"AbortError\" ? \"timeout\" : \"unreachable\",\n };\n cache.set(target, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n}\n\n// Bounded parallelism: the val has a 1 minute execution ceiling, so a batch of\n// 50 at 8s worst case each must not run serially.\nasync function checkAll(urls: string[]) {\n const results: any[] = new Array(urls.length);\n let next = 0;\n\n const workers = Array.from(\n { length: Math.min(BATCH_CONCURRENCY, urls.length) },\n async () => {\n while (true) {\n const i = next++;\n if (i >= urls.length) return;\n results[i] = await fetchStatus(urls[i]);\n }\n },\n );\n\n await Promise.all(workers);\n return results;\n}\n\n/**\n * URLVoid detection count.\n *\n * The website reaches URLVoid through public CORS proxies today and they have\n * all rotted: corsproxy.io 403s every request without exception, codetabs\n * returns 522, and allorigins works intermittently but hangs for 19-20 seconds\n * before failing. That hanging is the single largest cost in a scan.\n *\n * Counting happens HERE and only the number crosses the wire - the page is\n * ~36KB and the answer is one integer, so this stays cheap the same way the\n * status route does.\n *\n * The count is occurrences of the word \"detected\" in the page. Crude, but it is\n * what the extensions already use and it is calibrated: google.com 0,\n * pastes.io 3, netfilm.app 5.\n */\n// Sized against the val's 1 MINUTE execution ceiling, not against comfort.\n// Worst case is (batch / concurrency) rounds x timeout: 10/5 = 2 rounds x 15s =\n// 30s, leaving headroom. The obvious-looking 25/5 with a 20s timeout would be 5\n// rounds = 100s and the val would be killed part way through the batch.\nconst URLVOID_TIMEOUT_MS = 15000;\nconst URLVOID_MAX_BATCH = 10;\nconst URLVOID_CONCURRENCY = 5;\n\nasync function urlvoidCount(domain: string) {\n const clean = String(domain || \"\").trim().toLowerCase();\n if (!clean || !/^[a-z0-9.-]+$/.test(clean)) {\n return { domain, count: null, error: \"bad-domain\" };\n }\n\n const cacheKey = `urlvoid:${clean}`;\n const cached = cache.get(cacheKey);\n if (cached && cached.expires > Date.now()) {\n return { ...cached.value, cached: true };\n }\n\n try {\n const controller = new AbortController();\n const timer = setTimeout(() => controller.abort(), URLVOID_TIMEOUT_MS);\n\n let res: Response;\n try {\n res = await fetch(\n `https://www.urlvoid.com/scan/${encodeURIComponent(clean)}/`,\n {\n signal: controller.signal,\n headers: {\n \"User-Agent\":\n \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36\",\n },\n },\n );\n } finally {\n clearTimeout(timer);\n }\n\n if (!res.ok) {\n try {\n await res.body?.cancel();\n } catch { /* already closed */ }\n return { domain: clean, count: null, error: `http-${res.status}` };\n }\n\n const html = await res.text();\n\n // URLVoid answers 200 with a \"Report Not Found\" page for any domain it has\n // never scanned. That page contains no \"detected\" either, so a naive count\n // reads it as ZERO DETECTIONS = clean, when it actually means \"no data\".\n // That is a silent false-clean, and it is the failure direction that matters\n // for a safety check. Detected by the page's own marker rather than by size:\n // the same page measured 12688 bytes locally and 12834 from the val, so a\n // byte threshold would be brittle.\n if (/Report Not Found/i.test(html)) {\n const value = {\n domain: clean,\n count: null,\n error: \"no-report\",\n bytes: html.length,\n };\n cache.set(cacheKey, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n }\n\n const count = (html.match(/detected/gi) || []).length;\n\n // `bytes` is returned so the caller can still sanity-check that a real scan\n // page came back, in case URLVoid introduces another shape of empty answer.