[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_201":202,"_203":204},"routes/_app.x.$handle.$name",{"_96":95,"_32":45,"_104":86,"_27":53,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":58,"_121":-5,"_122":-5,"_123":124},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":58,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":79,"_80":81,"_82":83,"_84":25},"version",21,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","githubApp.http.ts","latestPath","fileId","3936819e-b965-11f0-9265-0224a6c84d84","name","fileType","http","content","// deno-lint-ignore-file require-await\n// Note: Val Town HTTP trigger to process GitHub App webhooks for repo bootstrap\n\nimport { timingSafeEqual } from \"https://deno.land/std@0.224.0/crypto/timing_safe_equal.ts\";\nimport { App } from \"https://esm.sh/@octokit/app@15.1.1?target=deno\";\nimport nacl from \"https://esm.sh/tweetnacl@1.0.3?target=deno\";\nimport { blake2b } from \"https://esm.sh/@noble/hashes@1.4.0/blake2b?target=deno\";\n\ntype ProjectType = \"android\" | \"node\" | \"unknown\";\n\ninterface RepositoryCreatedPayload {\n action: string;\n repository: {\n full_name: string;\n default_branch: string;\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n };\n installation?: {\n id: number;\n } | null;\n}\n\nconst TEMPLATE_URL = \"https://github.com/cmwen/min-android-app-template\";\nconst TARGET_WORKFLOW_FILE = \"bootstrap-action.yml\";\nconst WORKFLOW_POLL_ATTEMPTS = 12;\nconst WORKFLOW_POLL_INTERVAL_MS = 5_000;\n\nconst TEMPLATE_TYPE_MAP: Record = {\n [TEMPLATE_URL]: \"android\",\n};\n\nconst SECRET_CONFIG: Record = {\n android: { envPrefix: \"ANDROID_ACTION_SECRET__\", expectedPrefix: \"ANDROID_\" },\n node: { envPrefix: \"NODE_ACTION_SECRET__\", expectedPrefix: \"NPM_\" },\n unknown: null,\n};\n\nconst ANDROID_INDICATORS = [\n \"build.gradle\",\n \"settings.gradle\",\n \"gradlew\",\n \"gradlew.bat\",\n \"app/build.gradle\",\n \"app/src/main/AndroidManifest.xml\",\n];\n\nconst NODE_INDICATORS = [\n \"package.json\",\n \"package-lock.json\",\n \"pnpm-lock.yaml\",\n \"yarn.lock\",\n \"tsconfig.json\",\n \"vite.config.ts\",\n \"rollup.config.js\",\n];\n\ninterface WorkflowSummary {\n id: number;\n name?: string;\n path?: string;\n state?: string;\n}\n\ninterface WorkflowListResponse {\n workflows?: WorkflowSummary[];\n}\n\ninterface TemplateRepositoryDetails {\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n}\n\ninterface OctokitClient {\n request: (route: string, parameters: Record) => Promise<{ data: T }>;\n}\n\nexport default async function (req: Request): Promise {\n const requestId = crypto.randomUUID();\n\n const method = req.method.toUpperCase();\n if (method !== \"POST\") {\n console.log(`[${requestId}] Ignored non-POST request`);\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const webhookSecret = Deno.env.get(\"GITHUB_APP_WEBHOOK_SECRET\");\n const appId = Deno.env.get(\"GITHUB_APP_ID\");\n const privateKey = Deno.env.get(\"GITHUB_APP_PRIVATE_KEY\");\n\n if (!webhookSecret || !appId || !privateKey) {\n return new Response(\"Missing GitHub App environment configuration\", { status: 500 });\n }\n\n const rawBody = await req.text();\n\n const signatureHeader = req.headers.get(\"x-hub-signature-256\");\n if (!signatureHeader) {\n console.log(`[${requestId}] Missing signature header`);\n return new Response(\"Signature missing\", { status: 400 });\n }\n\n const validSignature = await verifySignature(webhookSecret, rawBody, signatureHeader);\n if (!validSignature) {\n console.log(`[${requestId}] Invalid signature`);\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n const eventName = req.headers.get(\"x-github-event\");\n if (!eventName) {\n console.log(`[${requestId}] Missing event name`);\n return new Response(\"Event header missing\", { status: 400 });\n }\n\n if (eventName !== \"repository\") {\n console.log(`[${requestId}] Ignored event ${eventName}`);\n return new Response(`Ignored event: ${eventName}`, { status: 202 });\n }\n\n let payload: RepositoryCreatedPayload;\n try {\n payload = JSON.parse(rawBody) as RepositoryCreatedPayload;\n } catch (error) {\n console.error(`[${requestId}] Failed to parse webhook payload`, error);\n return new Response(\"Invalid JSON payload\", { status: 400 });\n }\n\n if (payload.action !