{message.text}

;\n};\n\nconst Layout = (\n props: { title: string; user?: User | null; notice?: string; children: unknown },\n) => (\n \n \n {props.title}\n \n \n \n \n \n \n \n \n \n {props.children}\n \n \n \n);\n\nconst Field = (\n props: {\n label: string;\n name: string;\n type: string;\n autocomplete: string;\n value?: string;\n hint?: string;\n },\n) => (\n \n {props.label}\n \n {props.hint ? {props.hint} : null}\n \n);\n\nconst Submit = ({ children }: { children: unknown }) => (\n \n {children}\n \n);\n\nconst app = new Hono();\n\nfunction redirect(\n path: string,\n params: Record = {},\n cookie?: string,\n): Response {\n const query = new URLSearchParams(params).toString();\n const headers: Record = { Location: query ? `${path}?${query}` : path };\n if (cookie) headers[\"Set-Cookie\"] = cookie;\n return new Response(null, { status: 302, headers });\n}\n\nfunction field(body: Record, name: string): string {\n const value = body[name];\n return typeof value === \"string\" ? value.trim() : \"\";\n}\n\nfunction noticeCode(c: Context): string | undefined {\n return c.req.query(\"err\") ?? c.req.query(\"msg\") ?? undefined;\n}\n\nasync function currentUser(c: Context): Promise {\n const token = readCookie(c.req.header(\"cookie\"), SESSION_COOKIE);\n if (!token) return null;\n const tokenHash = await hashToken(token);\n const session = await findSessionUser(tokenHash);\n if (!session) return null;\n if (Date.parse(session.session_expires_at) <= Date.now()) {\n await deleteSession(tokenHash);\n return null;\n }\n return session;\n}\n\nasync function startSession(userId: string): Promise {\n const now = Date.now();\n const token = newToken();\n await createSession({\n tokenHash: await hashToken(token),\n userId,\n createdAt: new Date(now).toISOString(),\n expiresAt: new Date(now + SESSION_DAYS * 86_400_000).toISOString(),\n });\n return sessionCookie(token, SESSION_DAYS * 86_400);\n}\n\n/** 生成验证码、落库、发信。带冷却和一小时次数上限。 */\nasync function issueCode(\n user: User,\n): Promise<\"ok\" | \"cooldown\" | \"rate_limited\" | \"mail_failed\"> {\n const now = Date.now();\n const recent = await countCodesSince(user.id, new Date(now - 3_600_000).toISOString());\n if (recent >= MAX_CODES_PER_HOUR) return \"rate_limited\";\n\n const last = await findActiveCode(user.id);\n if (last && now - Date.parse(last.created_at) < RESEND_COOLDOWN_SECONDS * 1000) {\n return \"cooldown\";\n }\n\n const code = generateCode();\n await insertCodeRow(user.id, code, now);\n\n try {\n await sendCodeEmail(user.email, code, CODE_TTL_MINUTES);\n return \"ok\";\n } catch (error) {\n console.error(\"验证码邮件发送失败:\", error);\n // 邮件发不出去时把验证码写进日志，方便你在 Val Town 日志里自己完成验证流程。\n console.log(`[dev] ${user.email} 的验证码是 ${code}`);\n return \"mail_failed\";\n }\n}\n\nasync function insertCodeRow(userId: string, code: string, now: number): Promise {\n const { insertCode } = await import(\"./db.ts\");\n await insertCode({\n id: crypto.randomUUID(),\n userId,\n codeHash: await hashCode(userId, code),\n createdAt: new Date(now).toISOString(),\n expiresAt: new Date(now + CODE_TTL_MINUTES * 60_000).toISOString(),\n });\n}\n\napp.get(\"/\", async (c) => {\n const user = await currentUser(c);\n return c.html(\n \n {user\n ? (\n

已登录

邮箱: {user.email}
状态: {user.verified_at ? \"已验证\" : \"未验证\"}
注册于: {new Date(user.created_at).toLocaleString(\"zh-CN\")}

\n 会话是 HttpOnly cookie，服务端只存 token 的哈希。登录状态保持 {SESSION_DAYS} 天。\n

\n )\n : (\n

邮箱注册 / 登录

\n 邮箱 + 密码注册 → 收 6 位验证码验证邮箱 → 登录后拿到会话 cookie。\n

\n \n 注册\n \n \n 登录\n \n

\n )}\n ,\n );\n});\n\napp.get(\"/signup\", async (c) => {\n const user = await currentUser(c);\n if (user) return redirect(\"/\");\n return c.html(\n \n

