`\n : \"\";\n return new Response(\n `\n\n${htmlEscape(title)} · Chiron

${htmlEscape(title)}

${htmlEscape(message)}

${button}\n Chiron access verification

`,\n {\n status: 200,\n headers: {\n \"Content-Type\": \"text/html; charset=utf-8\",\n \"Cache-Control\": \"no-store\",\n \"Content-Security-Policy\":\n \"default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'\",\n \"Referrer-Policy\": \"no-referrer\",\n },\n },\n );\n}\n\nfunction redirect(location: string): Response {\n return new Response(null, {\n status: 302,\n headers: {\n Location: location,\n \"Cache-Control\": \"no-store\",\n \"Referrer-Policy\": \"no-referrer\",\n },\n });\n}\n\nfunction bytesToBase64Url(bytes: Uint8Array): string {\n let binary = \"\";\n for (const byte of bytes) binary += String.fromCharCode(byte);\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(\n /=+$/g,\n \"\",\n );\n}\n\nfunction base64UrlToBytes(value: string): Uint8Array {\n const normalized = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = normalized + \"=\".repeat((4 - (normalized.length % 4)) % 4);\n const binary = atob(padded);\n return Uint8Array.from(binary, (character) => character.charCodeAt(0));\n}\n\nfunction randomToken(bytes = 32): string {\n const output = new Uint8Array(bytes);\n crypto.getRandomValues(output);\n return bytesToBase64Url(output);\n}\n\nasync function sha256Base64Url(value: string): Promise {\n const digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(value));\n return bytesToBase64Url(new Uint8Array(digest));\n}\n\nasync function hmacBase64Url(secret: string, value: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(value));\n return bytesToBase64Url(new Uint8Array(mac));\n}\n\nasync function secretHash(value: string): Promise {\n const pepper = env(\"CLAIM_STATE_PEPPER\");\n if (!pepper) throw new Error(\"claim state secret not configured\");\n return hmacBase64Url(pepper, `state:${value}`);\n}\n\nasync function pkceVerifier(state: string): Promise {\n const pepper = env(\"CLAIM_STATE_PEPPER\");\n if (!pepper) throw new Error(\"claim state secret not configured\");\n // Deterministically derive the verifier from a server secret and state. The\n // database retains only a hash of state, so it cannot reconstruct a verifier.\n return hmacBase64Url(pepper, `pkce:${state}`);\n}\n\nasync function claimDataKey(): Promise {\n const encoded = env(\"CLAIM_DATA_KEY_B64\");\n if (!encoded || !hasValidClaimDataKeyConfig()) return undefined;\n try {\n const raw = base64UrlToBytes(encoded);\n return await crypto.subtle.importKey(\n \"raw\",\n raw,\n { name: \"AES-GCM\" },\n false,\n [\"encrypt\", \"decrypt\"],\n );\n } catch {\n return undefined;\n }\n}\n\nfunction hasValidClaimDataKeyConfig(): boolean {\n const encoded = env(\"CLAIM_DATA_KEY_B64\");\n if (!encoded) return false;\n try {\n return base64UrlToBytes(encoded).byteLength === 32;\n } catch {\n return false;\n }\n}\n\nasync function encryptClaimValue(\n value: string,\n key: CryptoKey,\n): Promise {\n const iv = new Uint8Array(12);\n crypto.getRandomValues(iv);\n const ciphertext = await crypto.subtle.encrypt(\n { name: \"AES-GCM\", iv },\n key,\n encoder.encode(value),\n );\n return `${bytesToBase64Url(iv)}.${\n bytesToBase64Url(new Uint8Array(ciphertext))\n }`;\n}\n\nasync function decryptClaimValue(\n value: string,\n key: CryptoKey,\n): Promise {\n const [encodedIv, encodedCiphertext] = value.split(\".\");\n if (!encodedIv || !encodedCiphertext) {\n throw new Error(\"malformed encrypted claim value\");\n }\n const clear = await crypto.subtle.decrypt(\n { name: \"AES-GCM\", iv: base64UrlToBytes(encodedIv) },\n key,\n base64UrlToBytes(encodedCiphertext),\n );\n return decoder.decode(clear);\n}\n\nfunction normalizeEmail(value: unknown): string {\n if (typeof value !