[{"_1":2,"_169":-5,"_170":-5},"loaderData",{"_3":4,"_91":92},"root",{"_5":6,"_34":35,"_64":65},"ctx",{"_7":8,"_23":-5,"_24":25,"_26":27,"_28":20,"_29":20,"_30":20,"_31":32,"_33":20},"auth",{"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20,"_21":22},"sessionClaims","sessionId","sessionStatus","userId","actor","orgId","orgRole","orgSlug","orgPermissions","factorVerificationAge","isAuthenticated",false,"tokenType","session_token","user","preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","notificationCount",0,"flagDenols","ENV",{"_36":37,"_38":39,"_40":41,"_42":43,"_44":45,"_46":47,"_48":49,"_50":51,"_52":53,"_54":55,"_56":57,"_58":59,"_60":61,"_62":63},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","VAL_RUNTIME_NAME","prod","RENDER_GIT_COMMIT","0e83a37603a7996d918363a2f608889037f26b4b","RENDER_GIT_BRANCH","main","CLERK_PUBLISHABLE_KEY","pk_live_Y2xlcmsudmFsLnRvd24k","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","API_URL","https://api.val.town","clerkState",{"_66":67},"__internal_clerk_state",{"_68":69,"_70":45,"_71":72,"_73":72,"_74":20,"_75":72,"_76":72,"_77":72,"_78":72,"_79":80,"_89":20,"_90":20},"__clerk_ssr_state",{"_21":22,"_9":-5,"_10":-5,"_11":-5,"_12":-5,"_13":-5,"_14":-5,"_15":-5,"_16":-5,"_17":-5,"_18":-5,"_19":20},"__publishableKey","__proxyUrl","","__domain","__isSatellite","__signInUrl","__signUpUrl","__afterSignInUrl","__afterSignUpUrl","__clerk_debug",{"_81":20,"_19":20,"_82":72,"_83":84,"_85":72,"_86":45,"_87":20,"_88":72},"isSignedIn","proxyUrl","reason","session-token-and-uat-missing","message","publishableKey","isSatellite","domain","__telemetryDisabled","__telemetryDebug","routes/embed.x.$handle.$name.$",{"_93":94,"_95":96,"_97":98,"_99":100,"_146":147,"_166":167,"_168":-5},"handle","min","name","min-github-app","path","githubApp.http.ts","project",{"_101":102,"_95":96,"_103":104,"_105":-5,"_106":20,"_107":108,"_109":72,"_110":-5,"_12":111,"_112":-5,"_113":20,"_114":-5,"_115":32,"_14":116,"_117":118,"_119":118,"_120":121,"_122":121,"_123":121,"_124":118,"_125":118,"_23":126,"_129":130,"_132":133,"_145":20},"id","4b0e9a5c-b963-11f0-9f51-0224a6c84d84","createdAt",["D",1762249656057],"deletedAt","legacyEnvVars","privacy","public","description","imageUrl","4beef6df-3843-4b72-89fa-30221ff3dc3f","pinnedFileId","pinPreview","screenshotVersion","likeCount","d71a7b3f-2bac-4e0a-ab86-45a2cb8e73e6","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm",{"_93":94,"_127":128},"profileImageUrl","https://images.clerk.dev/oauth_github/img_2SaTZZASBW3zWmhsdpd5gxwllMY.jpeg","org",{"_93":94,"_131":128},"avatar","branch",{"_134":135,"_95":43,"_101":136,"_137":102,"_138":-5,"_139":-5,"_140":-5,"_141":-5,"_142":-5,"_143":96,"_144":94},"version",16,"4b0ef6fa-b963-11f0-9f51-0224a6c84d84","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","isOwned","file",{"_101":148,"_95":98,"_149":150,"_151":-5,"_152":136,"_153":154,"_155":156,"_103":157,"_134":158,"_159":160,"_161":162,"_163":20,"_164":-5,"_97":165},"b4ff53f0-b9bf-11f0-9165-0224a6c84d84","fileId","3936819e-b965-11f0-9265-0224a6c84d84","parentId","branchId","branchVersion",15,"latest",true,["D",1762289347482],11,"fileType","http","content","// deno-lint-ignore-file require-await\n// Note: Val Town HTTP trigger to process GitHub App webhooks for repo bootstrap\n\nimport { timingSafeEqual } from \"https://deno.land/std@0.224.0/crypto/timing_safe_equal.ts\";\nimport { App } from \"https://esm.sh/@octokit/app@15.1.1?target=deno\";\nimport sodium from \"https://esm.sh/tweetsodium@0.2.0?target=deno\";\n\ntype ProjectType = \"android\" | \"node\" | \"unknown\";\n\ninterface RepositoryCreatedPayload {\n action: string;\n repository: {\n full_name: string;\n default_branch: string;\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n };\n installation?: {\n id: number;\n } | null;\n}\n\nconst TEMPLATE_URL = \"https://github.com/cmwen/min-android-app-template\";\nconst TARGET_WORKFLOW_FILE = \"bootstrap-action.yml\";\nconst WORKFLOW_POLL_ATTEMPTS = 12;\nconst WORKFLOW_POLL_INTERVAL_MS = 5_000;\n\nconst TEMPLATE_TYPE_MAP: Record = {\n [TEMPLATE_URL]: \"android\",\n};\n\nconst SECRET_CONFIG: Record = {\n android: { envVar: \"ANDROID_ACTION_SECRETS_JSON\", expectedPrefix: \"ANDROID_\" },\n node: { envVar: \"NODE_ACTION_SECRETS_JSON\", expectedPrefix: \"NPM_\" },\n unknown: null,\n};\n\nconst ANDROID_INDICATORS = [\n \"build.gradle\",\n \"settings.gradle\",\n \"gradlew\",\n \"gradlew.bat\",\n \"app/build.gradle\",\n \"app/src/main/AndroidManifest.xml\",\n];\n\nconst NODE_INDICATORS = [\n \"package.json\",\n \"package-lock.json\",\n \"pnpm-lock.yaml\",\n \"yarn.lock\",\n \"tsconfig.json\",\n \"vite.config.ts\",\n \"rollup.config.js\",\n];\n\ninterface WorkflowSummary {\n id: number;\n name?: string;\n path?: string;\n state?: string;\n}\n\ninterface WorkflowListResponse {\n workflows?: WorkflowSummary[];\n}\n\ninterface TemplateRepositoryDetails {\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n}\n\ninterface OctokitClient {\n request: (route: string, parameters: Record) => Promise<{ data: T }>;\n}\n\nexport default async function (req: Request): Promise {\n const requestId = crypto.randomUUID();\n\n const method = req.method.toUpperCase();\n if (method !== \"POST\") {\n console.log(`[${requestId}] Ignored non-POST request`);\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const webhookSecret = Deno.env.get(\"GITHUB_APP_WEBHOOK_SECRET\");\n const appId = Deno.env.get(\"GITHUB_APP_ID\");\n const privateKey = Deno.env.get(\"GITHUB_APP_PRIVATE_KEY\");\n\n if (!webhookSecret || !appId || !privateKey) {\n return new Response(\"Missing GitHub App environment configuration\", { status: 500 });\n }\n\n const rawBody = await req.text();\n\n const signatureHeader = req.headers.get(\"x-hub-signature-256\");\n if (!signatureHeader) {\n console.log(`[${requestId}] Missing signature header`);\n return new Response(\"Signature missing\", { status: 400 });\n }\n\n const validSignature = await verifySignature(webhookSecret, rawBody, signatureHeader);\n if (!validSignature) {\n console.log(`[${requestId}] Invalid signature`);\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n const eventName = req.headers.get(\"x-github-event\");\n if (!eventName) {\n console.log(`[${requestId}] Missing event name`);\n return new Response(\"Event header missing\", { status: 400 });\n }\n\n if (eventName !== \"repository\") {\n console.log(`[${requestId}] Ignored event ${eventName}`);\n return new Response(`Ignored event: ${eventName}`, { status: 202 });\n }\n\n let payload: RepositoryCreatedPayload;\n try {\n payload = JSON.parse(rawBody) as RepositoryCreatedPayload;\n } catch (error) {\n console.error(`[${requestId}] Failed to parse webhook payload`, error);\n return new Response(\"Invalid JSON payload\", { status: 400 });\n }\n\n if (payload.action !== \"created\") {\n console.log(`[${requestId}] Ignored repository action ${payload.action}`);\n return new Response(`Ignored repository action: ${payload.action}`, { status: 202 });\n }\n\n const { repository, installation } = payload;\n if (!repository?.full_name || !repository?.default_branch) {\n console.log(`[${requestId}] Repository payload incomplete`, payload.repository);\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n const templateInfo = payload.repository.template_repository ?? null;\n const templateUrlFromPayload = templateInfo?.html_url\n ?? (templateInfo?.full_name ? `https://github.com/${templateInfo.full_name}` : null);\n const payloadTemplateMatches = templateUrlFromPayload === TEMPLATE_URL;\n if (!payloadTemplateMatches) {\n console.log(`[${requestId}] Template mismatch from