注册

\n ,\n );\n});\n\napp.post(\"/signup\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const password = field(body, \"password\");\n\n if (!/^[^@\\s]+@[^@\\s]+\\.[^@\\s]+$/.test(email) || email.length > MAX_EMAIL_LENGTH) {\n return redirect(\"/signup\", { err: \"invalid_email\" });\n }\n if (password.length < MIN_PASSWORD_LENGTH || password.length > MAX_PASSWORD_LENGTH) {\n return redirect(\"/signup\", { err: \"weak_password\" });\n }\n\n const existing = await findUserByEmail(email);\n if (existing?.verified_at) return redirect(\"/login\", { err: \"email_taken\" });\n\n let user = existing;\n if (!user) {\n try {\n await createUser({\n id: crypto.randomUUID(),\n email,\n passwordHash: await hashPassword(password),\n createdAt: new Date().toISOString(),\n });\n } catch (error) {\n // 并发注册撞上 UNIQUE 约束：当成已存在处理。\n console.error(\"创建用户失败:\", error);\n user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n }\n user ??= await findUserByEmail(email);\n }\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n\n const result = await issueCode(user);\n return redirect(\"/verify\", {\n email,\n ...(result === \"ok\" ? { msg: \"code_sent\" } : { err: result }),\n });\n});\n\napp.get(\"/verify\", async (c) => {\n const email = (c.req.query(\"email\") ?? \"\").toLowerCase();\n if (!email) return redirect(\"/signup\");\n return c.html(\n \n

验证邮箱

\n 验证码已发到 {email}，{CODE_TTL_MINUTES} 分钟内有效。\n

\n ,\n );\n});\n\napp.post(\"/verify\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const code = field(body, \"code\");\n\n const user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n\n const row = await findActiveCode(user.id);\n if (!row || Date.parse(row.expires_at) <= Date.now()) {\n return redirect(\"/verify\", { email, err: \"expired_code\" });\n }\n if (row.attempts >= MAX_CODE_ATTEMPTS) {\n return redirect(\"/verify\", { email, err: \"too_many_attempts\" });\n }\n if (await hashCode(user.id, code) !== row.code_hash) {\n await bumpCodeAttempts(row.id);\n return redirect(\"/verify\", { email, err: \"bad_code\" });\n }\n\n const now = new Date().toISOString();\n await consumeCode(row.id, now);\n await markVerified(user.id, now);\n return redirect(\"/\", { msg: \"welcome\" }, await startSession(user.id));\n});\n\napp.post(\"/verify/resend\", async (c) => {\n await initDb();\n const email = field(await c.req.parseBody(), \"email\").toLowerCase();\n const user = await findUserByEmail(email);\n if (!user) return redirect(\"/signup\", { err: \"invalid_email\" });\n if (user.verified_at) return redirect(\"/login\", { err: \"email_taken\" });\n\n const result = await issueCode(user);\n return redirect(\"/verify\", {\n email,\n ...(result === \"ok\" ? { msg: \"code_sent\" } : { err: result }),\n });\n});\n\napp.get(\"/login\", async (c) => {\n const user = await currentUser(c);\n if (user) return redirect(\"/\");\n return c.html(\n \n