== \"created\") {\n console.log(`[${requestId}] Ignored repository action ${payload.action}`);\n return new Response(`Ignored repository action: ${payload.action}`, { status: 202 });\n }\n\n const { repository, installation } = payload;\n if (!repository?.full_name || !repository?.default_branch) {\n console.log(`[${requestId}] Repository payload incomplete`, payload.repository);\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n const templateInfo = payload.repository.template_repository ?? null;\n const templateUrlFromPayload = templateInfo?.html_url\n ?? (templateInfo?.full_name ? `https://github.com/${templateInfo.full_name}` : null);\n const payloadTemplateMatches = templateUrlFromPayload === TEMPLATE_URL;\n if (!payloadTemplateMatches) {\n console.log(`[${requestId}] Template mismatch from payload`, {\n repo: repository.full_name,\n templateUrlFromPayload,\n });\n }\n\n if (!installation?.id) {\n console.log(`[${requestId}] Missing installation context`);\n return new Response(\"Installation context missing\", { status: 400 });\n }\n\n try {\n console.log(`[${requestId}] Initializing Octokit client for repo ${repository.full_name}`);\n const octokit = await getInstallationOctokit(appId, privateKey, installation.id);\n const [owner, repoName] = repository.full_name.split(\"/\");\n if (!owner || !repoName) {\n console.log(`[${requestId}] Unable to determine owner/repo from full_name`, { fullName: repository.full_name });\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n let effectiveTemplateUrl = templateUrlFromPayload;\n if (!payloadTemplateMatches) {\n const repoDetails = await octokit.request(\"GET /repos/{owner}/{repo}\", {\n owner,\n repo: repoName,\n }) as { data: TemplateRepositoryDetails };\n const resolvedTemplateUrl = repoDetails.data.template_repository?.html_url\n ?? (repoDetails.data.template_repository?.full_name\n ? `https://github.com/${repoDetails.data.template_repository.full_name}`\n : null);\n console.log(`[${requestId}] Resolved template URL`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n effectiveTemplateUrl = resolvedTemplateUrl;\n if (resolvedTemplateUrl !== TEMPLATE_URL) {\n console.log(`[${requestId}] Skipping repo after resolution`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n return new Response(\"Repository not created from expected template\", { status: 202 });\n }\n }\n\n const projectType = await determineProjectType({\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl: effectiveTemplateUrl,\n octokit,\n owner,\n repo: repoName,\n defaultBranch: repository.default_branch,\n });\n\n const secretsSynced = await syncProjectSecrets({\n projectType,\n octokit,\n owner,\n repo: repoName,\n requestId,\n });\n\n if (!secretsSynced) {\n console.log(`[${requestId}] No secrets synced for project type ${projectType}`);\n }\n\n const workflowMatch = await findWorkflowWithRetry(octokit, owner, repoName, requestId);\n if (!workflowMatch) {\n console.log(`[${requestId}] Workflow did not become available in time`, {\n repo: repository.full_name,\n });\n return new Response(\"Workflow file not ready\", { status: 202 });\n }\n\n let activeWorkflow = workflowMatch;\n if (activeWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Enabling workflow ${TARGET_WORKFLOW_FILE} (state=${activeWorkflow.state})`);\n try {\n await enableWorkflow(octokit, owner, repoName, activeWorkflow.id ?? TARGET_WORKFLOW_FILE);\n } catch (enableError) {\n console.error(`[${requestId}] Failed to enable workflow`, enableError);\n return new Response(\"Workflow enable failed\", { status: 500 });\n }\n\n const refreshedWorkflow = await findWorkflowWithRetry(\n octokit,\n owner,\n repoName,\n requestId,\n 4,\n 2_000,\n false,\n );\n if (!refreshedWorkflow || refreshedWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Workflow still disabled after enable`, {\n repo: repository.full_name,\n state: refreshedWorkflow?.state,\n });\n return new Response(\"Workflow still disabled\", { status: 202 });\n }\n activeWorkflow = refreshedWorkflow;\n }\n\n const workflowId = activeWorkflow.id ?? TARGET_WORKFLOW_FILE;\n\n console.log(`[${requestId}] Dispatching workflow ${TARGET_WORKFLOW_FILE} for ${repository.full_name}@${repository.default_branch}`);\n await octokit.request(\"POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches\", {\n owner,\n repo: repoName,\n workflow_id: workflowId,\n