[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8},"actionData","errors","root",{"_102":103,"_104":105},"routes/embed.x.$handle.$name.$",{"_9":10,"_11":12,"_13":14,"_15":16,"_17":18,"_19":20,"_21":-5},"handle","rocurity","name","curie-ID","path","curie_id.ts","project",{"_22":45,"_11":12,"_33":46,"_47":-5,"_48":42,"_49":50,"_51":50,"_52":53,"_54":-5,"_55":56,"_57":25,"_58":32,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":42},"file",{"_22":23,"_11":14,"_24":25,"_26":-5,"_27":28,"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":-5,"_13":44},"permalink","https://www.val.town/x/rocurity/curie-ID/code/curie_id.ts","extension","id","de78a852-4b3c-48a3-8cb6-5ff27d5b6e6b","fileId","fab254c8-a8da-11f1-8463-1607ee4eb77e","parentId","branchId","2c04a53e-0cd9-4938-a6f5-b437131ee544","branchVersion",27,"latest",true,"createdAt",["D",1789185672616],"version",26,"fileType","http","content","/**\n * CURIE ID — standalone identity backend, deployed as a Val.town HTTP val.\n *\n * Zero-cost stack:\n * - Firebase Auth (Spark/free) holds passwords — we never touch raw passwords ourselves.\n * - Firestore (Spark/free) holds Curie accounts — accessed here via REST + a service\n * account, so client apps can never read/write it directly (see firestore.rules).\n * - FCM (free) delivers verification/approval codes to a device — no email/SMS provider.\n * - This val itself (Val.town) replaces Cloud Functions, which requires Blaze billing.\n *\n * Required Val.town environment variables:\n * CURIE_JWT_SECRET - long random string, signs Curie's own session tokens\n * ADMIN_PASSWORD - password for the admin dashboard (pick something strong)\n * FIREBASE_WEB_API_KEY - Firebase project's public Web API key\n * FIREBASE_PROJECT_ID - Firebase project id\n * FIREBASE_CLIENT_EMAIL - service account email (Firebase console > Project settings\n * > Service accounts > Generate new private key)\n * FIREBASE_PRIVATE_KEY - service account private key (paste with \\n kept literal;\n * this file replaces \\\\n -> real newlines for you)\n *\n * User-facing endpoints:\n * GET /register/check-username ?username= -> { available }\n * POST /register/start { displayName, username, password, deviceId, fcmToken?, email? } -> { accessToken, curieId }\n * fcmToken and email are both optional — account activates immediately either way.\n * email, if given, only ever enables /forgot-password later; nothing else requires it.\n * POST /login { identifier, password, deviceId, fcmToken } -> { accessToken }\n * identifier accepts either the 9-digit Curie ID or a username.\n * A correct password is always enough — no device-approval step.\n * POST /verify-token (Authorization: Bearer ) -> { valid, curieId }\n * GET /me (Authorization: Bearer ) -> public profile\n * POST /me/email (Authorization: Bearer ) { email } -> { ok } (add/change recovery email later)\n * POST /forgot-password { identifier } -> { ok } (always ok; doesn't reveal if an account/email exists)\n * POST /reset-password { identifier, code, newPassword } -> { ok }\n * POST /mint-app-token (Authorization: Bearer ) { app: \"insaka\" | \"tushimi\" } -> { customToken, curieId, username, displayName }\n * GET /user/:curieId -> public profile\n *\n * Admin endpoints (Authorization: Bearer from /admin/login):\n * POST /admin/login { password } -> { accessToken }\n * GET /admin/users ?query=&cursor= -> { users, nextCursor }\n * GET /admin/users/:curieId -> full account (incl. devices)\n * POST /admin/users/:curieId/suspend -> { ok }\n * POST /admin/users/:curieId/activate -> { ok }\n * POST /admin/users/:curieId/delete -> { ok }\n * POST /admin/users/:curieId/devices/:deviceId/revoke -> { ok }\n * GET /admin/logs ?limit=100 -> { events }\n */\n\nimport { importPKCS8, jwtVerify, SignJWT } from \"npm:jose@6\";\n\n// ---------------------------------------------------------------------------\n// Config\n// ---------------------------------------------------------------------------\n\nconst CURIE_JWT_SECRET = Deno.env.get(\"CURIE_JWT_SECRET\")!;\nconst ADMIN_PASSWORD = Deno.env.get(\"ADMIN_PASSWORD\")!;\nconst FIREBASE_WEB_API_KEY = Deno.env.get(\"FIREBASE_WEB_API_KEY\")!;\nconst FIREBASE_PROJECT_ID = Deno.env.get(\"FIREBASE_PROJECT_ID\")!;\nconst FIREBASE_CLIENT_EMAIL = Deno.env.get(\"FIREBASE_CLIENT_EMAIL\")!;\nconst FIREBASE_PRIVATE_KEY = (Deno.env.get(\"FIREBASE_PRIVATE_KEY\") || \"\")\n .replace(/\\\\n/g, \"\\n\");\n\n// Optional — only needed if minting sign-in tokens for a SEPARATE Firebase\n// project (e.g. INSAKA) via POST /mint-app-token. Same idea as the Curie\n// project's own service account above, just for a different project.\nconst INSAKA_FIREBASE_PROJECT_ID = Deno.env.get(\"INSAKA_FIREBASE_PROJECT_ID\") ||\n \"\";\nconst INSAKA_FIREBASE_CLIENT_EMAIL =\n Deno.env.get(\"INSAKA_FIREBASE_CLIENT_EMAIL\") || \"\";\nconst INSAKA_FIREBASE_PRIVATE_KEY =\n (Deno.env.get(\"INSAKA_FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\n\n// Same idea, for the Tushimi (writer platform) Firebase project.\nconst TUSHIMI_FIREBASE_PROJECT_ID = Deno.env.get(\"TUSHIMI_FIREBASE_PROJECT_ID\") ||\n \"\";\nconst TUSHIMI_FIREBASE_CLIENT_EMAIL =\n Deno.env.get(\"TUSHIMI_FIREBASE_CLIENT_EMAIL\") || \"\";\nconst TUSHIMI_FIREBASE_PRIVATE_KEY =\n (Deno.env.get(\"TUSHIMI_FIREBASE_PRIVATE_KEY\") || \"\").replace(/\\\\n/g, \"\\n\");\n\n// Optional — only needed for password-reset emails. Without it, /forgot-password\n// still works but can't actually deliver a code (see sendEmail below).