\n ,\n );\n});\n\napp.post(\"/login\", async (c) => {\n await initDb();\n const body = await c.req.parseBody();\n const email = field(body, \"email\").toLowerCase();\n const password = field(body, \"password\");\n\n const user = await findUserByEmail(email);\n // 用户不存在时也走一遍哈希校验，避免用响应时间区分邮箱是否注册过。\n const ok = await verifyPassword(password, user?.password_hash ?? \"pbkdf2$1$AA$AA\");\n if (!user || !ok) return redirect(\"/login\", { err: \"invalid_credentials\" });\n if (!user.verified_at) return redirect(\"/verify\", { email, err: \"not_verified\" });\n\n return redirect(\"/\", { msg: \"welcome\" }, await startSession(user.id));\n});\n\napp.post(\"/logout\", async (c) => {\n const token = readCookie(c.req.header(\"cookie\"), SESSION_COOKIE);\n if (token) await deleteSession(await hashToken(token));\n return redirect(\"/\", { msg: \"logged_out\" }, clearedSessionCookie());\n});\n\napp.get(\"/public/*\", (c) => serveFile(c.req.path));\n\napp.get(\"/source\", (c) => c.redirect(parseVal().links.self.val));\n\n// 把 Hono 的错误换成原始错误，Val Town 日志里能看到真实堆栈\napp.onError((err) => Promise.reject(err));\n\nexport default app.fetch;",[70],"bfe521f7-4c90-4468-8fb0-97f26f3ef3bd","db.ts","56b52bd8-b2ae-11f1-99cb-1607ee4eb77e",2,["D",1789659727383],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport type User = {\n id: string;\n email: string;\n password_hash: string;\n created_at: string;\n verified_at: string | null;\n};\n\nexport type LoginCode = {\n id: string;\n user_id: string;\n code_hash: string;\n created_at: string;\n expires_at: string;\n consumed_at: string | null;\n attempts: number;\n};\n\nexport type SessionUser = User & { session_expires_at: string };\n\n// 建表。用 CREATE TABLE IF NOT EXISTS，所以每次冷启动跑一遍也是安全的。\nlet schemaReady: Promise | undefined;\n\nexport function initDb(): Promise {\n schemaReady ??= sqlite.batch([\n {\n sql: `CREATE TABLE IF NOT EXISTS users (\n id TEXT PRIMARY KEY,\n email TEXT NOT NULL COLLATE NOCASE UNIQUE,\n password_hash TEXT NOT NULL,\n created_at TEXT NOT NULL,\n verified_at TEXT\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS login_codes (\n id TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n code_hash TEXT NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL,\n consumed_at TEXT,\n attempts INTEGER NOT NULL DEFAULT 0\n )`,\n },\n {\n sql: `CREATE TABLE IF NOT EXISTS sessions (\n token_hash TEXT PRIMARY KEY,\n user_id TEXT NOT NULL,\n created_at TEXT NOT NULL,\n expires_at TEXT NOT NULL\n )`,\n },\n { sql: \"CREATE INDEX IF NOT EXISTS idx_login_codes_user ON login_codes(user_id, created_at)\" },\n ]).then(() => undefined);\n return schemaReady;\n}\n\nasync function query(sql: string, args: (string | number)[] = []): Promise {\n const result = await sqlite.execute({ sql, args });\n return result.rows as unknown as T[];\n}\n\nexport async function findUserByEmail(email: string): Promise {\n const [user] = await query(\"SELECT * FROM users WHERE email = ?\", [email]);\n return user ?? null;\n}\n\nexport async function createUser(user: {\n id: string;\n email: string;\n passwordHash: string;\n createdAt: string;\n}): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO users (id, email, password_hash, created_at) VALUES (?, ?, ?, ?)