== \"string\") return \"\";\n const normalized = value.trim().toLowerCase();\n // This is a guardrail against corrupt inputs, not a full RFC email parser.\n return /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(normalized) &&\n normalized.length <= 320\n ? normalized\n : \"\";\n}\n\nfunction normalizeGitHubLogin(value: unknown): string {\n if (typeof value !== \"string\") return \"\";\n const normalized = value.trim().toLowerCase();\n return /^[a-z\\d](?:[a-z\\d-]{0,37}[a-z\\d])?$|^[a-z\\d]$/.test(normalized)\n ? normalized\n : \"\";\n}\n\nfunction safeId(value: unknown): string {\n return typeof value === \"string\" && value.length > 0 && value.length <= 255\n ? value\n : \"\";\n}\n\nfunction paymentLinkAllowlist(): Set {\n return new Set(\n env(\"STRIPE_ALLOWED_PAYMENT_LINK_IDS\").split(\",\").map((id) => id.trim())\n .filter((id) => /^plink_[A-Za-z0-9]+$/.test(id)),\n );\n}\n\nfunction configuredClaimBase(req: Request): string {\n const configured = env(\"CLAIM_PUBLIC_BASE_URL\");\n if (configured) {\n const parsed = new URL(configured);\n if (parsed.protocol !== \"https:\") {\n throw new Error(\"claim public URL must be HTTPS\");\n }\n return configured.replace(/\\/+$/, \"\");\n }\n return new URL(req.url).origin;\n}\n\nfunction claimUrl(base: string, path: string, sessionId?: string): string {\n const url = new URL(`${base}${path}`);\n if (sessionId) url.searchParams.set(\"session_id\", sessionId);\n return url.toString();\n}\n\nlet schemaPromise: Promise | undefined;\nfunction ensureSchema(): Promise {\n schemaPromise ??= sqlite.batch([\n `CREATE TABLE IF NOT EXISTS paid_claims (\n checkout_session_id TEXT PRIMARY KEY,\n stripe_event_id TEXT NOT NULL UNIQUE,\n payment_link_id TEXT NOT NULL,\n subscription_id TEXT,\n tier TEXT NOT NULL,\n payer_email_encrypted TEXT NOT NULL,\n claimed_github_username_encrypted TEXT NOT NULL,\n status TEXT NOT NULL,\n oauth_state_hash TEXT,\n oauth_state_expires_at INTEGER,\n github_login TEXT,\n github_user_id TEXT,\n github_invitation_id TEXT,\n invite_permission TEXT,\n created_at TEXT NOT NULL,\n updated_at TEXT NOT NULL,\n error_code TEXT\n )`,\n `CREATE INDEX IF NOT EXISTS idx_paid_claims_oauth_state ON paid_claims(oauth_state_hash)`,\n `CREATE INDEX IF NOT EXISTS idx_paid_claims_subscription ON paid_claims(subscription_id)`,\n ]);\n return schemaPromise;\n}\n\nasync function getClaimBySession(\n sessionId: string,\n): Promise {\n const result = await sqlite.execute({\n sql:\n `SELECT * FROM paid_claims WHERE checkout_session_id = :session_id LIMIT 1`,\n args: { session_id: sessionId },\n });\n return result.rows[0] as ClaimRow | undefined;\n}\n\nasync function getClaimByState(\n stateHash: string,\n now: number,\n): Promise {\n const result = await sqlite.execute({\n sql: `SELECT * FROM paid_claims\n WHERE oauth_state_hash = :state_hash AND oauth_state_expires_at > :now\n LIMIT 1`,\n args: { state_hash: stateHash, now },\n });\n return result.rows[0] as ClaimRow | undefined;\n}\n\nasync function updateClaim(\n sessionId: string,\n updates: Record,\n): Promise {\n const entries = Object.entries({ ...updates, updated_at: timestamp() });\n const assignments = entries.map(([key]) => `${key} = :${key}`).join(\", \");\n const args: Record = {\n ...Object.fromEntries(entries),\n session_id: sessionId,\n };\n await sqlite.execute({\n sql:\n `UPDATE paid_claims SET ${assignments} WHERE checkout_session_id = :session_id`,\n args,\n });\n}\n\nfunction changedRows(result: unknown): number {\n return Number((result as { rowsAffected?: number }).rowsAffected ?? 