[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_168":169,"_170":171},"routes/_app.x.$handle.$name",{"_98":97,"_31":43,"_107":88,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":57,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_41":42,"_31":43,"_36":44,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":69,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":81,"_82":83,"_84":85,"_86":24},"version",2,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":27,"_32":33,"_34":35,"_36":37,"_38":14,"_39":40,"_23":24},"previous","deleted",false,"deletedHere","path","auth.ts","latestPath","fileId","a744625a-b00e-11f1-b65d-1607ee4eb77e","name","fileType","script","content","/**\n * Password hashing and session tokens.\n *\n * Passwords: PBKDF2-SHA256, per-user random salt, stored as\n * pbkdf2$$$\n * Nothing reversible is ever written to the database.\n *\n * Sessions: 32 random bytes given to the browser, only the SHA-256\n * digest is stored. A database leak does not yield usable sessions.\n */\n\nconst PBKDF2_ITERATIONS = 210_000;\nconst SALT_BYTES = 16;\nconst KEY_BITS = 256;\n\nfunction toB64(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes));\n}\n\nfunction fromB64(s: string): Uint8Array {\n return Uint8Array.from(atob(s), (c) => c.charCodeAt(0));\n}\n\nasync function pbkdf2(\n password: string,\n salt: Uint8Array,\n iterations: number,\n): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", hash: \"SHA-256\", salt, iterations },\n key,\n KEY_BITS,\n );\n return new Uint8Array(bits);\n}\n\n/** Hash a password for storage. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));\n const hash = await pbkdf2(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toB64(salt)}$${toB64(hash)}`;\n}\n\n/** Constant-time byte comparison. */\nfunction timingSafeEqual(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\n/** Verify a password against a stored hash. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n try {\n const [scheme, iterStr, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const iterations = parseInt(iterStr, 10);\n if (!Number.isFinite(iterations) || iterations < 1000) return false;\n const candidate = await pbkdf2(password, fromB64(saltB64), iterations);\n return timingSafeEqual(candidate, fromB64(hashB64));\n } catch {\n return false;\n }\n}\n\n/**\n * Burn roughly the same time as a real verification when the username\n * doesn't exist, so response timing doesn't reveal which handles are real.\n */\nexport async function dummyVerify(): Promise {\n const salt = new Uint8Array(SALT_BYTES);\n await pbkdf2(\"decoy-value-for-timing\", salt, PBKDF2_ITERATIONS);\n}\n\n/** A fresh session token. Returns the plaintext (for the cookie) and its digest (for the DB). */\nexport async function newSessionToken(): Promise<{ token: string; digest: string }> {\n const raw = crypto.getRandomValues(new Uint8Array(32));\n const token = toB64(raw).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=/g, \"\");\n return { token, digest: await digestToken(token) };\n}\n\n/** SHA-256 of a session token, hex encoded. */\nexport async function digestToken(token: string): Promise {\n const bytes = await crypto.subtle.digest(\n \"SHA-256\",\n new TextEncoder().encode(token),\n );\n return Array.from(new Uint8Array(bytes))\n .map((b) => b.toString(16).padStart(2, \"0\"))\n .join(\"\");\n}\n\nexport const SESSION_TTL_DAYS = 30;\nexport const SESSION_COOKIE = \"tg_session\";\n","createdAt",["D",1789371240670],"branchVersion","branchId","bb0b67fb-350e-4d2b-8d6f-3c56dcf88f85","id","bfa39e45-7092-4aeb-b689-37287ba7acba","throne-gelt-ledger",["D",1789371222313],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Imperial wager ledger — accounts, bets, payouts","imageUrl","28c534b6-beee-40a1-be9c-43985b36185d","pinnedFileId","9c51ffec-b00e-11f1-bc3a-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","01a09ecc-b888-773d-b822-8340b04163b7","tursoName","bfa39e4570924aebb68937287ba7acba","tursoHostname","bfa39e4570924aebb68937287ba7acba-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789545678485],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_98":97,"_106":102},"org",{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},"branch",{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"isOwned",6,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","RT_Brandt","handle","displayName","Garrick W","avatar","https://lh3.googleusercontent.com/a/ACg8ocIFL4o68YPM3Sv8WlUCusFPkUPZWiKW0FtIuul8fl9ATqyk3Xw=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_41":42,"_31":43,"_36":163,"_45":-5,"_46":24,"_47":48,"_49":48,"_50":51,"_52":-5,"_18":53,"_54":55,"_56":57,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":67,"_68":164,"_70":-5,"_71":72,"_73":72,"_74":75,"_76":75,"_77":75,"_78":72,"_79":72,"_80":165,"_82":166,"_84":167,"_86":24},"tree",[154,155],"files",[154,155],"counts",{"_144":61,"_145":134,"_146":61,"_147":148,"_149":150},"contents",[129,130],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_41":141,"_31":27,"_29":30,"_133":-5,"_39":40,"_38":14,"_135":57,"_36":142,"_13":61,"_32":33,"_34":35,"_23":24,"_139":-5,"_26":143},{"_41":131,"_31":132,"_29":55,"_133":-5,"_39":40,"_38":134,"_135":24,"_36":136,"_13":61,"_32":137,"_34":138,"_23":24,"_139":-5,"_26":140},"18ee5279-cbd0-428c-a9cc-c2a383f90b16","main.tsx","parentId",1,"latest",["D",1789371222369],"http","export default async function (req: Request): Promise {\n return Response.json({ ok: true });\n}\n","label",[132],"a9d77305-8592-418d-8486-8b521c6fd867",["D",1789371240670],[27],"pulls","branches","forks","envVars",{"_151":14,"_153":61},"connections",{"_151":61,"_152":61},"count","unfilledCount","emptyCount",{"_41":141,"_31":27,"_29":30,"_133":-5,"_39":40,"_38":14,"_135":57,"_36":160,"_13":61,"_32":33,"_34":35,"_23":24,"_139":-5,"_157":161,"_26":162},{"_41":131,"_31":132,"_29":55,"_133":-5,"_39":40,"_38":134,"_135":24,"_36":156,"_13":61,"_32":137,"_34":138,"_23":24,"_139":-5,"_157":158,"_26":159},["D",1789371222369],"children",[],[132],["D",1789371240670],[],[27],["D",1789371222313],["D",1789545678485],{"_98":97,"_106":102},{"_98":97,"_99":100,"_101":102,"_18":53,"_103":104,"_105":24},{"_13":87,"_31":88,"_41":40,"_89":42,"_90":-5,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":43,"_96":97},"ctx",{"_80":-5,"_126":201,"_202":203,"_204":205,"_206":24,"_207":24,"_208":24,"_209":57,"_210":-5,"_211":-7,"_212":-7,"_213":61,"_214":24,"_215":24,"_216":-5,"_217":24,"_218":24,"_219":24,"_220":-5},"ENV",{"_172":173,"_174":175,"_176":88,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186,"_187":188,"_189":190,"_191":192,"_193":194,"_195":196,"_197":198,"_199":200},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v2