ref: repository.default_branch,\n });\n console.log(`[${requestId}] Workflow dispatched successfully`, {\n repo: repository.full_name,\n templateUrl: effectiveTemplateUrl,\n });\n } catch (error) {\n console.error(`[${requestId}] Failed to trigger workflow`, error);\n return new Response(\"Workflow trigger failed\", { status: 500 });\n }\n\n return new Response(\"bootstrap-action dispatched\", { status: 200 });\n}\n\nasync function verifySignature(secret: string, body: string, receivedSignature: string): Promise {\n const encoder = new TextEncoder();\n const keyData = encoder.encode(secret);\n const key = await crypto.subtle.importKey(\n \"raw\",\n keyData,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n\n const mac = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(body));\n const expected = `sha256=${toHex(new Uint8Array(mac))}`;\n\n const expectedBytes = encoder.encode(expected);\n const receivedBytes = encoder.encode(receivedSignature);\n\n if (expectedBytes.length !== receivedBytes.length) {\n return false;\n }\n\n return timingSafeEqual(expectedBytes, receivedBytes);\n}\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function getInstallationOctokit(appId: string, privateKeyPem: string, installationId: number): Promise {\n const appIdNumber = Number(appId);\n if (Number.isNaN(appIdNumber)) {\n throw new Error(\"Invalid GitHub App ID – expected numeric string\");\n }\n const normalizedKey = normalizePrivateKey(privateKeyPem);\n const app = new App({\n appId: appIdNumber,\n privateKey: normalizedKey,\n });\n return await app.getInstallationOctokit(installationId);\n}\n\nasync function determineProjectType(params: {\n requestId: string;\n templateUrlFromPayload: string | null;\n resolvedTemplateUrl: string | null;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n defaultBranch: string;\n}): Promise {\n const {\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl,\n octokit,\n owner,\n repo,\n defaultBranch,\n } = params;\n\n const templateCandidates = [templateUrlFromPayload, resolvedTemplateUrl].filter(Boolean) as string[];\n for (const templateUrl of templateCandidates) {\n const mappedType = TEMPLATE_TYPE_MAP[templateUrl];\n if (mappedType) {\n console.log(`[${requestId}] Project type inferred from template`, {\n repo: `${owner}/${repo}`,\n templateUrl,\n mappedType,\n });\n return mappedType;\n }\n }\n\n const treePaths = await fetchRepoTreeWithRetry({\n octokit,\n owner,\n repo,\n branch: defaultBranch,\n requestId,\n });\n\n if (!treePaths) {\n console.log(`[${requestId}] Unable to fetch repository tree; defaulting to unknown type`, {\n repo: `${owner}/${repo}`,\n });\n return \"unknown\";\n }\n\n const { androidScore, nodeScore } = scoreProjectHeuristics(treePaths);\n console.log(`[${requestId}] Project heuristic scores`, {\n repo: `${owner}/${repo}`,\n androidScore,\n nodeScore,\n });\n\n if (androidScore >= 2 && androidScore >= nodeScore + 1) {\n return \"android\";\n }\n if (nodeScore >= 2 && nodeScore >= androidScore + 1) {\n return \"node\";\n }\n if (androidScore >= 3) {\n return \"android\";\n }\n if (nodeScore >= 3) {\n return \"node\";\n }\n\n return \"unknown\";\n}\n\nasync function fetchRepoTreeWithRetry(params: {\n octokit: OctokitClient;\n owner: string;\n repo: string;\n branch: string;\n requestId: string;\n attempts?: number;\n intervalMs?: number;\n}): Promise {\n const {\n octokit,\n owner,\n repo,\n branch,\n requestId,\n attempts = 5,\n intervalMs = 3_000,\n } = params;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/git/trees/{tree_sha}\", {\n owner,\n repo,\n tree_sha: branch,\n recursive: 1,\n }) as { data: { tree?: Array<{ path?: string }>; truncated?: boolean } };\n\n const treeEntries = response.data.tree ?? [];\n const paths = treeEntries\n .map((entry) => entry.path)\n .filter((path): path is string => typeof path === \"string\");\n\n if (response.data.truncated) {\n console.log(`[${requestId}] Repo tree truncated`, {\n repo: `${owner}/${repo}`,\n attempt,\n });\n }\n\n if (paths.length > 0) {\n return paths;\n }\n } catch (error) {\n if ((error as { status?: number }).status !