0);\n}\n\nasync function verifyStripeSignature(\n payload: string,\n sigHeader: string,\n secret: string,\n): Promise {\n let rawTimestamp = \"\";\n const signatures: string[] = [];\n for (const component of sigHeader.split(\",\")) {\n const separator = component.indexOf(\"=\");\n if (separator < 0) continue;\n const key = component.slice(0, separator).trim();\n const value = component.slice(separator + 1).trim();\n if (key === \"t\") rawTimestamp = value;\n if (key === \"v1\") signatures.push(value);\n }\n const sentAt = Number(rawTimestamp);\n if (!Number.isFinite(sentAt) || signatures.length === 0) return false;\n if (Math.abs(nowSeconds() - sentAt) > STRIPE_REPLAY_TOLERANCE_SECONDS) {\n return false;\n }\n\n const signingKey = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const mac = await crypto.subtle.sign(\n \"HMAC\",\n signingKey,\n encoder.encode(`${rawTimestamp}.${payload}`),\n );\n const expected = Array.from(\n new Uint8Array(mac),\n (byte) => byte.toString(16).padStart(2, \"0\"),\n ).join(\"\");\n for (const signature of signatures) {\n if (signature.length !== expected.length) continue;\n let difference = 0;\n for (let index = 0; index < expected.length; index += 1) {\n difference |= expected.charCodeAt(index) ^ signature.charCodeAt(index);\n }\n if (difference === 0) return true;\n }\n return false;\n}\n\nfunction webhookVerifiers(): Array<\n { secret: string; expectedLivemode: boolean }\n> {\n const live = env(\"STRIPE_WEBHOOK_SECRET\");\n const sandbox = env(\"STRIPE_SANDBOX_WEBHOOK_SECRET\");\n return [\n ...(live ? [{ secret: live, expectedLivemode: true }] : []),\n ...(sandbox ? [{ secret: sandbox, expectedLivemode: false }] : []),\n ];\n}\n\nfunction githubConfig(): GitHubConfig | undefined {\n const appId = env(\"GITHUB_APP_ID\");\n const clientId = env(\"GITHUB_APP_CLIENT_ID\");\n const clientSecret = env(\"GITHUB_APP_CLIENT_SECRET\");\n const privateKeyBase64 = env(\"GITHUB_APP_PRIVATE_KEY_B64\");\n const installationId = env(\"GITHUB_APP_INSTALLATION_ID\");\n const vaultOwner = normalizeGitHubLogin(env(\"GITHUB_VAULT_OWNER\"));\n const vaultRepo = normalizeGitHubLogin(env(\"GITHUB_VAULT_REPO\"));\n const vaultRepositoryId = Number(env(\"GITHUB_VAULT_REPOSITORY_ID\"));\n if (\n !/^\\d+$/.test(appId) || !clientId || !clientSecret || !privateKeyBase64 ||\n !/^\\d+$/.test(installationId)\n ) return undefined;\n if (!vaultOwner || !vaultRepo) return undefined;\n if (!Number.isSafeInteger(vaultRepositoryId) || vaultRepositoryId <= 0) {\n return undefined;\n }\n return {\n appId,\n clientId,\n clientSecret,\n privateKeyBase64,\n installationId,\n vaultOwner,\n vaultRepo,\n vaultRepositoryId,\n };\n}\n\nfunction autoProvisioningReady(): boolean {\n return env(\"AUTO_PROVISIONING_ENABLED\") === \"true\" &&\n env(\"GITHUB_VAULT_OWNER_TYPE\") === \"organization\" &&\n Boolean(githubConfig()) &&\n Boolean(env(\"CLAIM_STATE_PEPPER\")) &&\n hasValidClaimDataKeyConfig() &&\n paymentLinkAllowlist().size > 0;\n}\n\nasync function appJwt(config: GitHubConfig): Promise {\n const pem = decoder.decode(base64UrlToBytes(config.privateKeyBase64));\n const der = base64UrlToBytes(\n pem.replace(/-----BEGIN [^-]+-----|-----END [^-]+-----|\\s+/g, \"\"),\n );\n const privateKey = await crypto.subtle.importKey(\n \"pkcs8\",\n der,\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n const issuedAt = nowSeconds() - 60;\n const header = bytesToBase64Url(\n encoder.encode(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" })),\n );\n const payload = bytesToBase64Url(\n encoder.encode(\n JSON.stringify({\n iat: issuedAt,\n exp: issuedAt + 9 * 60,\n iss: config.appId,\n }),\n ),\n );\n const unsigned = `${header}.${payload}`;\n const signature = await crypto.subtle.sign(\n { name: \"RSASSA-PKCS1-v1_5\" },\n privateKey,\n encoder.encode(unsigned),\n );\n return `${unsigned}.