\",\n args: [user.id, user.email, user.passwordHash, user.createdAt],\n });\n}\n\nexport async function markVerified(userId: string, at: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE users SET verified_at = ? WHERE id = ? AND verified_at IS NULL\",\n args: [at, userId],\n });\n}\n\nexport async function insertCode(code: {\n id: string;\n userId: string;\n codeHash: string;\n createdAt: string;\n expiresAt: string;\n}): Promise {\n await sqlite.execute({\n sql: `INSERT INTO login_codes (id, user_id, code_hash, created_at, expires_at)\n VALUES (?, ?, ?, ?, ?)`,\n args: [code.id, code.userId, code.codeHash, code.createdAt, code.expiresAt],\n });\n}\n\n/** 最近一个还没用掉的验证码（可能是过期的，调用方自己判断）。 */\nexport async function findActiveCode(userId: string): Promise {\n const [row] = await query(\n \"SELECT * FROM login_codes WHERE user_id = ? AND consumed_at IS NULL ORDER BY created_at DESC LIMIT 1\",\n [userId],\n );\n return row ?? null;\n}\n\nexport async function consumeCode(codeId: string, at: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE login_codes SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL\",\n args: [at, codeId],\n });\n}\n\nexport async function bumpCodeAttempts(codeId: string): Promise {\n await sqlite.execute({\n sql: \"UPDATE login_codes SET attempts = attempts + 1 WHERE id = ?\",\n args: [codeId],\n });\n}\n\n/** 某个时间点之后这个用户一共申请过几次验证码（用于限流）。 */\nexport async function countCodesSince(userId: string, since: string): Promise {\n const [row] = await query<{ n: number }>(\n \"SELECT COUNT(*) AS n FROM login_codes WHERE user_id = ? AND created_at >= ?\",\n [userId, since],\n );\n return Number(row?.n ?? 0);\n}\n\nexport async function createSession(session: {\n tokenHash: string;\n userId: string;\n createdAt: string;\n expiresAt: string;\n}): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token_hash, user_id, created_at, expires_at) VALUES (?, ?, ?, ?)\",\n args: [session.tokenHash, session.userId, session.createdAt, session.expiresAt],\n });\n}\n\nexport async function findSessionUser(tokenHash: string): Promise {\n const [row] = await query(\n `SELECT u.*, s.expires_at AS session_expires_at\n FROM sessions s JOIN users u ON u.id = s.user_id\n WHERE s.token_hash = ?`,\n [tokenHash],\n );\n return row ?? null;\n}\n\nexport async function deleteSession(tokenHash: string): Promise {\n await sqlite.execute({ sql: \"DELETE FROM sessions WHERE token_hash = ?\", args: [tokenHash] });\n}",[79],"12f660a8-891a-4d8e-9066-76a094f7ec76","auth.ts","56bfff0e-b2ae-11f1-99cb-1607ee4eb77e",3,["D",1789659727447],"// 密码、验证码、会话 token 的处理。全部用 Web Crypto，没有第三方依赖。\n\nconst encoder = new TextEncoder();\n\nconst PBKDF2_ITERATIONS = 100_000;\n\nexport const SESSION_COOKIE = \"session\";\n\nfunction toBase64(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary);\n}\n\nfunction fromBase64(value: string): Uint8Array {\n const binary = atob(value);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);\n return bytes;\n}\n\nfunction equalBytes(a: Uint8Array, b: Uint8Array): boolean {\n if (a.length !== b.length) return false;\n let diff = 0;\n for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i];\n return diff === 0;\n}\n\nasync function derive(password: string, salt: Uint8Array, iterations: number): Promise {\n const key = await crypto.subtle.importKey(\"raw\", encoder.encode(password), \"PBKDF2\", false, [\n \"deriveBits\",\n ]);\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations, hash: \"SHA-256\" },\n key,\n 256,\n );\n return new Uint8Array(bits);\n}\n\n/** 存成 pbkdf2$迭代次数$盐$哈希，盐每个用户独立。 */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const hash = await derive(password, salt, PBKDF2_ITERATIONS);\n return `pbkdf2$${PBKDF2_ITERATIONS}$${toBase64(salt)}$${toBase64(hash)}`;\n}\n\nexport async function verifyPassword(password: string, stored: string): Promise {\n const [scheme, iterations, salt, hash] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\" || !iterations || !salt || !hash) return false;\n const candidate = await derive(password, fromBase64(salt), Number(iterations));\n return equalBytes(candidate, fromBase64(hash));\n}\n\n/** 6 位数字验证码。 */\nexport function generateCode(): string {\n return String(crypto.getRandomValues(new Uint32Array(1))[0] % 1_000_000).padStart(6, \"0\");\n}\n\nexport async function sha256Base64(input: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n return toBase64(new Uint8Array(digest));\n}\n\n/** 验证码不存明文，存哈希。 */\nexport async function hashCode(userId: string, code: string): Promise {\n return await sha256Base64(`${userId}:${code}`);\n}\n\n/** 会话 token 同理：只存哈希，明文只在 cookie 里。 */\nexport async function hashToken(token: string): Promise {\n return await sha256Base64(`session:${token}`);\n}\n\nexport function newToken(): string {\n const bytes = crypto.getRandomValues(new Uint8Array(32));\n return [...bytes].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function readCookie(header: string | null | undefined, name: string): string | null {\n if (!header) return null;\n for (const part of header.split(\";\")) {\n const index = part.indexOf(\"=\");\n if (index === -1) continue;\n if (part.slice(0, index).trim() === name) {\n return decodeURIComponent(part.slice(index + 1).trim());\n }\n }\n return null;\n}\n\nexport function sessionCookie(token: string, maxAgeSeconds: number): string {\n return `${SESSION_COOKIE}=${token}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAgeSeconds}`;\n}\n\nexport function clearedSessionCookie(): string {\n return `${SESSION_COOKIE}=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0`;\n}",[86],"b6a84a11-75dd-4c2b-8d71-251323feb8c8","README.md","01a0b007-082c-75f1-b566-c3540b70476c",10,["D",1789659918345],"# signup-login\n\n邮箱注册 / 登录 + 6 位验证码校验。Hono JSX 服务端渲染，SQLite 存数据，零第三方依赖。\n\n[打开应用](url:index.tsx)\n\n## 流程\n\n```mermaid\nsequenceDiagram\n participant U as 浏览器\n participant A as index.tsx\n participant D as SQLite\n participant M as std/email\n\n U->>A: POST /signup（邮箱 + 密码）\n A->>D: 建用户，密码存 PBKDF2 哈希\n A->>D: 存验证码哈希（10 分钟有效）\n A->>M: 发 6 位验证码\n A-->>U: 302 → /verify\n U->>A: POST /verify（验证码）\n A->>D: 比对哈希 → 标记邮箱已验证\n A->>D: 建会话，只存 token 的哈希\n A-->>U: 302 → / 并 Set-Cookie\n U->>A: GET /（带 cookie）\n A->>D: 用 token 哈希查会话\n A-->>U: 已登录页面\n```\n\n## 文件\n\n| 文件 | 作用 |\n| --- | --- |\n| `index.tsx` | 路由 + 页面（`/signup`、`/verify`、`/login`、`/logout`） |\n| `db.ts` | 三张表（users / login_codes / sessions）和所有查询 |\n| `auth.ts` | PBKDF2 密码哈希、验证码、会话 token、cookie 读写 |\n| `mail.ts` | 发验证码邮件 |\n| `test.ts` | 单元测试，用 `run_file` 直接跑 |\n\n跑测试：\n\n```\nrun_file(\"drmy01bsp6bi/signup-login\", \"test.ts\")\n```\n\n## 安全上的取舍\n\n- 密码用 PBKDF2-SHA256，10 万次迭代，每个用户独立随机盐。\n- 验证码和会话 token **都只存 SHA-256 哈希**。数据库泄露也拿不到能直接用的凭证。\n- 会话 cookie 带 `HttpOnly` + `Secure` + `SameSite=Lax`，30 天过期。\n- 登录失败统一提示\"邮箱或密码不对\"；邮箱不存在时也照样跑一遍哈希校验，避免用响应时间判断邮箱是否注册过。\n- 验证码：10 分钟过期、用掉即失效、错 5 次作废、30 秒冷却、每小时最多 5 次。