[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_176":177,"_178":179},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_133":-5,"_20":134,"_22":135,"_136":137,"_138":139,"_25":140,"_24":-5,"_141":-5,"_142":-5,"_143":54,"_144":145,"_146":45,"_147":-5,"_148":-5,"_149":150},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","wilt","name","manifestProxy","branchName","main","version","path","","project",{"_34":76,"_13":14,"_46":77,"_78":-5,"_79":54,"_80":81,"_82":81,"_83":84,"_85":-5,"_86":87,"_88":59,"_89":45,"_90":-5,"_91":-5,"_92":48,"_93":94,"_95":96,"_97":98,"_99":100,"_101":-5,"_102":103,"_104":103,"_105":106,"_107":106,"_108":106,"_109":103,"_110":103,"_111":112,"_113":114,"_115":116,"_117":54},"tree",[67,68],"file","contents",[32,33],"upstream","pull","ahead","behind","envVars",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":63,"_51":64,"_53":54,"_55":65,"_18":66},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":56},"id","65879683-8e22-4b0e-a638-f3c2c2cdef53","requests.tsx","fileId","313f2a52-a8cc-11f1-9588-1607ee4eb77e","parentId","branchId","b16fe429-7aff-4c9b-8160-512537a30958","branchVersion",3,"latest",true,"createdAt",["D",1788573037808],0,"fileType","script","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { raw } from \"npm:hono@4/html\";\n\nexport type RequestLogRow = {\n id: number;\n requested_at: string;\n method: string;\n path: string;\n query_string: string;\n ip_address: string | null;\n user_agent: string | null;\n referer: string | null;\n country: string | null;\n request_id: string | null;\n response_status: number;\n duration_ms: number;\n error_message: string | null;\n};\n\ntype RequestsPageProps = {\n rows: RequestLogRow[];\n username: string;\n};\n\nfunction valueOrDash(value: string | number | null): string {\n return value === null || value === \"\" ? \"—\" : String(value);\n}\n\nexport function RequestsPage({ rows, username }: RequestsPageProps) {\n return (\n <>\n {raw(\"\")}\n \n \n \n \n Recent manifest requests\n \n \n

Recent manifest requests

Signed in as {username}. Showing the latest {rows.length} requests.

\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n \n {rows.map((row) => (\n \n \n \n \n \n \n \n \n \n \n \n \n \n \n ))}\n \n

ID	Time	Method	Request	IP	Country	User agent	Referrer	Request ID	Status	Duration	Error
{row.id}	{row.requested_at}	{row.method}	\n \n {row.path}{row.query_string ? `?${row.query_string}` : \"\"}\n \n	{valueOrDash(row.ip_address)}	{valueOrDash(row.country)}	{valueOrDash(row.user_agent)}	{valueOrDash(row.referer)}	{valueOrDash(row.request_id)}	{row.response_status}	{row.duration_ms} ms	{valueOrDash(row.error_message)}