\n const value = { domain: clean, count, bytes: html.length };\n cache.set(cacheKey, { value, expires: Date.now() + CACHE_TTL_MS });\n return value;\n } catch (err: any) {\n return {\n domain: clean,\n count: null,\n error: err?.name === \"AbortError\" ? \"timeout\" : \"unreachable\",\n };\n }\n}\n\nasync function urlvoidAll(domains: string[]) {\n const results: any[] = new Array(domains.length);\n let next = 0;\n\n const workers = Array.from(\n { length: Math.min(URLVOID_CONCURRENCY, domains.length) },\n async () => {\n while (true) {\n const i = next++;\n if (i >= domains.length) return;\n results[i] = await urlvoidCount(domains[i]);\n }\n },\n );\n\n await Promise.all(workers);\n return results;\n}\n\nexport default async function (req: Request): Promise {\n if (req.method === \"OPTIONS\") {\n return new Response(null, { headers: corsFor(req) });\n }\n\n const url = new URL(req.url);\n\n if (url.pathname === \"/health\") {\n return json({ status: \"ok\", cached: cache.size }, 200, req);\n }\n\n // Fail closed. If BMZ_TOKEN was never set, an undefined TOKEN would otherwise\n // match a caller who simply omitted ?key= and leave this wide open.\n if (!TOKEN) return json({ error: \"server not configured\" }, 503, req);\n\n const key = url.searchParams.get(\"key\");\n if (key !== TOKEN) return json({ error: \"bad key\" }, 403, req);\n\n // URLVoid: GET ?domain=... or POST { domains: [...] }\n if (url.pathname === \"/urlvoid\") {\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"bad json\" }, 400, req);\n }\n\n const domains = Array.isArray(body?.domains) ? body.domains : null;\n if (!domains) {\n return json({ error: \"expected { domains: [...] }\" }, 400, req);\n }\n if (domains.length > URLVOID_MAX_BATCH) {\n return json(\n { error: `max ${URLVOID_MAX_BATCH} domains per request` },\n 400,\n req,\n );\n }\n\n return json({ results: await urlvoidAll(domains) }, 200, req);\n }\n\n const domain = url.searchParams.get(\"domain\");\n if (!domain) return json({ error: \"missing domain\" }, 400, req);\n return json(await urlvoidCount(domain), 200, req);\n }\n\n // Batch: POST { urls: [...] }\n if (req.method === \"POST\") {\n let body: any;\n try {\n body = await req.json();\n } catch {\n return json({ error: \"bad json\" }, 400, req);\n }\n\n const urls = Array.isArray(body?.urls) ? body.urls : null;\n if (!urls) return json({ error: \"expected { urls: [...] }\" }, 400, req);\n if (urls.length > MAX_BATCH) {\n return json({ error: `max ${MAX_BATCH} urls per request` }, 400, req);\n }\n\n return json({ results: await checkAll(urls) }, 200, req);\n }\n\n // Single: GET ?url=...\n const target = url.searchParams.get(\"url\");\n if (!target) return json({ error: \"missing url\" }, 400, req);\n\n return json(await fetchStatus(target), 200, req);\n}","createdAt",["D",1787960354887],"branchVersion","branchId","6abda2db-9515-4b97-a6b1-ac4f5dfde99e","id","bcc12f98-bca5-4a87-af80-3f8fde18504e","link-status",["D",1787955230430],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","6cf8877d-7819-45dc-a495-2864c17b77f2","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019e8e28-de35-776d-af6d-e3ab77939d46","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":14,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","testpilot","handle","displayName","Test Pilot","avatar","https://lh3.googleusercontent.com/a/ACg8ocLF8ZTY_d5_QI10Y65wFr6Lw6BxHNOX0L2DGDewjR6Pe2xYIQ=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":149,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":150,"_80":151,"_82":152,"_84":25},"tree",[144],"files",[144],"counts",{"_133":62,"_134":135,"_136":62,"_137":138,"_139":140},"contents",[125],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":58,"_38":129,"_13":130,"_33":34,"_35":37,"_24":25,"_131":-5,"_27":132},"d299d036-ccd1-4d79-8fd1-f361f7aed386","parentId","latest",["D",1787960354887],7,"label",[28],"pulls","branches",1,"forks","envVars",{"_141":135,"_143":62},"connections",{"_141":62,"_142":62},"count","unfilledCount","emptyCount",{"_43":126,"_32":28,"_30":31,"_127":-5,"_41":42,"_40":14,"_128":58,"_38":145,"_13":130,"_33":34,"_35":37,"_24":25,"_131":-5,"_146":147,"_27":148},["D",1787960354887],"children",[],[28],["D",1787955230430],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":14,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_78":-5,"_122":186,"_187":188,"_189":190,"_191":25,"_192":25,"_193":25,"_194":58,"_195":-5,"_196":-7,"_197":-7,"_198":62,"_199":25,"_200":25,"_201":-5,"_202":25,"_203":25,"_204":25,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":85,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v8