payload`, {\n repo: repository.full_name,\n templateUrlFromPayload,\n });\n }\n\n if (!installation?.id) {\n console.log(`[${requestId}] Missing installation context`);\n return new Response(\"Installation context missing\", { status: 400 });\n }\n\n try {\n console.log(`[${requestId}] Initializing Octokit client for repo ${repository.full_name}`);\n const octokit = await getInstallationOctokit(appId, privateKey, installation.id);\n const [owner, repoName] = repository.full_name.split(\"/\");\n if (!owner || !repoName) {\n console.log(`[${requestId}] Unable to determine owner/repo from full_name`, { fullName: repository.full_name });\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n let effectiveTemplateUrl = templateUrlFromPayload;\n if (!payloadTemplateMatches) {\n const repoDetails = await octokit.request(\"GET /repos/{owner}/{repo}\", {\n owner,\n repo: repoName,\n }) as { data: TemplateRepositoryDetails };\n const resolvedTemplateUrl = repoDetails.data.template_repository?.html_url\n ?? (repoDetails.data.template_repository?.full_name\n ? `https://github.com/${repoDetails.data.template_repository.full_name}`\n : null);\n console.log(`[${requestId}] Resolved template URL`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n effectiveTemplateUrl = resolvedTemplateUrl;\n if (resolvedTemplateUrl !== TEMPLATE_URL) {\n console.log(`[${requestId}] Skipping repo after resolution`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n return new Response(\"Repository not created from expected template\", { status: 202 });\n }\n }\n\n const projectType = await determineProjectType({\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl: effectiveTemplateUrl,\n octokit,\n owner,\n repo: repoName,\n defaultBranch: repository.default_branch,\n });\n\n const secretsSynced = await syncProjectSecrets({\n projectType,\n octokit,\n owner,\n repo: repoName,\n requestId,\n });\n\n if (!secretsSynced) {\n console.log(`[${requestId}] No secrets synced for project type ${projectType}`);\n }\n\n const workflowMatch = await findWorkflowWithRetry(octokit, owner, repoName, requestId);\n if (!workflowMatch) {\n console.log(`[${requestId}] Workflow did not become available in time`, {\n repo: repository.full_name,\n });\n return new Response(\"Workflow file not ready\", { status: 202 });\n }\n\n let activeWorkflow = workflowMatch;\n if (activeWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Enabling workflow ${TARGET_WORKFLOW_FILE} (state=${activeWorkflow.state})`);\n try {\n await enableWorkflow(octokit, owner, repoName, activeWorkflow.id ?? TARGET_WORKFLOW_FILE);\n } catch (enableError) {\n console.error(`[${requestId}] Failed to enable workflow`, enableError);\n return new Response(\"Workflow enable failed\", { status: 500 });\n }\n\n const refreshedWorkflow = await findWorkflowWithRetry(\n octokit,\n owner,\n repoName,\n requestId,\n 4,\n 2_000,\n false,\n );\n if (!refreshedWorkflow || refreshedWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Workflow still disabled after enable`, {\n repo: repository.full_name,\n state: refreshedWorkflow?.state,\n });\n return new Response(\"Workflow still disabled\", { status: 202 });\n }\n activeWorkflow = refreshedWorkflow;\n }\n\n const workflowId = activeWorkflow.id ?? TARGET_WORKFLOW_FILE;\n\n console.log(`[${requestId}] Dispatching workflow ${TARGET_WORKFLOW_FILE} for ${repository.full_name}@${repository.default_branch}`);\n await octokit.request(\"POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches\", {\n owner,\n repo: repoName,\n workflow_id: workflowId,\n ref: repository.default_branch,\n });\n console.log(`[${requestId}] Workflow dispatched successfully`, {\n repo: repository.full_name,\n templateUrl: effectiveTemplateUrl,\n });\n } catch (error) {\n console.error(`[${requestId}] Failed to trigger