\nconst RESEND_API_KEY = Deno.env.get(\"RESEND_API_KEY\") || \"\";\nconst RESET_CODE_TTL_MS = 15 * 60 * 1000; // 15 min to use a reset code\n\nconst TOKEN_TTL_SECONDS = 60 * 60 * 6; // 6 hours — generous headroom against Val Town clock drift between instances\nconst APPROVAL_TTL_MS = 5 * 60 * 1000; // unused now that /login never requires approval — left for admin/legacy reference\n\nconst FIRESTORE_BASE =\n `https://firestore.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/databases/(default)/documents`;\n\n// ---------------------------------------------------------------------------\n// Google OAuth2 (service account) — lets us call Firestore + FCM with admin rights\n// ---------------------------------------------------------------------------\n\nlet cachedToken: { token: string; expiresAt: number } | null = null;\n\nasync function getGoogleAccessToken(): Promise {\n if (cachedToken && cachedToken.expiresAt > Date.now() + 30_000) {\n return cachedToken.token;\n }\n\n const now = Math.floor(Date.now() / 1000);\n const key = await importPKCS8(FIREBASE_PRIVATE_KEY, \"RS256\");\n\n const assertion = await new SignJWT({\n scope:\n \"https://www.googleapis.com/auth/datastore https://www.googleapis.com/auth/firebase.messaging https://www.googleapis.com/auth/identitytoolkit\",\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(FIREBASE_CLIENT_EMAIL)\n .setSubject(FIREBASE_CLIENT_EMAIL)\n .setAudience(\"https://oauth2.googleapis.com/token\")\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n\n const res = await fetch(\"https://oauth2.googleapis.com/token\", {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n body: new URLSearchParams({\n grant_type: \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n assertion,\n }),\n });\n\n if (!res.ok) {\n throw new Error(`Google token exchange failed: ${await res.text()}`);\n }\n const data = await res.json();\n\n cachedToken = {\n token: data.access_token,\n expiresAt: now * 1000 + data.expires_in * 1000,\n };\n return cachedToken.token;\n}\n\n// ---------------------------------------------------------------------------\n// Firestore REST helpers (admin access, bypasses security rules — trusted server only)\n// ---------------------------------------------------------------------------\n\nfunction toFirestoreValue(v: any): any {\n if (v === null || v === undefined) return { nullValue: null };\n if (typeof v === \"string\") return { stringValue: v };\n if (typeof v === \"boolean\") return { booleanValue: v };\n if (typeof v === \"number\") {\n return Number.isInteger(v)\n ? { integerValue: String(v) }\n : { doubleValue: v };\n }\n if (v instanceof Date) return { timestampValue: v.toISOString() };\n if (Array.isArray(v)) {\n return { arrayValue: { values: v.map(toFirestoreValue) } };\n }\n if (typeof v === \"object\") {\n return { mapValue: { fields: toFirestoreFields(v) } };\n }\n throw new Error(`Unsupported value type: ${typeof v}`);\n}\n\nfunction toFirestoreFields(obj: Record) {\n const fields: Record = {};\n for (const [k, v] of Object.entries(obj)) {\n if (v === undefined) continue;\n fields[k] = toFirestoreValue(v);\n }\n return fields;\n}\n\nfunction fromFirestoreValue(v: any): any {\n if (!v) return null;\n if (\"nullValue\" in v) return null;\n if (\"stringValue\" in v) return v.stringValue;\n if (\"integerValue\" in v) return parseInt(v.integerValue, 10);\n if (\"doubleValue\" in v) return v.doubleValue;\n if (\"booleanValue\" in v) return v.booleanValue;\n if (\"timestampValue\" in v) return v.timestampValue;\n if (\"arrayValue\" in v) {\n return (v.arrayValue.values || []).map(fromFirestoreValue);\n }\n if (\"mapValue\" in v) return fromFirestoreFields(v.mapValue.fields || {});\n return null;\n}\n\nfunction fromFirestoreFields(fields: Record) {\n const obj: Record = {};\n for (const [k, v] of Object.entries(fields || {})) {\n obj[k] = fromFirestoreValue(v);\n }\n return obj;\n}\n\nasync function getDoc(path: string): Promise | null> {\n const token = await getGoogleAccessToken();\n const res = await fetch(`${FIRESTORE_BASE}/${path}`, {\n headers: { Authorization: `Bearer ${token}` },\n });\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`Firestore get failed: ${await res.text()}`);\n const json = await res.json();\n return fromFirestoreFields(json.fields || {});\n}\n\n/** Create a doc with a specific ID. Fails (throws) if it already exists. */\nasync function createDoc(\n collection: string,\n id: string,\n data: Record,\n) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `${FIRESTORE_BASE}/${collection}?documentId=${encodeURIComponent(id)}`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n },\n );\n if (!res.ok) {\n throw new Error(\n `Firestore create failed (${res.status}): ${await res.text()}`,\n );\n }\n}\n\nasync function patchDoc(path: string, data: Record) {\n const token = await getGoogleAccessToken();\n const mask = Object.keys(data).map((k) =>\n `updateMask.fieldPaths=${encodeURIComponent(k)}`\n ).join(\"&\");\n const res = await fetch(`${FIRESTORE_BASE}/${path}?