${bytesToBase64Url(new Uint8Array(signature))}`;\n}\n\nasync function githubRequest(\n url: string,\n token: string,\n method = \"GET\",\n body?: unknown,\n): Promise<{ status: number; data: any }> {\n const response = await fetch(url, {\n method,\n headers: {\n Accept: \"application/vnd.github+json\",\n Authorization: `Bearer ${token}`,\n \"X-GitHub-Api-Version\": GITHUB_API_VERSION,\n \"Content-Type\": \"application/json\",\n },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n const text = await response.text();\n let data: any = undefined;\n if (text) {\n try {\n data = JSON.parse(text);\n } catch {\n data = undefined;\n }\n }\n return { status: response.status, data };\n}\n\nasync function createInstallationToken(config: GitHubConfig): Promise {\n const token = await githubRequest(\n `https://api.github.com/app/installations/${\n encodeURIComponent(config.installationId)\n }/access_tokens`,\n await appJwt(config),\n \"POST\",\n {\n repository_ids: [config.vaultRepositoryId],\n permissions: { administration: \"write\" },\n },\n );\n if (token.status !== 201 || typeof token.data?.token !== \"string\") {\n throw new Error(\"installation token unavailable\");\n }\n return token.data.token;\n}\n\nasync function exchangeOAuthCode(\n config: GitHubConfig,\n code: string,\n verifier: string,\n callbackUrl: string,\n): Promise {\n const parameters = new URLSearchParams({\n client_id: config.clientId,\n client_secret: config.clientSecret,\n code,\n redirect_uri: callbackUrl,\n code_verifier: verifier,\n });\n const response = await fetch(\"https://github.com/login/oauth/access_token\", {\n method: \"POST\",\n headers: {\n Accept: \"application/json\",\n \"Content-Type\": \"application/x-www-form-urlencoded\",\n },\n body: parameters,\n });\n const data = await response.json().catch(() => undefined) as any;\n if (!response.ok || typeof data?.access_token !== \"string\") {\n throw new Error(\"OAuth token exchange failed\");\n }\n return data.access_token;\n}\n\nasync function inviteAndActivate(\n config: GitHubConfig,\n login: string,\n buyerToken: string,\n): Promise<\n {\n status: \"ACTIVE\" | \"INVITED_AWAITING_ACCEPTANCE\";\n invitationId: string | null;\n }\n> {\n const installationToken = await createInstallationToken(config);\n const repoPath = `${encodeURIComponent(config.vaultOwner)}/${\n encodeURIComponent(config.vaultRepo)\n }`;\n const invite = await githubRequest(\n `https://api.github.com/repos/${repoPath}/collaborators/${\n encodeURIComponent(login)\n }`,\n installationToken,\n \"PUT\",\n { permission: \"pull\" },\n );\n if (invite.status !== 201 && invite.status !== 204) {\n throw new Error(\"GitHub invitation failed\");\n }\n const invitationId = Number.isSafeInteger(Number(invite.data?.id))\n ? String(invite.data.id)\n : null;\n\n if (invite.status === 201 && invitationId) {\n const accepted = await githubRequest(\n `https://api.github.com/user/repository_invitations/${\n encodeURIComponent(invitationId)\n }`,\n buyerToken,\n \"PATCH\",\n );\n if (accepted.status !== 204 && accepted.status !== 304) {\n return { status: \"INVITED_AWAITING_ACCEPTANCE\", invitationId };\n }\n }\n\n const permission = await githubRequest(\n `https://api.github.com/repos/${repoPath}/collaborators/${\n encodeURIComponent(login)\n }/permission`,\n installationToken,\n );\n const granted = String(permission.data?.permission ?? \"\").toLowerCase();\n return {\n status: granted === \"read\" || granted === \"pull\"\n ? \"ACTIVE\"\n : \"INVITED_AWAITING_ACCEPTANCE\",\n invitationId,\n };\n}\n\nasync function handleStripeWebhook(req: Request): Promise {\n const payload = await req.text();\n const signature = req.headers.get(\"stripe-signature\") ?? \"\";\n let verifier: { secret: string; expectedLivemode: boolean } | undefined;\n for (const candidate of webhookVerifiers()) {\n if (await verifyStripeSignature(payload, signature, candidate.secret)) {\n verifier = candidate;\n break;\n }\n }\n if (!verifier) return new Response(\"bad signature\", { status: 400 });\n\n let event: any;\n try {\n event = JSON.parse(payload);\n } catch {\n return new Response(\"bad payload\", { status: 400 });\n }\n if (event.livemode !