workflow`, error);\n return new Response(\"Workflow trigger failed\", { status: 500 });\n }\n\n return new Response(\"bootstrap-action dispatched\", { status: 200 });\n}\n\nasync function verifySignature(secret: string, body: string, receivedSignature: string): Promise {\n const encoder = new TextEncoder();\n const keyData = encoder.encode(secret);\n const key = await crypto.subtle.importKey(\n \"raw\",\n keyData,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n\n const mac = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(body));\n const expected = `sha256=${toHex(new Uint8Array(mac))}`;\n\n const expectedBytes = encoder.encode(expected);\n const receivedBytes = encoder.encode(receivedSignature);\n\n if (expectedBytes.length !== receivedBytes.length) {\n return false;\n }\n\n return timingSafeEqual(expectedBytes, receivedBytes);\n}\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function getInstallationOctokit(appId: string, privateKeyPem: string, installationId: number): Promise {\n const appIdNumber = Number(appId);\n if (Number.isNaN(appIdNumber)) {\n throw new Error(\"Invalid GitHub App ID – expected numeric string\");\n }\n const normalizedKey = normalizePrivateKey(privateKeyPem);\n const app = new App({\n appId: appIdNumber,\n privateKey: normalizedKey,\n });\n return await app.getInstallationOctokit(installationId);\n}\n\nasync function determineProjectType(params: {\n requestId: string;\n templateUrlFromPayload: string | null;\n resolvedTemplateUrl: string | null;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n defaultBranch: string;\n}): Promise {\n const {\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl,\n octokit,\n owner,\n repo,\n defaultBranch,\n } = params;\n\n const templateCandidates = [templateUrlFromPayload, resolvedTemplateUrl].filter(Boolean) as string[];\n for (const templateUrl of templateCandidates) {\n const mappedType = TEMPLATE_TYPE_MAP[templateUrl];\n if (mappedType) {\n console.log(`[${requestId}] Project type inferred from template`, {\n repo: `${owner}/${repo}`,\n templateUrl,\n mappedType,\n });\n return mappedType;\n }\n }\n\n const treePaths = await fetchRepoTreeWithRetry({\n octokit,\n owner,\n repo,\n branch: defaultBranch,\n requestId,\n });\n\n if (!treePaths) {\n console.log(`[${requestId}] Unable to fetch repository tree; defaulting to unknown type`, {\n repo: `${owner}/${repo}`,\n });\n return \"unknown\";\n }\n\n const { androidScore, nodeScore } = scoreProjectHeuristics(treePaths);\n console.log(`[${requestId}] Project heuristic scores`, {\n repo: `${owner}/${repo}`,\n androidScore,\n nodeScore,\n });\n\n if (androidScore >= 2 && androidScore >= nodeScore + 1) {\n return \"android\";\n }\n if (nodeScore >= 2 && nodeScore >= androidScore + 1) {\n return \"node\";\n }\n if (androidScore >= 3) {\n return \"android\";\n }\n if (nodeScore >= 3) {\n return \"node\";\n }\n\n return \"unknown\";\n}\n\nasync function fetchRepoTreeWithRetry(params: {\n octokit: OctokitClient;\n owner: string;\n repo: string;\n branch: string;\n requestId: string;\n attempts?: number;\n intervalMs?: number;\n}): Promise {\n const {\n octokit,\n owner,\n repo,\n branch,\n requestId,\n attempts = 5,\n intervalMs = 3_000,\n } = params;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/git/trees/{tree_sha}\", {\n owner,\n repo,\n tree_sha: branch,\n recursive: 1,\n }) as { data: { tree?: Array<{ path?: string }>; truncated?: boolean } };\n\n const treeEntries = response.data.tree ?? [];\n const paths = treeEntries\n .map((entry) => entry.path)\n .filter((path): path is string => typeof path === \"string\");\n\n if (response.data.truncated) {\n console.log(`[${requestId}] Repo tree truncated`, {\n repo: `${owner}/${repo}`,\n attempt,\n });\n }\n\n if (paths.length > 0) {\n return paths;\n }\n } catch (error) {\n if ((error as { status?: number }).status !