${mask}`, {\n method: \"PATCH\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ fields: toFirestoreFields(data) }),\n });\n if (!res.ok) {\n throw new Error(\n `Firestore patch failed (${res.status}): ${await res.text()}`,\n );\n }\n}\n\nasync function deleteDoc(path: string) {\n const token = await getGoogleAccessToken();\n await fetch(`${FIRESTORE_BASE}/${path}`, {\n method: \"DELETE\",\n headers: { Authorization: `Bearer ${token}` },\n });\n}\n\n/** Runs a structuredQuery against a collection. Returns decoded documents (with their id). */\nasync function runQuery(collection: string, opts: {\n where?: { field: string; op: string; value: any };\n orderBy?: { field: string; direction?: \"ASCENDING\" | \"DESCENDING\" };\n startAt?: string;\n endAt?: string;\n limit?: number;\n}) {\n const token = await getGoogleAccessToken();\n const structuredQuery: any = {\n from: [{ collectionId: collection }],\n limit: opts.limit || 50,\n };\n\n if (opts.where) {\n structuredQuery.where = {\n fieldFilter: {\n field: { fieldPath: opts.where.field },\n op: opts.where.op,\n value: toFirestoreValue(opts.where.value),\n },\n };\n }\n if (opts.orderBy) {\n structuredQuery.orderBy = [{\n field: { fieldPath: opts.orderBy.field },\n direction: opts.orderBy.direction || \"DESCENDING\",\n }];\n }\n\n const res = await fetch(`${FIRESTORE_BASE}:runQuery`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ structuredQuery }),\n });\n if (!res.ok) throw new Error(`Firestore query failed: ${await res.text()}`);\n const rows = await res.json();\n\n return rows\n .filter((r: any) => r.document)\n .map((r: any) => {\n const id = r.document.name.split(\"/\").pop();\n return { id, ...fromFirestoreFields(r.document.fields || {}) };\n });\n}\n\n// ---------------------------------------------------------------------------\n// FCM push (free — delivers verification codes / approval requests)\n// ---------------------------------------------------------------------------\n\n/** Returns { success, error?, staleToken? }. staleToken means the token is dead —\n * resending to it will never work, the browser needs to generate a fresh one. */\nasync function sendPush(\n fcmToken: string,\n title: string,\n body: string,\n data: Record,\n) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `https://fcm.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/messages:send`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n message: {\n token: fcmToken,\n notification: { title, body },\n data,\n android: { priority: \"high\" },\n },\n }),\n },\n );\n if (res.ok) return { success: true };\n\n const errText = await res.text();\n console.error(\"FCM send failed:\", errText);\n const staleToken = /UNREGISTERED|INVALID_ARGUMENT|NOT_FOUND/.test(errText);\n return { success: false, error: errText, staleToken };\n}\n\n// ---------------------------------------------------------------------------\n// Firebase Auth (Identity Toolkit REST) — holds passwords, we never store them ourselves\n// ---------------------------------------------------------------------------\n\nfunction syntheticEmail(curieId: string) {\n return `${curieId}@auth.curie.internal`;\n}\n\nasync function createAuthUser(\n curieId: string,\n password: string,\n displayName: string,\n): Promise {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signUp?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n email: syntheticEmail(curieId),\n password,\n displayName,\n returnSecureToken: false,\n }),\n },\n );\n if (!res.ok) throw new Error(`Auth user create failed: ${await res.text()}`);\n const data = await res.json();\n return data.localId as string; // Firebase Auth's own uid — save this, needed for admin deletion later\n}\n\n/** Admin-only: permanently deletes the underlying Firebase Auth credential. */\nasync function deleteAuthUserByUid(authUid: string) {\n const token = await getGoogleAccessToken();\n await fetch(\n `https://identitytoolkit.googleapis.com/v1/projects/${FIREBASE_PROJECT_ID}/accounts:delete`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ localId: authUid }),\n },\n );\n}\n\nasync function firebasePasswordLogin(curieId: string, password: string) {\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=${FIREBASE_WEB_API_KEY}`,\n {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify({\n email: syntheticEmail(curieId),\n password,\n returnSecureToken: true,\n }),\n },\n );\n if (!res.ok) throw new Error(\"Invalid Curie ID or password\");\n return res.json();\n}\n\n/** Admin-only: directly sets a new password for an existing auth user, no old\n * password required. Used by the reset-password flow once a mailed code has\n * been verified — this is the same admin credential already used elsewhere\n * (getGoogleAccessToken), which already carries the identitytoolkit scope. */\nasync function adminSetPassword(authUid: string, newPassword: string) {\n const token = await getGoogleAccessToken();\n const res = await fetch(\n `https://identitytoolkit.googleapis.com/v1/accounts:update`,\n {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ localId: authUid, password: newPassword }),\n },\n );\n if (!res.ok) {\n throw new Error(`Password update failed: ${await res.text()}`);\n }\n}\n\n// ---------------------------------------------------------------------------\n// Email (Resend) — used only for password-reset codes right now\n// ---------------------------------------------------------------------------\n\nfunction generateResetCode() {\n return Math.floor(100_000 + Math.random() * 900_000).toString(); // 6 digits\n}\n\n/** Returns true on success. Never throws — a failed send shouldn't 500 the\n * request; callers just get told to check RESEND_API_KEY is configured. */\nasync function sendEmail(to: string, subject: string, html: string): Promise {\n if (!RESEND_API_KEY) {\n console.error(\"RESEND_API_KEY is not set — cannot send email\");\n return false;\n }\n try {\n const res = await fetch(\"https://api.resend.com/emails\", {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${RESEND_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n // onboarding@resend.dev works immediately with no domain setup.\n // Swap for your own verified domain later (e.g. no-reply@curie.id)\n // once you've added one in the Resend dashboard.