== 404) {\n console.error(`[${requestId}] Failed to fetch repo tree`, error);\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for repository tree (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nfunction scoreProjectHeuristics(paths: string[]): { androidScore: number; nodeScore: number } {\n const androidScore = ANDROID_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n const nodeScore = NODE_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n return { androidScore, nodeScore };\n}\n\nasync function syncProjectSecrets(params: {\n projectType: ProjectType;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n requestId: string;\n}): Promise {\n const { projectType, octokit, owner, repo, requestId } = params;\n const config = SECRET_CONFIG[projectType];\n if (!config) {\n return false;\n }\n\n const envPrefix = config.envPrefix;\n const envEntries = Object.entries(Deno.env.toObject());\n const entries = envEntries\n .filter(([key]) => key.startsWith(envPrefix))\n .map(([key, value]) => [key.slice(envPrefix.length), value] as const)\n .filter(([, value]) => typeof value === \"string\" && value.length > 0);\n\n if (entries.length === 0) {\n console.log(`[${requestId}] No secrets defined in env config`, {\n projectType,\n envPrefix,\n });\n return false;\n }\n\n const publicKeyResponse = await octokit.request(\"GET /repos/{owner}/{repo}/actions/secrets/public-key\", {\n owner,\n repo,\n }) as { data: { key_id: string; key: string } };\n\n const { key_id: keyId, key } = publicKeyResponse.data;\n\n for (const [secretName, secretValue] of entries) {\n if (!secretName.startsWith(config.expectedPrefix)) {\n console.log(`[${requestId}] Secret name does not match expected prefix`, {\n secretName,\n expectedPrefix: config.expectedPrefix,\n envVariable: `${envPrefix}${secretName}`,\n });\n }\n\n const encrypted = encryptSecretValue(key, secretValue);\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}\", {\n owner,\n repo,\n secret_name: secretName,\n encrypted_value: encrypted,\n key_id: keyId,\n });\n console.log(`[${requestId}] Updated secret ${secretName}`);\n }\n\n return true;\n}\n\nasync function findWorkflowWithRetry(\n octokit: OctokitClient,\n owner: string,\n repo: string,\n requestId: string,\n attempts = WORKFLOW_POLL_ATTEMPTS,\n intervalMs = WORKFLOW_POLL_INTERVAL_MS,\n checkFileExistence = true,\n): Promise {\n let fileExists: boolean | undefined = checkFileExistence ? undefined : true;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/actions/workflows\", {\n owner,\n repo,\n per_page: 100,\n }) as { data: WorkflowListResponse };\n\n const workflows = response.data.workflows ?? [];\n const match = workflows.find((workflow) => workflow.path?.endsWith(`/${TARGET_WORKFLOW_FILE}`));\n if (match) {\n return match;\n }\n\n if (fileExists === undefined) {\n fileExists = await doesWorkflowFileExist(octokit, owner, repo, TARGET_WORKFLOW_FILE);\n if (!fileExists) {\n console.log(`[${requestId}] Workflow file ${TARGET_WORKFLOW_FILE} missing from repository`, { owner, repo });\n return null;\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for workflow registration (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nasync function doesWorkflowFileExist(octokit: OctokitClient, owner: string, repo: string, fileName: string): Promise {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/contents/.github/workflows/{path}\", {\n owner,\n repo,\n path: fileName,\n });\n return Array.isArray(response.data) ? response.data.length > 0 : Boolean(response.data);\n } catch (error) {\n if ((error as { status?: number }).status === 404) {\n return false;\n }\n throw error;\n }\n}\n\nasync function enableWorkflow(octokit: OctokitClient, owner: string, repo: string, workflowId: number | string): Promise {\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable\", {\n owner,\n repo,\n workflow_id: workflowId,\n });\n}\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction normalizePrivateKey(pem: string): string {\n const cleaned = pem.replace(/\\r/g, \"\").replace(/\\\\n/g, \"\\n\").replace(/\\n+/g, \"\\n\").trim();\n\n if (cleaned.includes(\"-----BEGIN PRIVATE KEY-----\")) {\n return cleaned;\n }\n\n if (!cleaned.includes(\"-----BEGIN RSA PRIVATE KEY-----\")) {\n throw new Error(\"Unsupported private key format. Provide PKCS#8 or PKCS#1 PEM\");\n }\n\n const base64 = cleaned\n .replace(\"-----BEGIN RSA PRIVATE KEY-----\", \"\")\n .replace(\"-----END RSA PRIVATE KEY-----\", \"\")\n .replace(/\\s+/g, \"\");\n\n const pkcs1Bytes = decodeBase64(base64);\n const pkcs8Bytes = wrapPkcs1InPkcs8(pkcs1Bytes);\n const pkcs8Base64 = encodeBase64(pkcs8Bytes);\n const body = pkcs8Base64.match(/.