== 404) {\n console.error(`[${requestId}] Failed to fetch repo tree`, error);\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for repository tree (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nfunction scoreProjectHeuristics(paths: string[]): { androidScore: number; nodeScore: number } {\n const androidScore = ANDROID_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n const nodeScore = NODE_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n return { androidScore, nodeScore };\n}\n\nasync function syncProjectSecrets(params: {\n projectType: ProjectType;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n requestId: string;\n}): Promise {\n const { projectType, octokit, owner, repo, requestId } = params;\n const config = SECRET_CONFIG[projectType];\n if (!config) {\n return false;\n }\n\n const secretsEnv = Deno.env.get(config.envVar);\n if (!secretsEnv) {\n console.log(`[${requestId}] Secret config env var missing`, {\n projectType,\n envVar: config.envVar,\n });\n return false;\n }\n\n let secretsRecord: Record;\n try {\n const parsed = JSON.parse(secretsEnv);\n if (!parsed || typeof parsed !== \"object\") {\n throw new Error(\"Invalid secret JSON structure\");\n }\n secretsRecord = Object.entries(parsed).reduce>((acc, [key, value]) => {\n if (typeof value === \"string\") {\n acc[key] = value;\n }\n return acc;\n }, {});\n } catch (error) {\n console.error(`[${requestId}] Failed to parse secret config`, error);\n throw new Error(`Secret config parse failure for ${config.envVar}`);\n }\n\n const entries = Object.entries(secretsRecord);\n if (entries.length === 0) {\n console.log(`[${requestId}] No secrets defined in env config`, {\n projectType,\n envVar: config.envVar,\n });\n return false;\n }\n\n const publicKeyResponse = await octokit.request(\"GET /repos/{owner}/{repo}/actions/secrets/public-key\", {\n owner,\n repo,\n }) as { data: { key_id: string; key: string } };\n\n const { key_id: keyId, key } = publicKeyResponse.data;\n\n for (const [secretName, secretValue] of entries) {\n if (!secretName.startsWith(config.expectedPrefix)) {\n console.log(`[${requestId}] Secret name does not match expected prefix`, {\n secretName,\n expectedPrefix: config.expectedPrefix,\n });\n }\n\n const encrypted = encryptSecretValue(key, secretValue);\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}\", {\n owner,\n repo,\n secret_name: secretName,\n encrypted_value: encrypted,\n key_id: keyId,\n });\n console.log(`[${requestId}] Updated secret ${secretName}`);\n }\n\n return true;\n}\n\nasync function findWorkflowWithRetry(\n octokit: OctokitClient,\n owner: string,\n repo: string,\n requestId: string,\n attempts = WORKFLOW_POLL_ATTEMPTS,\n intervalMs = WORKFLOW_POLL_INTERVAL_MS,\n checkFileExistence = true,\n): Promise {\n let fileExists: boolean | undefined = checkFileExistence ? undefined : true;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/actions/workflows\", {\n owner,\n repo,\n per_page: 100,\n }) as { data: WorkflowListResponse };\n\n const workflows = response.data.workflows ?? [];\n const match = workflows.find((workflow) => workflow.path?.endsWith(`/${TARGET_WORKFLOW_FILE}`));\n if (match) {\n return match;\n }\n\n if (fileExists === undefined) {\n fileExists = await doesWorkflowFileExist(octokit, owner, repo, TARGET_WORKFLOW_FILE);\n if (!fileExists) {\n console.log(`[${requestId}] Workflow file ${TARGET_WORKFLOW_FILE} missing from repository`, { owner, repo });\n return null;\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for workflow registration (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nasync function doesWorkflowFileExist(octokit: OctokitClient, owner: string, repo: string, fileName: string): Promise {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/contents/.github/workflows/{path}\", {\n