\n from: \"Curie ID \",\n to: [to],\n subject,\n html,\n }),\n });\n if (!res.ok) {\n console.error(\"Resend send failed:\", await res.text());\n return false;\n }\n return true;\n } catch (e) {\n console.error(\"Resend send threw:\", e);\n return false;\n }\n}\n\nfunction isValidEmail(v: unknown) {\n return typeof v === \"string\" && v.length <= 254 &&\n /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(v);\n}\n\n// ---------------------------------------------------------------------------\n// Curie ID + session token\n// ---------------------------------------------------------------------------\n\nfunction isValidCurieId(v: string) {\n return /^[0-9]{9}c$/.test(v);\n}\n\nfunction normalizeCurieId(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction isStrongPassword(p: unknown) {\n // At least 6 characters, with a mix of letters and numbers.\n return typeof p === \"string\" && p.length >= 6 && p.length <= 128 &&\n /[a-zA-Z]/.test(p) && /[0-9]/.test(p);\n}\n\nfunction isValidUsername(v: unknown) {\n return typeof v === \"string\" && /^[a-z0-9_]{3,20}$/.test(v);\n}\n\nfunction normalizeUsername(v: unknown) {\n return String(v || \"\").trim().toLowerCase();\n}\n\nfunction generateCurieId() {\n const digits = Math.floor(100_000_000 + Math.random() * 900_000_000)\n .toString();\n return `${digits}c`;\n}\n\nasync function generateUniqueCurieId() {\n for (let i = 0; i < 20; i++) {\n const id = generateCurieId();\n if (!(await getDoc(`Users/${id}`))) return id;\n }\n throw new Error(\"Could not allocate a Curie ID\");\n}\n\nfunction getSecretBytes() {\n return new TextEncoder().encode(CURIE_JWT_SECRET);\n}\n\nasync function issueAccessToken(curieId: string) {\n return new SignJWT({ curieId, scope: \"curie\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(`${TOKEN_TTL_SECONDS}s`)\n .setIssuer(\"curie-id\")\n .setAudience(\"curie-apps\")\n .sign(getSecretBytes());\n}\n\nasync function authenticate(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id\",\n audience: \"curie-apps\",\n clockTolerance: 300, // 5 minutes — absorbs small clock drift between Val Town instances\n });\n if (!payload.curieId || !isValidCurieId(payload.curieId as string)) {\n throw new Error(\"Invalid token\");\n }\n return payload;\n}\n\n// ---------------------------------------------------------------------------\n// Minting sign-in tokens for OTHER Firebase projects (e.g. INSAKA, Tushimi)\n// ---------------------------------------------------------------------------\n// A Firebase \"custom token\" is just a signed JWT in a specific shape — Google\n// never has to be called to create one, unlike the OAuth2 access tokens above.\n// Any app holding a project's service account key can mint one for any uid\n// in that project, and the client redeems it via signInWithCustomToken().\n// This is how a Curie ID login becomes a real, first-class signed-in session\n// inside another app's own separate Firebase project, using that app's own\n// uid space — no changes needed to that app's existing Auth-based security\n// rules.\nasync function mintFirebaseCustomToken(\n projectClientEmail: string,\n projectPrivateKey: string,\n uid: string,\n extraClaims: Record = {},\n) {\n const key = await importPKCS8(projectPrivateKey, \"RS256\");\n const now = Math.floor(Date.now() / 1000);\n return new SignJWT({\n uid,\n claims: extraClaims,\n })\n .setProtectedHeader({ alg: \"RS256\", typ: \"JWT\" })\n .setIssuer(projectClientEmail)\n .setSubject(projectClientEmail)\n .setAudience(\n \"https://identitytoolkit.googleapis.com/google.identity.identitytoolkit.v1.IdentityToolkit\",\n )\n .setIssuedAt(now)\n .setExpirationTime(now + 3600)\n .sign(key);\n}\n\n// ---------------------------------------------------------------------------\n// Audit log (feeds the admin dashboard's activity view)\n// ---------------------------------------------------------------------------\n\nasync function logEvent(\n type: string,\n curieId: string | null,\n meta: Record = {},\n) {\n const token = await getGoogleAccessToken();\n try {\n await fetch(`${FIRESTORE_BASE}/AuditLog`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${token}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n fields: toFirestoreFields({\n type,\n curieId,\n meta,\n createdAt: new Date(),\n }),\n }),\n });\n } catch (e) {\n console.error(\"Failed to write audit log:\", e); // never block the actual request over this\n }\n}\n\n// ---------------------------------------------------------------------------\n// Admin auth — separate token type from user sessions, gated by ADMIN_PASSWORD\n// ---------------------------------------------------------------------------\n\nasync function issueAdminToken() {\n return new SignJWT({ scope: \"admin\" })\n .setProtectedHeader({ alg: \"HS256\", typ: \"JWT\" })\n .setIssuedAt()\n .setExpirationTime(\"4h\")\n .setIssuer(\"curie-id-admin\")\n .setAudience(\"curie-admin-dashboard\")\n .sign(getSecretBytes());\n}\n\nasync function authenticateAdmin(req: Request) {\n const header = req.headers.get(\"authorization\") || \"\";\n if (!header.startsWith(\"Bearer \")) throw new Error(\"Missing bearer token\");\n const { payload } = await jwtVerify(header.slice(7), getSecretBytes(), {\n issuer: \"curie-id-admin\",\n audience: \"curie-admin-dashboard\",\n });\n if (payload.scope !== \"admin\") throw new Error(\"Not an admin token\");\n return payload;\n}\n\nfunction publicUser(data: Record) {\n return {\n curieId: data.curieId,\n username: data.username || null,\n displayName: data.displayName || \"\",\n countryCode: data.countryCode || null,\n createdAt: data.createdAt || null,\n };\n}\n\n// ---------------------------------------------------------------------------\n// Login rate limiting (existing account brute-force protection)\n// ---------------------------------------------------------------------------\n\nasync function isRateLimited(curieId: string) {\n const doc = await getDoc(`LoginAttempts/${curieId}`);\n if (!doc) return false;\n return !!