== verifier.expectedLivemode) {\n return new Response(\"environment mismatch\", { status: 400 });\n }\n if (event.type !== \"checkout.session.completed\") {\n return new Response(\"ignored\", { status: 200 });\n }\n\n const checkout = event.data?.object;\n if (checkout?.payment_status !== \"paid\") {\n console.log(\n JSON.stringify({\n when: timestamp(),\n result: \"ignored_unpaid_checkout\",\n livemode: Boolean(event.livemode),\n }),\n );\n return new Response(\"not paid yet\", { status: 200 });\n }\n\n const sessionId = safeId(checkout?.id);\n const eventId = safeId(event?.id);\n const paymentLinkId = safeId(\n typeof checkout?.payment_link === \"string\"\n ? checkout.payment_link\n : checkout?.payment_link?.id,\n );\n const customerEmail = normalizeEmail(checkout?.customer_details?.email);\n const usernameField = Array.isArray(checkout?.custom_fields)\n ? checkout.custom_fields.find((field: any) =>\n field?.key === \"github_username\"\n )\n : undefined;\n const checkoutUsername = normalizeGitHubLogin(usernameField?.text?.value);\n const subscriptionId =\n safeId(\n typeof checkout?.subscription === \"string\"\n ? checkout.subscription\n : checkout?.subscription?.id,\n ) || null;\n const tier =\n typeof checkout?.metadata?.tier === \"string\" &&\n checkout.metadata.tier.length <= 80\n ? checkout.metadata.tier\n : \"unlabeled\";\n const allowlist = paymentLinkAllowlist();\n\n if (\n !sessionId || !eventId || !paymentLinkId || !allowlist.has(paymentLinkId) ||\n !customerEmail || !checkoutUsername\n ) {\n // Preserve a non-automated receipt so a malformed/legacy checkout never\n // receives an access grant. No email, username, or raw payload is logged.\n const receipt = {\n when: timestamp(),\n event_id_present: Boolean(eventId),\n checkout_session_id_present: Boolean(sessionId),\n payment_link_allowlisted: allowlist.has(paymentLinkId),\n payer_email_present: Boolean(customerEmail),\n github_username_present: Boolean(checkoutUsername),\n result: \"PAID — MANUAL ACCESS REVIEW REQUIRED\",\n };\n console.log(JSON.stringify(receipt));\n return json(receipt);\n }\n\n const key = await claimDataKey();\n if (!key) {\n const receipt = {\n when: timestamp(),\n event_id: eventId,\n checkout_session_id: sessionId,\n tier,\n result: \"PAID — MANUAL ACCESS REVIEW REQUIRED\",\n };\n console.log(\n JSON.stringify({\n when: receipt.when,\n event_id: eventId,\n checkout_session_id: sessionId,\n result: \"claim_store_not_configured\",\n }),\n );\n return json(receipt);\n }\n\n await ensureSchema();\n const createdAt = timestamp();\n await sqlite.execute({\n sql: `INSERT OR IGNORE INTO paid_claims (\n checkout_session_id, stripe_event_id, payment_link_id, subscription_id, tier,\n payer_email_encrypted, claimed_github_username_encrypted, status,\n created_at, updated_at\n ) VALUES (\n :checkout_session_id, :stripe_event_id, :payment_link_id, :subscription_id, :tier,\n :payer_email_encrypted, :claimed_github_username_encrypted, :status,\n :created_at, :updated_at\n )`,\n args: {\n checkout_session_id: sessionId,\n stripe_event_id: eventId,\n payment_link_id: paymentLinkId,\n subscription_id: subscriptionId,\n tier,\n payer_email_encrypted: await encryptClaimValue(customerEmail, key),\n claimed_github_username_encrypted: await encryptClaimValue(\n checkoutUsername,\n key,\n ),\n status: \"PAID_PENDING_CLAIM\",\n created_at: createdAt,\n updated_at: createdAt,\n },\n });\n\n const receipt = {\n when: timestamp(),\n event_id: eventId,\n checkout_session_id: sessionId,\n tier,\n claim_ready: autoProvisioningReady(),\n result: autoProvisioningReady()\n ? \"PAID — CLAIM READY\"\n : \"PAID — MANUAL ACCESS REVIEW REQUIRED\",\n };\n console.log(JSON.stringify(receipt));\n return json(receipt);\n}\n\nfunction claimActionUrl(base: string, sessionId: string): string {\n return claimUrl(base, \"/claim\", sessionId);\n}\n\nasync function beginClaim(req: Request, url: URL): Promise {\n const sessionId = safeId(url.searchParams.get(\"session_id\"));\n if (!sessionId) {\n return page(\n \"We need your purchase link\",\n \"Open the access link from your completed checkout page.