{1,64}/g)?.join(\"\\n\") ?? pkcs8Base64;\n return `-----BEGIN PRIVATE KEY-----\\n${body}\\n-----END PRIVATE KEY-----`;\n}\n\nfunction wrapPkcs1InPkcs8(pkcs1: Uint8Array): Uint8Array {\n const version = new Uint8Array([0x02, 0x01, 0x00]);\n const algorithm = new Uint8Array([\n 0x30, 0x0d,\n 0x06, 0x09,\n 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,\n 0x05, 0x00,\n ]);\n const privateKey = encodeDerOctetString(pkcs1);\n const totalLength = version.length + algorithm.length + privateKey.length;\n const sequenceHeader = encodeDerSequence(totalLength);\n const result = new Uint8Array(sequenceHeader.length + version.length + algorithm.length + privateKey.length);\n let offset = 0;\n result.set(sequenceHeader, offset);\n offset += sequenceHeader.length;\n result.set(version, offset);\n offset += version.length;\n result.set(algorithm, offset);\n offset += algorithm.length;\n result.set(privateKey, offset);\n return result;\n}\n\nfunction encodeDerSequence(contentLength: number): Uint8Array {\n const lengthBytes = encodeDerLength(contentLength);\n const result = new Uint8Array(1 + lengthBytes.length);\n result[0] = 0x30;\n result.set(lengthBytes, 1);\n return result;\n}\n\nfunction encodeDerOctetString(value: Uint8Array): Uint8Array {\n const lengthBytes = encodeDerLength(value.length);\n const result = new Uint8Array(1 + lengthBytes.length + value.length);\n result[0] = 0x04;\n result.set(lengthBytes, 1);\n result.set(value, 1 + lengthBytes.length);\n return result;\n}\n\nfunction encodeDerLength(length: number): Uint8Array {\n if (length < 0x80) {\n return new Uint8Array([length]);\n }\n const bytes: number[] = [];\n let temp = length;\n while (temp > 0) {\n bytes.unshift(temp & 0xff);\n temp >>= 8;\n }\n return new Uint8Array([0x80 | bytes.length, ...bytes]);\n}\n\nfunction encryptSecretValue(publicKey: string, secretValue: string): string {\n const publicKeyBytes = decodeBase64(publicKey);\n if (publicKeyBytes.length !== nacl.box.publicKeyLength) {\n throw new Error(`Unexpected public key length: ${publicKeyBytes.length}`);\n }\n\n const messageBytes = new TextEncoder().encode(secretValue);\n const sealed = sealBox(messageBytes, publicKeyBytes);\n return encodeBase64(sealed);\n}\n\nfunction sealBox(message: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array {\n const ephemeral = nacl.box.keyPair();\n const nonce = deriveSealNonce(ephemeral.publicKey, recipientPublicKey);\n const cipher = nacl.box(message, nonce, recipientPublicKey, ephemeral.secretKey);\n const sealed = new Uint8Array(ephemeral.publicKey.length + cipher.length);\n sealed.set(ephemeral.publicKey, 0);\n sealed.set(cipher, ephemeral.publicKey.length);\n return sealed;\n}\n\nfunction deriveSealNonce(ephemeralPublicKey: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array {\n const input = new Uint8Array(ephemeralPublicKey.length + recipientPublicKey.length);\n input.set(ephemeralPublicKey, 0);\n input.set(recipientPublicKey, ephemeralPublicKey.length);\n const hash = blake2b(input, { dkLen: nacl.box.nonceLength });\n return hash instanceof Uint8Array ? hash : new Uint8Array(hash);\n}\n\nfunction decodeBase64(base64: string): Uint8Array {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\nfunction encodeBase64(bytes: Uint8Array): string {\n let binary = \"\";\n bytes.forEach((byte) => {\n binary += String.fromCharCode(byte);\n });\n return btoa(binary);\n}\n","// deno-lint-ignore-file require-await\n// Note: Val Town HTTP trigger to process GitHub App webhooks for repo bootstrap\n\nimport { timingSafeEqual } from \"https://deno.land/std@0.224.0/crypto/timing_safe_equal.ts\";\nimport { App } from \"https://esm.sh/@octokit/app@15.1.1?target=deno\";\nimport nacl from \"https://esm.sh/tweetnacl@1.0.3?target=deno\";\nimport { blake2b } from \"https://esm.sh/@noble/hashes@1.4.0/blake2b?target=deno\";\n\ntype ProjectType = \"android\" | \"node\" | \"unknown\";\n\ninterface RepositoryCreatedPayload {\n action: string;\n repository: {\n full_name: string;\n default_branch: string;\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n };\n installation?: {\n id: number;\n } | null;\n}\n\n// Approved template repositories → project type mapping\n// Extend this map