(doc.lockedUntil &&\n new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordFailedLogin(curieId: string) {\n const doc = (await getDoc(`LoginAttempts/${curieId}`)) || { failedCount: 0 };\n const failedCount = (doc.failedCount || 0) + 1;\n const update: Record = { failedCount };\n if (failedCount >= 5) {\n update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n }\n try {\n await createDoc(\"LoginAttempts\", curieId, update);\n } catch {\n await patchDoc(`LoginAttempts/${curieId}`, update);\n }\n}\n\nasync function clearFailedLogins(curieId: string) {\n await deleteDoc(`LoginAttempts/${curieId}`);\n}\n\n// ---------------------------------------------------------------------------\n// Simple per-IP throttle for /register/start (no account exists yet to lock)\n// ---------------------------------------------------------------------------\n\nasync function isRegisterThrottled(ip: string) {\n const doc = await getDoc(`RegisterAttempts/${ip.replace(/[.:]/g, \"_\")}`);\n if (!doc) return false;\n return !!(doc.lockedUntil &&\n new Date(doc.lockedUntil).getTime() > Date.now());\n}\n\nasync function recordRegisterAttempt(ip: string) {\n const key = ip.replace(/[.:]/g, \"_\");\n const doc = (await getDoc(`RegisterAttempts/${key}`)) || { count: 0 };\n const count = (doc.count || 0) + 1;\n const update: Record = { count };\n if (count >= 5) update.lockedUntil = new Date(Date.now() + 15 * 60 * 1000);\n try {\n await createDoc(\"RegisterAttempts\", key, update);\n } catch {\n await patchDoc(`RegisterAttempts/${key}`, update);\n }\n}\n\n// ---------------------------------------------------------------------------\n// HTTP handler\n// ---------------------------------------------------------------------------\n\nfunction json(data: unknown, status = 200) {\n return new Response(JSON.stringify(data), {\n status,\n headers: {\n \"Content-Type\": \"application/json\",\n \"Access-Control-Allow-Origin\": \"*\",\n // Every response here can carry a live token or approval state — never\n // let a mobile carrier's transparent caching proxy (or any other\n // intermediate cache) serve a stale copy of it back on a later poll.\n \"Cache-Control\": \"no-store, no-cache, must-revalidate\",\n Pragma: \"no-cache\",\n },\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const path = url.pathname.replace(/\\/+$/, \"\") || \"/\";\n\n if (req.method === \"OPTIONS\") {\n return new Response(null, {\n status: 204,\n headers: {\n \"Access-Control-Allow-Origin\": \"*\",\n \"Access-Control-Allow-Methods\": \"GET,POST,OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Content-Type,Authorization\",\n },\n });\n }\n\n try {\n // Health check --------------------------------------------------------\n if (req.method === \"GET\" && path === \"/\") {\n return json({ service: \"Curie ID\", status: \"online\" });\n }\n\n // GET /register/check-username -------------------------------------------\n if (req.method === \"GET\" && path === \"/register/check-username\") {\n const username = normalizeUsername(url.searchParams.get(\"username\"));\n if (!isValidUsername(username)) {\n return json({\n available: false,\n error: \"3-20 characters, lowercase letters/numbers/underscore only\",\n }, 400);\n }\n const existing = await getDoc(`Usernames/${username}`);\n return json({ available: !existing });\n }\n\n // POST /register/start -------------------------------------------------\n // First-time signup activates the account immediately — no code required.\n if (req.method === \"POST\" && path === \"/register/start\") {\n const ip = req.headers.get(\"x-forwarded-for\") || \"unknown\";\n if (await isRegisterThrottled(ip)) {\n return json({ error: \"Too many attempts. Try again later.\" }, 429);\n }\n\n const {\n displayName,\n username: rawUsername,\n password,\n deviceId,\n fcmToken,\n email: rawEmail,\n } = await req.json();\n const username = normalizeUsername(rawUsername);\n const email = typeof rawEmail === \"string\" ? rawEmail.trim() : \"\";\n if (email && !isValidEmail(email)) {\n return json({ error: \"That doesn't look like a valid email address\" }, 400);\n }\n\n if (!displayName || !isStrongPassword(password) || !deviceId) {\n await recordRegisterAttempt(ip);\n return json({\n error: \"displayName, a strong password, and deviceId are required\",\n }, 400);\n }\n if (!isValidUsername(username)) {\n await recordRegisterAttempt(ip);\n return json({\n error:\n \"Username must be 3-20 characters: lowercase letters, numbers, underscore only\",\n }, 400);\n }\n\n const curieId = await generateUniqueCurieId();\n\n // Reserve the username first — if someone else already has it, fail fast\n // before creating any auth user or account.\n try {\n await createDoc(\"Usernames\", username, { curieId });\n } catch (e) {\n await recordRegisterAttempt(ip);\n return json({\n error: \"That username is already taken. Please choose another.