View source

\n \n \n \n );\n}\n","deleted",false,"label",[36],"c9312aed-8db2-4f57-9286-64ef133118ca","index.ts","d914dba4-9eb4-11f1-acd4-1607ee4eb77e",4,["D",1788573085547],2,"http","import { Hono } from \"npm:hono@4\";\nimport {\n getOAuthUserData,\n oauthMiddleware,\n} from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\nimport { parseVal } from \"https://esm.town/v/std/utils/index.ts\";\nimport { RequestsPage, type RequestLogRow } from \"./requests.tsx\";\n\ntype Manifest = Readonly<{\n source: string;\n contentType: string;\n}>;\n\n// Add future manifests here. Callers cannot supply upstream URLs.\nconst manifests: Readonly> = Object.freeze({\n \"/windows-terminal.appinstaller\": {\n source:\n \"https://raw.githubusercontent.com/wilt00/windows-terminal/personal/WindowsTerminalPersonal.appinstaller\",\n contentType: \"application/appinstaller\",\n },\n});\n\nconst MAX_MANIFEST_BYTES = 256 * 1024;\nconst RECENT_REQUEST_LIMIT = 100;\nconst ALLOWED_SOURCE_HOSTS = new Set([\"raw.githubusercontent.com\"]);\nconst SENSITIVE_NAME = /authorization|cookie|password|secret|token|api[-_]?key|val_town_access|^code$|^state$/i;\n\nlet schemaPromise: Promise | null = null;\n\nfunction ensureRequestLogSchema(): Promise {\n if (!schemaPromise) {\n schemaPromise = sqlite.execute(`CREATE TABLE IF NOT EXISTS request_logs (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n requested_at TEXT NOT NULL,\n method TEXT NOT NULL,\n path TEXT NOT NULL,\n query_string TEXT NOT NULL,\n ip_address TEXT,\n user_agent TEXT,\n referer TEXT,\n accept TEXT,\n accept_language TEXT,\n host TEXT,\n forwarded_for TEXT,\n country TEXT,\n request_id TEXT,\n val_town_user TEXT,\n response_status INTEGER NOT NULL,\n duration_ms INTEGER NOT NULL,\n error_message TEXT,\n headers_json TEXT NOT NULL\n )`).catch((error) => {\n schemaPromise = null;\n throw error;\n });\n }\n return schemaPromise;\n}\n\nfunction sanitizedQueryString(url: URL): string {\n const params = new URLSearchParams(url.search);\n for (const name of [...params.keys()]) {\n if (SENSITIVE_NAME.test(name)) params.set(name, \"[redacted]\");\n }\n return params.toString();\n}\n\nfunction headersForLog(headers: Headers): string {\n const loggedHeaders = Object.fromEntries(\n [...headers.entries()].map(([name, value]) => [\n name,\n SENSITIVE_NAME.test(name) ? \"[redacted]\" : value.slice(0, 2048),\n ]),\n );\n let serialized = JSON.stringify(loggedHeaders);\n while (serialized.length > 16 * 1024) {\n const lastName = Object.keys(loggedHeaders).pop();\n if (!lastName) break;\n delete loggedHeaders[lastName];\n serialized = JSON.stringify(loggedHeaders);\n }\n return serialized;\n}\n\nasync function logRequest(\n request: Request,\n responseStatus: number,\n startedAt: number,\n errorMessage: string | null,\n): Promise {\n try {\n await ensureRequestLogSchema();\n\n const url = new URL(request.url);\n const forwardedFor = request.headers.get(\"x-forwarded-for\");\n const ipAddress = request.headers.get(\"fly-client-ip\") ??\n request.headers.get(\"cf-connecting-ip\") ??\n request.headers.get(\"true-client-ip\") ??\n request.headers.get(\"x-real-ip\") ??\n forwardedFor?.split(\",\")[0]?.trim() ??\n null;\n\n await sqlite.execute({\n sql: `INSERT INTO request_logs (\n requested_at, method, path, query_string, ip_address, user_agent,\n referer, accept, accept_language, host, forwarded_for, country,\n request_id, val_town_user, response_status, duration_ms,\n error_message, headers_json\n ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n new Date().toISOString(),\n request.method,\n url.pathname,\n sanitizedQueryString(url),\n ipAddress,\n request.headers.get(\"user-agent\"),\n request.headers.get(\"referer\"),\n request.headers.get(\"accept\"),\n request.headers.get(\"accept-language\"),\n url.host,\n forwardedFor,\n request.headers.get(\"cf-ipcountry\") ?? request.headers.get(\"x-vercel-ip-country\"),\n request.headers.get(\"x-request-id\") ??\n request.headers.get(\"x-val-town-request-id\") ??\n request.headers.get(\"rndr-id\") ??\n request.headers.get(\"cf-ray\"),\n request.headers.get(\"x-val-town-user\"),\n responseStatus,\n Math.max(0, Math.round(performance.now() - startedAt)),\n errorMessage?.slice(0, 2048) ?? null,\n headersForLog(request.headers),\n ],\n });\n } catch (error) {\n // Request logging must never make the manifest endpoint unavailable.\n console.error(\"Failed to log manifest request\", error);\n }\n}\n\nasync function serveManifest(request: Request): Promise {\n if (request.method !== \"GET\" && request.method !== \"HEAD\") {\n return new Response(\"Method not allowed\\n\", {\n status: 405,\n headers: { Allow: \"GET, HEAD\" },\n });\n }\n\n const path = new URL(request.url).pathname.replace(/\\/+$/, \"\") || \"/\";\n const manifest = manifests[path];\n if (!manifest) {\n return new Response(\"Not found\\n\", { status: 404 });\n }\n\n const source = new URL(manifest.source);\n if (source.protocol !