owner,\n repo,\n path: fileName,\n });\n return Array.isArray(response.data) ? response.data.length > 0 : Boolean(response.data);\n } catch (error) {\n if ((error as { status?: number }).status === 404) {\n return false;\n }\n throw error;\n }\n}\n\nasync function enableWorkflow(octokit: OctokitClient, owner: string, repo: string, workflowId: number | string): Promise {\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable\", {\n owner,\n repo,\n workflow_id: workflowId,\n });\n}\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction normalizePrivateKey(pem: string): string {\n const cleaned = pem.replace(/\\r/g, \"\").replace(/\\\\n/g, \"\\n\").replace(/\\n+/g, \"\\n\").trim();\n\n if (cleaned.includes(\"-----BEGIN PRIVATE KEY-----\")) {\n return cleaned;\n }\n\n if (!cleaned.includes(\"-----BEGIN RSA PRIVATE KEY-----\")) {\n throw new Error(\"Unsupported private key format. Provide PKCS#8 or PKCS#1 PEM\");\n }\n\n const base64 = cleaned\n .replace(\"-----BEGIN RSA PRIVATE KEY-----\", \"\")\n .replace(\"-----END RSA PRIVATE KEY-----\", \"\")\n .replace(/\\s+/g, \"\");\n\n const pkcs1Bytes = decodeBase64(base64);\n const pkcs8Bytes = wrapPkcs1InPkcs8(pkcs1Bytes);\n const pkcs8Base64 = encodeBase64(pkcs8Bytes);\n const body = pkcs8Base64.match(/.{1,64}/g)?.join(\"\\n\") ?? pkcs8Base64;\n return `-----BEGIN PRIVATE KEY-----\\n${body}\\n-----END PRIVATE KEY-----`;\n}\n\nfunction wrapPkcs1InPkcs8(pkcs1: Uint8Array): Uint8Array {\n const version = new Uint8Array([0x02, 0x01, 0x00]);\n const algorithm = new Uint8Array([\n 0x30, 0x0d,\n 0x06, 0x09,\n 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,\n 0x05, 0x00,\n ]);\n const privateKey = encodeDerOctetString(pkcs1);\n const totalLength = version.length + algorithm.length + privateKey.length;\n const sequenceHeader = encodeDerSequence(totalLength);\n const result = new Uint8Array(sequenceHeader.length + version.length + algorithm.length + privateKey.length);\n let offset = 0;\n result.set(sequenceHeader, offset);\n offset += sequenceHeader.length;\n result.set(version, offset);\n offset += version.length;\n result.set(algorithm, offset);\n offset += algorithm.length;\n result.set(privateKey, offset);\n return result;\n}\n\nfunction encodeDerSequence(contentLength: number): Uint8Array {\n const lengthBytes = encodeDerLength(contentLength);\n const result = new Uint8Array(1 + lengthBytes.length);\n result[0] = 0x30;\n result.set(lengthBytes, 1);\n return result;\n}\n\nfunction encodeDerOctetString(value: Uint8Array): Uint8Array {\n const lengthBytes = encodeDerLength(value.length);\n const result = new Uint8Array(1 + lengthBytes.length + value.length);\n result[0] = 0x04;\n result.set(lengthBytes, 1);\n result.set(value, 1 + lengthBytes.length);\n return result;\n}\n\nfunction encodeDerLength(length: number): Uint8Array {\n if (length < 0x80) {\n return new Uint8Array([length]);\n }\n const bytes: number[] = [];\n let temp = length;\n while (temp > 0) {\n bytes.unshift(temp & 0xff);\n temp >>= 8;\n }\n return new Uint8Array([0x80 | bytes.length, ...bytes]);\n}\n\nfunction encryptSecretValue(publicKey: string, secretValue: string): string {\n const publicKeyBytes = decodeBase64(publicKey);\n const messageBytes = new TextEncoder().encode(secretValue);\n const encryptedBytes = sodium.seal(messageBytes, publicKeyBytes);\n return encodeBase64(encryptedBytes);\n}\n\nfunction decodeBase64(base64: string): Uint8Array {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\nfunction encodeBase64(bytes: Uint8Array): string {\n let binary = \"\";\n bytes.forEach((byte) => {\n binary += String.fromCharCode(byte);\n });\n return btoa(binary);\n}\n","deleted","label",[98],"permalink","https://www.val.town/x/min/min-github-app/code/githubApp.http.ts","extension","actionData","errors"]