\",\n }, 409);\n }\n\n let authUid: string;\n try {\n authUid = await createAuthUser(\n curieId,\n password,\n String(displayName).trim().slice(0, 100),\n );\n } catch (e) {\n await deleteDoc(`Usernames/${username}`);\n return json({ error: \"Could not create account\" }, 400);\n }\n\n try {\n await createDoc(\"Users\", curieId, {\n curieId,\n username,\n authUid,\n displayName: String(displayName).trim().slice(0, 100),\n status: \"active\",\n email: email || null,\n trustedDevices: [{\n deviceId,\n fcmToken: fcmToken || null,\n addedAt: new Date(),\n }],\n createdAt: new Date(),\n });\n } catch (e) {\n await deleteAuthUserByUid(authUid);\n await deleteDoc(`Usernames/${username}`);\n return json(\n { error: \"Could not create account, please try again\" },\n 500,\n );\n }\n\n await logEvent(\"register\", curieId, {\n ip,\n username,\n hasPushToken: !!fcmToken,\n });\n await recordRegisterAttempt(ip);\n\n const token = await issueAccessToken(curieId);\n return json({\n accessToken: token,\n tokenType: \"Bearer\",\n expiresIn: TOKEN_TTL_SECONDS,\n curieId,\n }, 201);\n }\n\n // POST /login -------------------------------------------------------------\n // A correct password is enough to sign in, even from a device we've never\n // seen before (e.g. browser data was cleared, or another app like INSAKA\n // calling this endpoint directly). There is no push-approval step: the\n // device is silently added to trustedDevices so it's on record, and the\n // access token is returned immediately in this same response — nothing\n // waits on a redirect or a second device, so there's no window for the\n // token to go stale before it's used.\n if (req.method === \"POST\" && path === \"/login\") {\n const {\n curieId: rawId,\n identifier: rawIdentifier,\n password,\n deviceId,\n fcmToken,\n } = await req.json();\n const raw = normalizeCurieId(rawIdentifier ?? rawId); // accepts either field name\n\n if (!raw || typeof password !== \"string\" || !deviceId) {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n // Accept either the 9-digit Curie ID directly, or a username that resolves to one.\n let curieId: string;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (!usernameDoc) {\n return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n }\n curieId = usernameDoc.curieId;\n } else {\n return json({ error: \"Invalid login request\" }, 400);\n }\n\n if (await isRateLimited(curieId)) {\n return json(\n { error: \"Too many failed attempts. Try again later.\" },\n 429,\n );\n }\n\n try {\n await firebasePasswordLogin(curieId, password);\n } catch {\n await recordFailedLogin(curieId);\n return json({ error: \"Invalid Curie ID/username or password\" }, 401);\n }\n await clearFailedLogins(curieId);\n\n const user = await getDoc(`Users/${curieId}`);\n if (!user || user.status === \"deleted\") {\n return json({ error: \"Account not found\" }, 403);\n }\n if (user.status === \"suspended\") {\n await logEvent(\"login_denied_suspended\", curieId, { deviceId });\n return json({ error: \"This account has been suspended\" }, 403);\n }\n if (user.status !== \"active\") {\n return json({ error: \"Account not verified\" }, 403);\n }\n\n const trusted = (user.trustedDevices || []).find((d: any) =>\n d.deviceId === deviceId\n );\n if (!trusted) {\n const newDevices = [...(user.trustedDevices || []), {\n deviceId,\n fcmToken: fcmToken || null,\n addedAt: new Date(),\n }];\n await patchDoc(`Users/${curieId}`, { trustedDevices: newDevices });\n await logEvent(\"login_device_added_no_approval\", curieId, { deviceId });\n }\n\n const token = await issueAccessToken(curieId);\n await logEvent(\"login_success\", curieId, { deviceId });\n return json({\n accessToken: token,\n tokenType: \"Bearer\",\n expiresIn: TOKEN_TTL_SECONDS,\n curieId,\n });\n }\n\n // POST /me/email ---------------------------------------------------------\n // Add or change the recovery email on an already-signed-in account. This\n // is the only thing email is ever used for — nothing else requires it.\n if (req.method === \"POST\" && path === \"/me/email\") {\n const payload = await authenticate(req);\n const { email: rawEmail } = await req.json();\n const email = typeof rawEmail === \"string\" ? rawEmail.trim() : \"\";\n if (!isValidEmail(email)) {\n return json({ error: \"That doesn't look like a valid email address\" }, 400);\n }\n await patchDoc(`Users/${payload.curieId}`, { email });\n await logEvent(\"email_updated\", payload.curieId as string, {});\n return json({ ok: true });\n }\n\n // POST /forgot-password ---------------------------------------------------\n // Always responds { ok: true } regardless of whether the account or its\n // email exists — this avoids letting someone probe which Curie IDs or\n // usernames have (or lack) a recovery email set. If everything lines up,\n // a 6-digit code is emailed and is valid for RESET_CODE_TTL_MS.\n if (req.method === \"POST\" && path === \"/forgot-password\") {\n const { identifier: rawIdentifier } = await req.json();\n const raw = normalizeCurieId(rawIdentifier);\n\n let curieId: string | null = null;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (usernameDoc) curieId = usernameDoc.curieId;\n }\n\n if (curieId) {\n if (await isRegisterThrottled(`forgot_${curieId}`)) {\n return json({ ok: true }); // still don't reveal anything — just silently skip sending\n }\n await recordRegisterAttempt(`forgot_${curieId}`);\n\n const user = await getDoc(`Users/${curieId}`);\n if (user && user.email) {\n const code = generateResetCode();\n try {\n await createDoc(\"PasswordResets\", curieId, {\n curieId,\n code,\n expiresAt: new Date(Date.now() + RESET_CODE_TTL_MS),\n });\n } catch {\n await patchDoc(`PasswordResets/${curieId}`, {\n code,\n expiresAt: new Date(Date.now() + RESET_CODE_TTL_MS),\n });\n }\n const sent = await sendEmail(\n user.email,\n \"Your Curie ID password reset code\",\n `

Your Curie ID (${curieId}) password reset code is:

${code}

This code expires in 15 minutes. If you didn't request this, you can ignore this email.