== \"https:\" || !ALLOWED_SOURCE_HOSTS.has(source.hostname)) {\n console.error(`Rejected non-allowlisted manifest source: ${source}`);\n return new Response(\"Manifest source is misconfigured\\n\", { status: 500 });\n }\n\n const upstream = await fetch(source, {\n headers: {\n Accept: manifest.contentType,\n \"User-Agent\": \"wilt-manifest-proxy/1.0\",\n },\n redirect: \"follow\",\n });\n if (!upstream.ok) {\n console.error(`Manifest fetch failed: ${source} (${upstream.status})`);\n return new Response(\"Manifest is temporarily unavailable\\n\", { status: 502 });\n }\n\n const body = new Uint8Array(await upstream.arrayBuffer());\n if (body.byteLength > MAX_MANIFEST_BYTES) {\n console.error(`Manifest is too large: ${source} (${body.byteLength} bytes)`);\n return new Response(\"Manifest is too large\\n\", { status: 502 });\n }\n\n return new Response(request.method === \"HEAD\" ? null : body, {\n headers: {\n \"Content-Type\": manifest.contentType,\n \"Content-Length\": String(body.byteLength),\n \"Cache-Control\": \"public, max-age=300\",\n \"X-Content-Type-Options\": \"nosniff\",\n },\n });\n}\n\nconst app = new Hono();\n\napp.get(\"/requests\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session?.user) return c.redirect(\"/auth/login\");\n if (!session.isOrgMember) return c.text(\"Forbidden\\n\", 403);\n\n await ensureRequestLogSchema();\n const result = await sqlite.execute({\n sql: `SELECT id, requested_at, method, path, query_string, ip_address,\n user_agent, referer, country, request_id, response_status, duration_ms,\n error_message\n FROM request_logs\n ORDER BY id DESC\n LIMIT ?`,\n args: [RECENT_REQUEST_LIMIT],\n });\n\n c.header(\"Cache-Control\", \"no-store\");\n return c.html(RequestsPage({\n rows: result.rows as unknown as RequestLogRow[],\n username: session.user.username ?? session.user.id,\n }));\n});\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\napp.all(\"*\", (c) => serveManifest(c.req.raw));\napp.onError((error) => Promise.reject(error));\n\nconst appWithOAuth = oauthMiddleware(app.fetch);\n\nexport default async function (request: Request): Promise {\n const startedAt = performance.now();\n let responseStatus = 500;\n let errorMessage: string | null = null;\n\n try {\n const response = await appWithOAuth(request);\n responseStatus = response.status;\n return response;\n } catch (error) {\n errorMessage = error instanceof Error ? error.message : String(error);\n throw error;\n } finally {\n await logRequest(request, responseStatus, startedAt, errorMessage);\n }\n}\n","wilt-manifests",[58],{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":73,"_17":62,"_49":63,"_51":64,"_53":54,"_55":65,"_70":74,"_18":75},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":69,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_70":71,"_18":72},["D",1788573037808],"children",[],[36],["D",1788573085547],[],[58],"b7e1bc2d-3953-45ad-8e34-44af02f2156c",["D",1787463499801],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Allowlisted proxy with manifest MIME types","imageUrl","userId","febc4285-e6a1-4c0f-8bfb-c068b09ce46d","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","b0fc47c7-b6cd-4ddb-a95a-0eb75d322130","tursoName","b7e1bc2d395345ad8e3444af02f2156c","tursoHostname","b7e1bc2d395345ad8e3444af02f2156c-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789531852468],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_132":128},"org",{"_11":12,"_126":-5,"_127":128,"_86":87,"_129":130,"_131":54},"branch",{"_17":60,"_13":16,"_34":41,"_118":76,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://secure.gravatar.com/avatar/95316a1d4fbd8be9c802a4e1e92fb9e9.jpg?s=200&d=identicon","tier","pro","canRestrictVals","profileImageUrl","adoptOrgId",{"_34":76,"_13":14,"_46":171,"_78":-5,"_79":54,"_80":81,"_82":81,"_83":84,"_85":-5,"_86":87,"_88":59,"_89":45,"_90":-5,"_91":-5,"_92":48,"_93":94,"_95":96,"_97":98,"_99":172,"_101":-5,"_102":103,"_104":103,"_105":106,"_107":106,"_108":106,"_109":103,"_110":103,"_111":173,"_113":174,"_115":175,"_117":54},[165,166],"files",[165,166],"counts",{"_155":48,"_156":157,"_158":48,"_31":159,"_160":161},[151,152],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":61,"_17":62,"_49":63,"_51":64,"_53":54,"_55":65,"_18":154},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":47,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_18":153},[36],[58],"pulls","branches",1,"forks",{"_162":48,"_164":48},"connections",{"_162":48,"_163":48},"count","unfilledCount","emptyCount",{"_34":57,"_13":58,"_37":59,"_39":-5,"_40":41,"_42":60,"_44":45,"_46":73,"_17":62,"_49":63,"_51":64,"_53":54,"_55":65,"_70":169,"_18":170},{"_34":35,"_13":36,"_37":38,"_39":-5,"_40":41,"_42":43,"_44":45,"_46":69,"_17":48,"_49":50,"_51":52,"_53":54,"_55":-5,"_70":167,"_18":168},[],[36],[],[58],["D",1787463499801],["D",1789531852468],{"_11":12,"_132":128},{"_11":12,"_126":-5,"_127":128,"_86":87,"_129":130,"_131":54},{"_17":60,"_13":16,"_34":41,"_118":76,"_119":-5,"_120":-5,"_121":-5,"_122":-5,"_123":-5,"_124":14,"_125":12},"ctx",{"_111":-5,"_148":209,"_210":211,"_212":213,"_214":54,"_215":54,"_216":54,"_217":45,"_218":-5,"_219":-7,"_220":-7,"_221":48,"_222":54,"_223":54,"_224":-5,"_225":54,"_226":54,"_227":54,"_228":-5},"ENV",{"_180":181,"_182":183,"_184":16,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200,"_201":202,"_203":204,"_205":206,"_207":208},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","5015b8df46402d8bba4f485ecc37aec202b0e06b","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Code