\",\n );\n }\n await ensureSchema();\n const claim = await getClaimBySession(sessionId);\n if (!claim) {\n return page(\n \"Confirming your payment\",\n \"We have not received the signed payment confirmation yet. Wait a moment, then reopen this link.\",\n );\n }\n\n const base = configuredClaimBase(req);\n if (claim.status === \"ACTIVE\") {\n return page(\n \"Access is active\",\n \"Your verified GitHub account has read access to the Chiron vault.\",\n );\n }\n if (claim.status === \"INVITED_AWAITING_ACCEPTANCE\") {\n return page(\n \"Your GitHub invitation is ready\",\n \"GitHub needs you to accept its repository invitation before access becomes active.\",\n );\n }\n if (!autoProvisioningReady()) {\n return page(\n \"Payment received\",\n \"Your payment is safely recorded. Automatic vault delivery is being enabled; no further action is needed right now.\",\n );\n }\n\n const state = randomToken();\n const stateHash = await secretHash(state);\n const verifier = await pkceVerifier(state);\n const challenge = await sha256Base64Url(verifier);\n const expiresAt = nowSeconds() + CLAIM_STATE_TTL_SECONDS;\n const updated = await sqlite.execute({\n sql: `UPDATE paid_claims\n SET oauth_state_hash = :state_hash, oauth_state_expires_at = :expires_at,\n status = :status, error_code = NULL, updated_at = :updated_at\n WHERE checkout_session_id = :session_id\n AND status NOT IN ('ACTIVE', 'INVITED_AWAITING_ACCEPTANCE')`,\n args: {\n state_hash: stateHash,\n expires_at: expiresAt,\n status: \"OAUTH_STARTED\",\n updated_at: timestamp(),\n session_id: sessionId,\n },\n });\n if (changedRows(updated) !== 1) {\n return page(\n \"Access is already being completed\",\n \"Refresh this page after a moment.\",\n );\n }\n\n const config = githubConfig();\n if (!config) {\n return page(\n \"Access setup is incomplete\",\n \"Your payment is safe, but the access service needs an owner configuration update.\",\n );\n }\n const callback = claimUrl(base, \"/claim/github/callback\");\n const authorize = new URL(\"https://github.com/login/oauth/authorize\");\n authorize.searchParams.set(\"client_id\", config.clientId);\n authorize.searchParams.set(\"redirect_uri\", callback);\n authorize.searchParams.set(\"state\", state);\n authorize.searchParams.set(\"code_challenge\", challenge);\n authorize.searchParams.set(\"code_challenge_method\", \"S256\");\n authorize.searchParams.set(\"prompt\", \"select_account\");\n return redirect(authorize.toString());\n}\n\nasync function handleOAuthCallback(req: Request, url: URL): Promise {\n const base = configuredClaimBase(req);\n const code = safeId(url.searchParams.get(\"code\"));\n const state = safeId(url.searchParams.get(\"state\"));\n if (!code || !state || url.searchParams.has(\"error\")) {\n return page(\n \"GitHub verification was not completed\",\n \"Return to your access link and try again.\",\n );\n }\n if (!autoProvisioningReady()) {\n return page(\n \"Access setup is incomplete\",\n \"Your payment is safe, but the access service is not ready to complete a claim.\",\n );\n }\n\n let stateHash: string;\n try {\n stateHash = await secretHash(state);\n } catch {\n return page(\n \"Access setup is incomplete\",\n \"The access service is missing its verification configuration.