`,\n );\n await logEvent(\"password_reset_requested\", curieId, { emailSent: sent });\n }\n }\n\n return json({ ok: true });\n }\n\n // POST /reset-password -----------------------------------------------------\n if (req.method === \"POST\" && path === \"/reset-password\") {\n const { identifier: rawIdentifier, code, newPassword } = await req.json();\n const raw = normalizeCurieId(rawIdentifier);\n\n let curieId: string | null = null;\n if (isValidCurieId(raw)) {\n curieId = raw;\n } else if (isValidUsername(raw)) {\n const usernameDoc = await getDoc(`Usernames/${raw}`);\n if (usernameDoc) curieId = usernameDoc.curieId;\n }\n if (!curieId || !code || !isStrongPassword(newPassword)) {\n return json({ error: \"Invalid reset request\" }, 400);\n }\n\n const reset = await getDoc(`PasswordResets/${curieId}`);\n if (\n !reset || reset.code !== code ||\n new Date(reset.expiresAt).getTime() < Date.now()\n ) {\n return json({ error: \"That code is invalid or has expired\" }, 400);\n }\n\n const user = await getDoc(`Users/${curieId}`);\n if (!user || !user.authUid) {\n return json({ error: \"Account not found\" }, 404);\n }\n\n await adminSetPassword(user.authUid, newPassword);\n await deleteDoc(`PasswordResets/${curieId}`);\n await clearFailedLogins(curieId);\n await logEvent(\"password_reset_completed\", curieId, {});\n\n return json({ ok: true });\n }\n\n // -----------------------------------------------------------------------\n // ADMIN ROUTES\n // -----------------------------------------------------------------------\n\n // POST /admin/login -------------------------------------------------------\n if (req.method === \"POST\" && path === \"/admin/login\") {\n const { password } = await req.json();\n if (!password || password !== ADMIN_PASSWORD) {\n return json({ error: \"Invalid password\" }, 401);\n }\n const token = await issueAdminToken();\n return json({ accessToken: token, tokenType: \"Bearer\" });\n }\n\n // Everything else under /admin/ requires a valid admin token.\n if (path.startsWith(\"/admin/\")) {\n try {\n await authenticateAdmin(req);\n } catch {\n return json({ error: \"Admin authentication required\" }, 401);\n }\n\n // GET /admin/users?query= --------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/users\") {\n const query = (url.searchParams.get(\"query\") || \"\").trim();\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"50\", 10),\n 100,\n );\n\n let users;\n if (isValidCurieId(normalizeCurieId(query))) {\n const one = await getDoc(`Users/${normalizeCurieId(query)}`);\n users = one ? [{ id: normalizeCurieId(query), ...one }] : [];\n } else if (query) {\n const usernameMapping = isValidUsername(normalizeUsername(query))\n ? await getDoc(`Usernames/${normalizeUsername(query)}`)\n : null;\n\n if (usernameMapping) {\n const one = await getDoc(`Users/${usernameMapping.curieId}`);\n users = one ? [one] : [];\n } else {\n users = await runQuery(\"Users\", {\n where: {\n field: \"displayName\",\n op: \"GREATER_THAN_OR_EQUAL\",\n value: query,\n },\n orderBy: { field: \"displayName\", direction: \"ASCENDING\" },\n limit,\n });\n users = users.filter((u: any) =>\n (u.displayName || \"\").toLowerCase().startsWith(\n query.toLowerCase(),\n )\n );\n }\n } else {\n users = await runQuery(\"Users\", {\n orderBy: { field: \"createdAt\", direction: \"DESCENDING\" },\n limit,\n });\n }\n\n return json({\n users: users.map((u: any) => ({\n curieId: u.curieId,\n username: u.username || null,\n displayName: u.displayName,\n status: u.status,\n createdAt: u.createdAt,\n deviceCount: (u.trustedDevices || []).length,\n })),\n });\n }\n\n // GET /admin/users/:curieId ------------------------------------------\n const adminUserMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && adminUserMatch) {\n const user = await getDoc(`Users/${adminUserMatch[1]}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n return json({\n curieId: user.curieId,\n displayName: user.displayName,\n status: user.status,\n createdAt: user.createdAt,\n trustedDevices: user.trustedDevices || [],\n });\n }\n\n // POST /admin/users/:curieId/suspend ----------------------------------\n const suspendMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/suspend$/);\n if (req.method === \"POST\" && suspendMatch) {\n await patchDoc(`Users/${suspendMatch[1]}`, { status: \"suspended\" });\n await logEvent(\"admin_suspend\", suspendMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/activate ---------------------------------\n const activateMatch = path.match(\n /^\\/admin\\/users\\/([0-9]{9}c)\\/activate$/,\n );\n if (req.method === \"POST\" && activateMatch) {\n await patchDoc(`Users/${activateMatch[1]}`, { status: \"active\" });\n await logEvent(\"admin_activate\", activateMatch[1], {});\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/delete ------------------------------------\n const deleteMatch = path.match(/^\\/admin\\/users\\/([0-9]{9}c)\\/delete$/);\n if (req.method === \"POST\" && deleteMatch) {\n const curieId = deleteMatch[1];\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n\n if (user.authUid) {\n try {\n await deleteAuthUserByUid(user.authUid);\n } catch (e) {\n console.error(\"Failed to delete underlying auth credential:\", e);\n }\n }\n if (user.username) {\n await deleteDoc(`Usernames/${user.username}`);\n }\n await deleteDoc(`Users/${curieId}`);\n await deleteDoc(`LoginAttempts/${curieId}`);\n await logEvent(\"admin_delete\", curieId, {\n username: user.username || null,\n });\n return json({ ok: true });\n }\n\n // POST /admin/users/:curieId/devices/:deviceId/revoke ------------------\n const revokeMatch = path.match(\n /^\\/admin\\/users\\/([0-9]{9}c)\\/devices\\/([^/]+)\\/revoke$/,\n );\n if (req.method === \"POST\" && revokeMatch) {\n const [, curieId, deviceId] = revokeMatch;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Not found\" }, 404);\n const remaining = (user.trustedDevices || []).filter((d: any) =>\n d.deviceId !