to support more templates as needed\nconst TEMPLATE_TYPE_MAP: Record = {\n \"https://github.com/cmwen/min-android-app-template\": \"android\",\n \"https://github.com/cmwen/min-node-app-template\": \"node\",\n};\nconst TARGET_WORKFLOW_FILE = \"bootstrap-action.yml\";\nconst WORKFLOW_POLL_ATTEMPTS = 12;\nconst WORKFLOW_POLL_INTERVAL_MS = 5_000;\n\nconst SECRET_CONFIG: Record = {\n android: { envPrefix: \"ANDROID_ACTION_SECRET__\", expectedPrefix: \"ANDROID_\" },\n node: { envPrefix: \"NODE_ACTION_SECRET__\", expectedPrefix: \"NPM_\" },\n unknown: null,\n};\n\nconst ANDROID_INDICATORS = [\n \"build.gradle\",\n \"settings.gradle\",\n \"gradlew\",\n \"gradlew.bat\",\n \"app/build.gradle\",\n \"app/src/main/AndroidManifest.xml\",\n];\n\nconst NODE_INDICATORS = [\n \"package.json\",\n \"package-lock.json\",\n \"pnpm-lock.yaml\",\n \"yarn.lock\",\n \"tsconfig.json\",\n \"vite.config.ts\",\n \"rollup.config.js\",\n];\n\ninterface WorkflowSummary {\n id: number;\n name?: string;\n path?: string;\n state?: string;\n}\n\ninterface WorkflowListResponse {\n workflows?: WorkflowSummary[];\n}\n\ninterface TemplateRepositoryDetails {\n template_repository?: {\n html_url?: string;\n full_name?: string;\n } | null;\n}\n\ninterface OctokitClient {\n request: (route: string, parameters: Record) => Promise<{ data: T }>;\n}\n\nexport default async function (req: Request): Promise {\n const requestId = crypto.randomUUID();\n\n const method = req.method.toUpperCase();\n if (method !== \"POST\") {\n console.log(`[${requestId}] Ignored non-POST request`);\n return new Response(\"Method Not Allowed\", { status: 405 });\n }\n\n const webhookSecret = Deno.env.get(\"GITHUB_APP_WEBHOOK_SECRET\");\n const appId = Deno.env.get(\"GITHUB_APP_ID\");\n const privateKey = Deno.env.get(\"GITHUB_APP_PRIVATE_KEY\");\n\n if (!webhookSecret || !appId || !privateKey) {\n return new Response(\"Missing GitHub App environment configuration\", { status: 500 });\n }\n\n const rawBody = await req.text();\n\n const signatureHeader = req.headers.get(\"x-hub-signature-256\");\n if (!signatureHeader) {\n console.log(`[${requestId}] Missing signature header`);\n return new Response(\"Signature missing\", { status: 400 });\n }\n\n const validSignature = await verifySignature(webhookSecret, rawBody, signatureHeader);\n if (!validSignature) {\n console.log(`[${requestId}] Invalid signature`);\n return new Response(\"Invalid signature\", { status: 401 });\n }\n\n const eventName = req.headers.get(\"x-github-event\");\n if (!eventName) {\n console.log(`[${requestId}] Missing event name`);\n return new Response(\"Event header missing\", { status: 400 });\n }\n\n if (eventName !== \"repository\") {\n console.log(`[${requestId}] Ignored event ${eventName}`);\n return new Response(`Ignored event: ${eventName}`, { status: 202 });\n }\n\n let payload: RepositoryCreatedPayload;\n try {\n payload = JSON.parse(rawBody) as RepositoryCreatedPayload;\n } catch (error) {\n console.error(`[${requestId}] Failed to parse webhook payload`, error);\n return new Response(\"Invalid JSON payload\", { status: 400 });\n }\n\n if (payload.action !== \"created\") {\n console.log(`[${requestId}] Ignored repository action ${payload.action}`);\n return new Response(`Ignored repository action: ${payload.action}`, { status: 202 });\n }\n\n const { repository, installation } = payload;\n if (!repository?.full_name || !repository?.default_branch) {\n console.log(`[${requestId}] Repository payload incomplete`, payload.repository);\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n const templateInfo = payload.repository.template_repository ?? null;\n const templateUrlFromPayload = templateInfo?.html_url\n ?? (templateInfo?.full_name ? `https://github.com/${templateInfo.full_name}` : null);\n const payloadTemplateMatches = Boolean(\n templateUrlFromPayload && TEMPLATE_TYPE_MAP[templateUrlFromPayload] !