\",\n );\n }\n await ensureSchema();\n const claim = await getClaimByState(stateHash, nowSeconds());\n if (!claim) {\n return page(\n \"This verification link expired\",\n \"Return to your purchase access link to start again.\",\n );\n }\n\n // Atomically consume state before exchanging the OAuth code. A duplicate\n // callback can never cause a second invitation.\n const consumed = await sqlite.execute({\n sql: `UPDATE paid_claims\n SET oauth_state_hash = NULL, oauth_state_expires_at = NULL,\n status = :status, updated_at = :updated_at\n WHERE checkout_session_id = :session_id\n AND oauth_state_hash = :state_hash\n AND oauth_state_expires_at > :now`,\n args: {\n status: \"OAUTH_IN_PROGRESS\",\n updated_at: timestamp(),\n session_id: claim.checkout_session_id,\n state_hash: stateHash,\n now: nowSeconds(),\n },\n });\n if (changedRows(consumed) !== 1) {\n return page(\n \"This verification link was already used\",\n \"Return to your purchase access link to start again.\",\n );\n }\n\n const resume = claimActionUrl(base, claim.checkout_session_id);\n const config = githubConfig();\n const key = await claimDataKey();\n if (!config || !key) {\n await updateClaim(claim.checkout_session_id, {\n status: \"NEEDS_SUPPORT\",\n error_code: \"missing_runtime_configuration\",\n });\n return page(\n \"Access setup is incomplete\",\n \"Your payment is safe. We need to finish an owner-side configuration step.\",\n );\n }\n\n try {\n const oauthToken = await exchangeOAuthCode(\n config,\n code,\n await pkceVerifier(state),\n claimUrl(base, \"/claim/github/callback\"),\n );\n const [userResponse, emailResponse] = await Promise.all([\n githubRequest(\"https://api.github.com/user\", oauthToken),\n githubRequest(\"https://api.github.com/user/emails\", oauthToken),\n ]);\n const login = normalizeGitHubLogin(userResponse.data?.login);\n const userId = String(userResponse.data?.id ?? \"\");\n const checkoutEmail = await decryptClaimValue(\n claim.payer_email_encrypted,\n key,\n );\n const checkoutUsername = await decryptClaimValue(\n claim.claimed_github_username_encrypted,\n key,\n );\n const emails = Array.isArray(emailResponse.data) ? emailResponse.data : [];\n const emailMatches = emails.some((email: any) =>\n email?.verified === true && normalizeEmail(email?.email) === checkoutEmail\n );\n\n if (userResponse.status !== 200 || !login || !/^\\d+$/.test(userId)) {\n throw new Error(\"unable to identify GitHub account\");\n }\n if (login !== checkoutUsername) {\n await updateClaim(claim.checkout_session_id, {\n status: \"GITHUB_USERNAME_MISMATCH\",\n error_code: \"github_username_mismatch\",\n });\n return page(\n \"Use the GitHub account from checkout\",\n \"The account you selected does not match the GitHub username entered when you paid.\",\n { href: resume, label: \"Try another GitHub account\" },\n );\n }\n if (emailResponse.status !== 200 || !emailMatches) {\n await updateClaim(claim.checkout_session_id, {\n status: \"EMAIL_MISMATCH\",\n error_code: \"checkout_email_not_verified_on_github\",\n });\n return page(\n \"Verify the checkout email on GitHub\",\n \"The selected GitHub account needs a verified email that matches the email used for payment.\",\n { href: resume, label: \"Try another GitHub account\" },\n );\n }\n\n await updateClaim(claim.checkout_session_id, {\n status: \"GITHUB_VERIFIED\",\n github_login: login,\n github_user_id: userId,\n error_code: null,\n });\n const activation = await inviteAndActivate(config, login, oauthToken);\n if (activation.status === \"ACTIVE\") {\n await updateClaim(claim.checkout_session_id, {\n status: \"ACTIVE\",\n github_invitation_id: activation.invitationId,\n invite_permission: \"read\",\n error_code: null,\n });\n return page(\n \"Your Chiron access is active\",\n \"Your verified GitHub account now has read access to the Chiron vault.