== deviceId\n );\n await patchDoc(`Users/${curieId}`, { trustedDevices: remaining });\n await logEvent(\"admin_revoke_device\", curieId, { deviceId });\n return json({ ok: true });\n }\n\n // GET /admin/logs ---------------------------------------------------------\n if (req.method === \"GET\" && path === \"/admin/logs\") {\n const limit = Math.min(\n parseInt(url.searchParams.get(\"limit\") || \"100\", 10),\n 200,\n );\n const events = await runQuery(\"AuditLog\", {\n orderBy: { field: \"createdAt\", direction: \"DESCENDING\" },\n limit,\n });\n return json({ events });\n }\n\n return json({ error: \"Not found\" }, 404);\n }\n\n // POST /verify-token ----------------------------------------------------\n if (req.method === \"POST\" && path === \"/verify-token\") {\n const payload = await authenticate(req);\n return json({\n valid: true,\n curieId: payload.curieId,\n expiresAt: payload.exp,\n });\n }\n\n // GET /me -----------------------------------------------------------------\n if (req.method === \"GET\" && path === \"/me\") {\n const payload = await authenticate(req);\n const user = await getDoc(`Users/${payload.curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n // POST /mint-app-token ------------------------------------------------------\n // Looks the requested app up in a small credentials table instead of\n // hardcoding a single app, so new apps (like Tushimi) can be added just\n // by adding env vars + a new entry here — no other endpoint changes.\n if (req.method === \"POST\" && path === \"/mint-app-token\") {\n const payload = await authenticate(req);\n const { app } = await req.json();\n\n const APP_CREDENTIALS: Record<\n string,\n { projectId: string; clientEmail: string; privateKey: string }\n > = {\n insaka: {\n projectId: INSAKA_FIREBASE_PROJECT_ID,\n clientEmail: INSAKA_FIREBASE_CLIENT_EMAIL,\n privateKey: INSAKA_FIREBASE_PRIVATE_KEY,\n },\n tushimi: {\n projectId: TUSHIMI_FIREBASE_PROJECT_ID,\n clientEmail: TUSHIMI_FIREBASE_CLIENT_EMAIL,\n privateKey: TUSHIMI_FIREBASE_PRIVATE_KEY,\n },\n };\n\n const creds = APP_CREDENTIALS[app];\n if (!creds) return json({ error: \"Unknown app\" }, 400);\n if (!creds.projectId || !creds.clientEmail || !creds.privateKey) {\n return json({\n error: `${app} integration is not configured on this server`,\n }, 501);\n }\n\n const curieId = payload.curieId as string;\n const user = await getDoc(`Users/${curieId}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n\n const customToken = await mintFirebaseCustomToken(\n creds.clientEmail,\n creds.privateKey,\n curieId, // becomes the uid inside the target app's Firebase project\n {\n curieUsername: user.username || null,\n curieDisplayName: user.displayName || null,\n },\n );\n\n await logEvent(\"mint_app_token\", curieId, { app });\n return json({\n customToken,\n curieId,\n username: user.username || null,\n displayName: user.displayName || \"\",\n });\n }\n\n // GET /user/:curieId ---------------------------------------------------\n const publicMatch = path.match(/^\\/user\\/([0-9]{9}c)$/);\n if (req.method === \"GET\" && publicMatch) {\n const user = await getDoc(`Users/${publicMatch[1]}`);\n if (!user) return json({ error: \"Curie account not found\" }, 404);\n return json(publicUser(user));\n }\n\n return json({ error: \"Not found\" }, 404);\n } catch (err) {\n console.error(err);\n return json({ error: \"Internal server error\" }, 500);\n }\n}","deleted",false,"label",[14],"45ec6b4d-76f2-43a3-b881-a7aaf9187167",["D",1788579388689],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","userId","860f2044-8a7f-4d4f-b481-eca89f0a8cf2","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019fb42d-289d-76eb-8026-f986896fa425","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_9":10,"_101":97},"org",{"_9":10,"_94":95,"_96":97,"_55":56,"_98":99,"_100":42},"branch",{"_35":30,"_11":85,"_22":28,"_86":45,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":12,"_93":10},"isOwned","main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","Rocurity","avatar","https://lh3.googleusercontent.com/a/ACg8ocI77drc4gWKU5gaAhxupzRpDqO2PN5OtCM-f_7zVnsNaWomkd0=s96-c","tier","free","canRestrictVals","profileImageUrl","ctx",{"_78":-5,"_135":136,"_137":138,"_139":140,"_141":42,"_142":42,"_143":42,"_144":32,"_145":-5,"_146":-7,"_147":-7,"_148":62,"_149":42,"_150":42,"_151":-5,"_152":42,"_153":42,"_154":42,"_155":-5},"ENV",{"_106":107,"_108":109,"_110":85,"_111":112,"_113":114,"_115":116,"_117":118,"_119":120,"_121":122,"_123":124,"_125":126,"_127":128,"_129":130,"_131":132,"_133":134},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town","orgs",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]