== undefined,\n );\n if (!payloadTemplateMatches) {\n console.log(`[${requestId}] Template mismatch from payload`, {\n repo: repository.full_name,\n templateUrlFromPayload,\n });\n }\n\n if (!installation?.id) {\n console.log(`[${requestId}] Missing installation context`);\n return new Response(\"Installation context missing\", { status: 400 });\n }\n\n try {\n console.log(`[${requestId}] Initializing Octokit client for repo ${repository.full_name}`);\n const octokit = await getInstallationOctokit(appId, privateKey, installation.id);\n const [owner, repoName] = repository.full_name.split(\"/\");\n if (!owner || !repoName) {\n console.log(`[${requestId}] Unable to determine owner/repo from full_name`, { fullName: repository.full_name });\n return new Response(\"Repository payload incomplete\", { status: 400 });\n }\n\n let effectiveTemplateUrl = templateUrlFromPayload;\n if (!payloadTemplateMatches) {\n const repoDetails = await octokit.request(\"GET /repos/{owner}/{repo}\", {\n owner,\n repo: repoName,\n }) as { data: TemplateRepositoryDetails };\n const resolvedTemplateUrl = repoDetails.data.template_repository?.html_url\n ?? (repoDetails.data.template_repository?.full_name\n ? `https://github.com/${repoDetails.data.template_repository.full_name}`\n : null);\n console.log(`[${requestId}] Resolved template URL`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n effectiveTemplateUrl = resolvedTemplateUrl;\n if (!resolvedTemplateUrl || TEMPLATE_TYPE_MAP[resolvedTemplateUrl] === undefined) {\n console.log(`[${requestId}] Skipping repo after resolution`, {\n repo: repository.full_name,\n resolvedTemplateUrl,\n });\n return new Response(\"Repository not created from expected template\", { status: 202 });\n }\n }\n\n const projectType = await determineProjectType({\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl: effectiveTemplateUrl,\n octokit,\n owner,\n repo: repoName,\n defaultBranch: repository.default_branch,\n });\n\n const secretsSynced = await syncProjectSecrets({\n projectType,\n octokit,\n owner,\n repo: repoName,\n requestId,\n });\n\n if (!secretsSynced) {\n console.log(`[${requestId}] No secrets synced for project type ${projectType}`);\n }\n\n const workflowMatch = await findWorkflowWithRetry(octokit, owner, repoName, requestId);\n if (!workflowMatch) {\n console.log(`[${requestId}] Workflow did not become available in time`, {\n repo: repository.full_name,\n });\n return new Response(\"Workflow file not ready\", { status: 202 });\n }\n\n let activeWorkflow = workflowMatch;\n if (activeWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Enabling workflow ${TARGET_WORKFLOW_FILE} (state=${activeWorkflow.state})`);\n try {\n await enableWorkflow(octokit, owner, repoName, activeWorkflow.id ?? TARGET_WORKFLOW_FILE);\n } catch (enableError) {\n console.error(`[${requestId}] Failed to enable workflow`, enableError);\n return new Response(\"Workflow enable failed\", { status: 500 });\n }\n\n const refreshedWorkflow = await findWorkflowWithRetry(\n octokit,\n owner,\n repoName,\n requestId,\n 4,\n 2_000,\n false,\n );\n if (!refreshedWorkflow || refreshedWorkflow.state?.startsWith(\"disabled\")) {\n console.log(`[${requestId}] Workflow still disabled after enable`, {\n repo: repository.full_name,\n state: refreshedWorkflow?.state,\n });\n return new Response(\"Workflow still disabled\", { status: 202 });\n }\n activeWorkflow = refreshedWorkflow;\n }\n\n const workflowId = activeWorkflow.id ?? TARGET_WORKFLOW_FILE;\n\n console.log(`[${requestId}] Dispatching workflow ${TARGET_WORKFLOW_FILE} for ${repository.full_name}@${repository.default_branch}`);\n await octokit.request(\"POST /repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches\", {\n owner,\n repo: repoName,\n workflow_id: workflowId,\n ref: repository.default_branch,\n });\n console.log(`[${requestId}] Workflow dispatched successfully`, {\n repo: repository.full_name,\n templateUrl: effectiveTemplateUrl,\n });\n } catch (error) {\n console.error(`[${requestId}] Failed to trigger workflow`, error);\n return new Response(\"Workflow trigger failed\", { status: 500 });\n }\n\n return new Response(\"bootstrap-action dispatched\", { status: 200 });\n}\n\nasync function verifySignature(secret: string, body: string, receivedSignature: string): Promise {\n const encoder = new TextEncoder();\n const keyData = encoder.encode(secret);\n const key = await crypto.subtle.importKey(\n \"raw\",\n keyData,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n\n const mac = await crypto.subtle.sign(\"HMAC\", key, encoder.encode(body));\n const expected = `sha256=${toHex(new Uint8Array(mac))}`;\n\n const expectedBytes = encoder.encode(expected);\n const receivedBytes = encoder.encode(receivedSignature);\n\n if (expectedBytes.length !