\",\n );\n }\n await updateClaim(claim.checkout_session_id, {\n status: \"INVITED_AWAITING_ACCEPTANCE\",\n github_invitation_id: activation.invitationId,\n invite_permission: \"read\",\n error_code: null,\n });\n return page(\n \"Your GitHub invitation is ready\",\n \"GitHub needs you to accept its repository invitation before access becomes active.\",\n );\n } catch {\n // Do not log exception text: third-party response bodies can contain\n // identifiers, and OAuth-related errors must never leak into Val logs.\n console.log(\n JSON.stringify({\n when: timestamp(),\n checkout_session_id: claim.checkout_session_id,\n result: \"claim_processing_failed\",\n }),\n );\n await updateClaim(claim.checkout_session_id, {\n status: \"OAUTH_FAILED\",\n error_code: \"claim_processing_failed\",\n });\n return page(\n \"We could not finish the access check\",\n \"Your payment is still safe. Try the verification again in a moment.\",\n { href: resume, label: \"Try again\" },\n );\n }\n}\n\nfunction health(): Response {\n const app = githubConfig();\n const storeReady = hasValidClaimDataKeyConfig() &&\n Boolean(env(\"CLAIM_STATE_PEPPER\"));\n return json({\n service: \"chiron paid-event intake\",\n version: 8,\n version_scope: \"fulfillment_handler\",\n env_visible: {\n STRIPE_WEBHOOK_SECRET: hasEnv(\"STRIPE_WEBHOOK_SECRET\"),\n STRIPE_SANDBOX_WEBHOOK_SECRET: hasEnv(\"STRIPE_SANDBOX_WEBHOOK_SECRET\"),\n CLAIM_DATA_KEY_B64: hasEnv(\"CLAIM_DATA_KEY_B64\"),\n CLAIM_STATE_PEPPER: hasEnv(\"CLAIM_STATE_PEPPER\"),\n GITHUB_APP_CLIENT_ID: hasEnv(\"GITHUB_APP_CLIENT_ID\"),\n GITHUB_APP_CLIENT_SECRET: hasEnv(\"GITHUB_APP_CLIENT_SECRET\"),\n GITHUB_APP_PRIVATE_KEY_B64: hasEnv(\"GITHUB_APP_PRIVATE_KEY_B64\"),\n },\n payment_link_allowlist_count: paymentLinkAllowlist().size,\n claim_store_ready: storeReady,\n github_app_configured: Boolean(app),\n vault_repository_id_resolution: app ? \"configured\" : \"not_configured\",\n vault_owner_is_organization:\n env(\"GITHUB_VAULT_OWNER_TYPE\") === \"organization\",\n auto_provisioning_enabled: autoProvisioningReady(),\n access_provisioning: autoProvisioningReady()\n ? \"paid_checkout_verified_email_verified_github_read_access\"\n : \"manual_payer_confirmation_required\",\n });\n}\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n if (req.method === \"POST\" && url.pathname === \"/\") {\n return handleStripeWebhook(req);\n }\n if (req.method === \"GET\" && url.pathname === \"/claim\") {\n return beginClaim(req, url);\n }\n if (req.method === \"GET\" && url.pathname === \"/claim/github/callback\") {\n return handleOAuthCallback(req, url);\n }\n if (\n req.method === \"GET\" && (url.pathname === \"/\" || url.pathname === \"/health\")\n ) return health();\n return new Response(\"not found\", {\n status: 404,\n headers: { \"Cache-Control\": \"no-store\" },\n });\n}","deleted","label",[112],"pulls","branches",1,"forks","envVars",{"_135":137,"_138":42},"connections",{"_135":42,"_136":42},"count","unfilledCount",16,"emptyCount",{"_18":111,"_20":112,"_113":36,"_114":-5,"_115":71,"_116":69,"_117":38,"_22":140,"_68":119,"_120":121,"_122":123,"_124":26,"_125":-5,"_141":142,"_89":143},["D",1785208317408],"children",[],[112],["D",1784256938685],["D",1789561879908],{"_16":17,"_87":83},{"_16":17,"_80":81,"_82":83,"_33":34,"_84":85,"_86":26},{"_68":69,"_20":70,"_18":71,"_72":19,"_73":-5,"_74":-5,"_75":-5,"_76":-5,"_77":-5,"_78":21,"_79":17},"ctx",{"_61":-5,"_107":182,"_183":184,"_185":186,"_187":26,"_188":26,"_189":26,"_190":38,"_191":-5,"_192":-7,"_193":-7,"_194":42,"_195":26,"_196":26,"_197":-5,"_198":26,"_199":26,"_200":26,"_201":-5},"ENV",{"_153":154,"_155":156,"_157":70,"_158":159,"_160":161,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]