\n- 页面只渲染文案代码（`?err=bad_code`），用户输入不会被反射回页面。\n\n## ⚠️ 免费套餐发不出邮件\n\n`std/email` 在免费账号上只能发给**本账号自己的邮箱**，日志原文：\n\n> Free tier users can only send email to themselves — leave `to`, `cc`, and `bcc` blank.\n\n所以现在这个版本：注册、验证码生成、验证、登录全都正常，只有\"把邮件投递给真实用户\"这一步会失败，页面上会明确提示。\n\n两个出路：\n\n1. **升级 Pro** —— 不用改任何代码，`mail.ts` 照旧。\n2. **换成自己的邮件服务** —— 改 `mail.ts` 里的发送实现（比如 Resend），把 API key 放进环境变量。\n\n👉 Add RESEND_API_KEY here: https://www.val.town/x/drmy01bsp6bi/signup-login/environment-variables?key=RESEND_API_KEY\n\n另外，邮件发送失败时验证码会打到日志里（`[dev] ... 的验证码是 ...`），方便你自己跑通流程。**正式上线前把 `index.tsx` 里那行 `console.log` 删掉。**\n\n## 还没做的\n\n- 忘记密码 / 重置密码\n- 改密码、改邮箱、注销账号\n- 会话管理（列出登录设备、\"退出所有设备\"）\n- CSRF token —— 目前靠 `SameSite=Lax` + 表单 POST 兜底，够用但不是零风险\n- 清理过期会话和验证码的定时任务（加一个 interval 文件即可）",[93],"52295a26-ce1a-43f2-a123-eb041e0d3050","public","01a0b007-082c-75f1-b566-bd26a32e0604",["D",1789659645926],"directory",[100],{"_39":99,"_13":100,"_42":101,"_44":-5,"_45":46,"_47":74,"_49":50,"_51":131,"_17":53,"_54":103,"_56":-5,"_58":59,"_60":-5,"_113":132,"_18":133},{"_39":92,"_13":93,"_42":94,"_44":-5,"_45":46,"_47":95,"_49":50,"_51":128,"_17":74,"_54":24,"_56":97,"_58":59,"_60":-5,"_113":129,"_18":130},{"_39":85,"_13":86,"_42":87,"_44":-5,"_45":46,"_47":88,"_49":50,"_51":125,"_17":53,"_54":55,"_56":90,"_58":59,"_60":-5,"_113":126,"_18":127},{"_39":78,"_13":79,"_42":80,"_44":-5,"_45":46,"_47":81,"_49":50,"_51":122,"_17":53,"_54":55,"_56":83,"_58":59,"_60":-5,"_113":123,"_18":124},{"_39":69,"_13":70,"_42":71,"_44":-5,"_45":46,"_47":72,"_49":50,"_51":119,"_17":74,"_54":75,"_56":76,"_58":59,"_60":-5,"_113":120,"_18":121},{"_39":62,"_13":63,"_42":64,"_44":-5,"_45":46,"_47":65,"_49":50,"_51":116,"_17":53,"_54":55,"_56":67,"_58":59,"_60":-5,"_113":117,"_18":118},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":112,"_17":53,"_54":55,"_56":57,"_58":59,"_60":-5,"_113":114,"_18":115},["D",1789659847451],"children",[],[41],["D",1789659727548],[],[63],["D",1789659795593],[],[70],["D",1789659727383],[],[79],["D",1789659727447],[],[86],["D",1789659918345],[],[93],["D",1789659645926],[134],[100],{"_39":135,"_13":136,"_42":137,"_44":101,"_45":46,"_47":74,"_49":50,"_51":138,"_17":53,"_54":24,"_56":139,"_58":59,"_60":-5,"_113":140,"_18":141},"73520635-9bdd-4366-885e-56f63098e59a","favicon.svg","01a0b007-082c-75f1-b566-ba2006e800dd",["D",1789659645926],"\n",[],[100,136],"4b3bb8fa-4cb4-4853-aec2-dc10c1c339dc",["D",1789659645926],"deletedAt","legacyEnvVars","privacy","httpPrivacy","description","邮箱注册 + 登录 + 验证码校验，SQLite 存用户，Hono JSX 页面","imageUrl","userId","8f5f4f03-5bf7-4d70-9213-3b0f291169e6","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0b001-2963-77e8-86ca-da7e1d5b44e5","tursoName","4b3bb8fa4cb44853aec2dc10c1c339dc","tursoHostname","4b3bb8fa4cb44853aec2dc10c1c339dc-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789660265060],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_196":19},"org",{"_11":12,"_191":19,"_192":19,"_151":152,"_193":194,"_195":59},"branch",{"_17":95,"_13":16,"_39":46,"_183":142,"_184":-5,"_185":-5,"_186":-5,"_187":-5,"_188":-5,"_189":14,"_190":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_39":142,"_13":14,"_51":262,"_144":-5,"_145":59,"_146":100,"_147":100,"_148":149,"_150":-5,"_151":152,"_153":71,"_154":50,"_155":-5,"_156":-5,"_157":53,"_158":159,"_160":161,"_162":163,"_164":263,"_166":-5,"_167":168,"_169":168,"_170":171,"_172":171,"_173":171,"_174":168,"_175":168,"_176":264,"_178":265,"_180":266,"_182":59},[238,240,241,242,243,244,245],"files",[238,239,240,241,242,243,244,245],"counts",{"_229":53,"_230":74,"_231":53,"_31":232,"_233":234},[215,216,217,218,219,220,221],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_39":99,"_13":100,"_42":101,"_44":-5,"_45":46,"_47":74,"_49":50,"_51":102,"_17":53,"_54":103,"_56":-5,"_58":59,"_60":-5,"_18":228},{"_39":92,"_13":93,"_42":94,"_44":-5,"_45":46,"_47":95,"_49":50,"_51":96,"_17":74,"_54":24,"_56":97,"_58":59,"_60":-5,"_18":227},{"_39":85,"_13":86,"_42":87,"_44":-5,"_45":46,"_47":88,"_49":50,"_51":89,"_17":53,"_54":55,"_56":90,"_58":59,"_60":-5,"_18":226},{"_39":78,"_13":79,"_42":80,"_44":-5,"_45":46,"_47":81,"_49":50,"_51":82,"_17":53,"_54":55,"_56":83,"_58":59,"_60":-5,"_18":225},{"_39":69,"_13":70,"_42":71,"_44":-5,"_45":46,"_47":72,"_49":50,"_51":73,"_17":74,"_54":75,"_56":76,"_58":59,"_60":-5,"_18":224},{"_39":62,"_13":63,"_42":64,"_44":-5,"_45":46,"_47":65,"_49":50,"_51":66,"_17":53,"_54":55,"_56":67,"_58":59,"_60":-5,"_18":223},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":52,"_17":53,"_54":55,"_56":57,"_58":59,"_60":-5,"_18":222},[41],[63],[70],[79],[86],[93],[100],"pulls","branches","forks",{"_235":53,"_237":53},"connections",{"_235":53,"_236":53},"count","unfilledCount","emptyCount",{"_39":99,"_13":100,"_42":101,"_44":-5,"_45":46,"_47":74,"_49":50,"_51":131,"_17":53,"_54":103,"_56":-5,"_58":59,"_60":-5,"_113":260,"_18":261},{"_39":135,"_13":136,"_42":137,"_44":101,"_45":46,"_47":74,"_49":50,"_51":138,"_17":53,"_54":24,"_56":139,"_58":59,"_60":-5,"_113":258,"_18":259},{"_39":92,"_13":93,"_42":94,"_44":-5,"_45":46,"_47":95,"_49":50,"_51":128,"_17":74,"_54":24,"_56":97,"_58":59,"_60":-5,"_113":256,"_18":257},{"_39":85,"_13":86,"_42":87,"_44":-5,"_45":46,"_47":88,"_49":50,"_51":125,"_17":53,"_54":55,"_56":90,"_58":59,"_60":-5,"_113":254,"_18":255},{"_39":78,"_13":79,"_42":80,"_44":-5,"_45":46,"_47":81,"_49":50,"_51":122,"_17":53,"_54":55,"_56":83,"_58":59,"_60":-5,"_113":252,"_18":253},{"_39":69,"_13":70,"_42":71,"_44":-5,"_45":46,"_47":72,"_49":50,"_51":119,"_17":74,"_54":75,"_56":76,"_58":59,"_60":-5,"_113":250,"_18":251},{"_39":62,"_13":63,"_42":64,"_44":-5,"_45":46,"_47":65,"_49":50,"_51":116,"_17":53,"_54":55,"_56":67,"_58":59,"_60":-5,"_113":248,"_18":249},{"_39":40,"_13":41,"_42":43,"_44":-5,"_45":46,"_47":48,"_49":50,"_51":112,"_17":53,"_54":55,"_56":57,"_58":59,"_60":-5,"_113":246,"_18":247},[],[41],[],[63],[],[70],[],[79],[],[86],[],[93],[],[100,136],[239],[100],["D",1789659645926],["D",1789660265060],{"_11":12,"_196":19},{"_11":12,"_191":19,"_192":19,"_151":152,"_193":194,"_195":59},{"_17":95,"_13":16,"_39":46,"_183":142,"_184":-5,"_185":-5,"_186":-5,"_187":-5,"_188":-5,"_189":14,"_190":12},"ctx",{"_176":-5,"_212":300,"_301":302,"_303":304,"_305":59,"_306":59,"_307":59,"_308":50,"_309":-5,"_310":-7,"_311":-7,"_312":53,"_313":59,"_314":59,"_315":-5,"_316":59,"_317":59,"_318":59,"_319":-5},"ENV",{"_271":272,"_273":274,"_275":16,"_276":277,"_278":279,"_280":281,"_282":283,"_284":285,"_286":287,"_288":289,"_290":291,"_292":293,"_294":295,"_296":297,"_298":299},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","71c1b20804b3232a7e513be260cfffc1932a9e97","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]