== receivedBytes.length) {\n return false;\n }\n\n return timingSafeEqual(expectedBytes, receivedBytes);\n}\n\nfunction toHex(bytes: Uint8Array): string {\n return Array.from(bytes).map((byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nasync function getInstallationOctokit(appId: string, privateKeyPem: string, installationId: number): Promise {\n const appIdNumber = Number(appId);\n if (Number.isNaN(appIdNumber)) {\n throw new Error(\"Invalid GitHub App ID – expected numeric string\");\n }\n const normalizedKey = normalizePrivateKey(privateKeyPem);\n const app = new App({\n appId: appIdNumber,\n privateKey: normalizedKey,\n });\n return await app.getInstallationOctokit(installationId);\n}\n\nasync function determineProjectType(params: {\n requestId: string;\n templateUrlFromPayload: string | null;\n resolvedTemplateUrl: string | null;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n defaultBranch: string;\n}): Promise {\n const {\n requestId,\n templateUrlFromPayload,\n resolvedTemplateUrl,\n octokit,\n owner,\n repo,\n defaultBranch,\n } = params;\n\n const templateCandidates = [templateUrlFromPayload, resolvedTemplateUrl].filter(Boolean) as string[];\n for (const templateUrl of templateCandidates) {\n const mappedType = TEMPLATE_TYPE_MAP[templateUrl];\n if (mappedType) {\n console.log(`[${requestId}] Project type inferred from template`, {\n repo: `${owner}/${repo}`,\n templateUrl,\n mappedType,\n });\n return mappedType;\n }\n }\n\n const treePaths = await fetchRepoTreeWithRetry({\n octokit,\n owner,\n repo,\n branch: defaultBranch,\n requestId,\n });\n\n if (!treePaths) {\n console.log(`[${requestId}] Unable to fetch repository tree; defaulting to unknown type`, {\n repo: `${owner}/${repo}`,\n });\n return \"unknown\";\n }\n\n const { androidScore, nodeScore } = scoreProjectHeuristics(treePaths);\n console.log(`[${requestId}] Project heuristic scores`, {\n repo: `${owner}/${repo}`,\n androidScore,\n nodeScore,\n });\n\n if (androidScore >= 2 && androidScore >= nodeScore + 1) {\n return \"android\";\n }\n if (nodeScore >= 2 && nodeScore >= androidScore + 1) {\n return \"node\";\n }\n if (androidScore >= 3) {\n return \"android\";\n }\n if (nodeScore >= 3) {\n return \"node\";\n }\n\n return \"unknown\";\n}\n\nasync function fetchRepoTreeWithRetry(params: {\n octokit: OctokitClient;\n owner: string;\n repo: string;\n branch: string;\n requestId: string;\n attempts?: number;\n intervalMs?: number;\n}): Promise {\n const {\n octokit,\n owner,\n repo,\n branch,\n requestId,\n attempts = 5,\n intervalMs = 3_000,\n } = params;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/git/trees/{tree_sha}\", {\n owner,\n repo,\n tree_sha: branch,\n recursive: 1,\n }) as { data: { tree?: Array<{ path?: string }>; truncated?: boolean } };\n\n const treeEntries = response.data.tree ?? [];\n const paths = treeEntries\n .map((entry) => entry.path)\n .filter((path): path is string => typeof path === \"string\");\n\n if (response.data.truncated) {\n console.log(`[${requestId}] Repo tree truncated`, {\n repo: `${owner}/${repo}`,\n attempt,\n });\n }\n\n if (paths.length > 0) {\n return paths;\n }\n } catch (error) {\n if ((error as { status?: number }).status !== 404) {\n console.error(`[${requestId}] Failed to fetch repo tree`, error);\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for repository tree (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nfunction scoreProjectHeuristics(paths: string[]): { androidScore: number; nodeScore: number } {\n const androidScore = ANDROID_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n const nodeScore = NODE_INDICATORS.reduce((score, indicator) => (\n paths.some((path) => path.includes(indicator)) ? score + 1 : score\n ), 0);\n\n return { androidScore, nodeScore };\n}\n\nasync function syncProjectSecrets(params: {\n projectType: ProjectType;\n octokit: OctokitClient;\n owner: string;\n repo: string;\n requestId: string;\n}): Promise {\n const { projectType, octokit, owner, repo, requestId } = params;\n const config = SECRET_CONFIG[projectType];\n if (!config) {\n return false;\n }\n\n const envPrefix = config.envPrefix;\n const envEntries = Object.entries(Deno.env.toObject());\n const entries = envEntries\n .filter(([key]) => key.startsWith(envPrefix))\n .map(([key, value]) => [key.slice(envPrefix.length), value] as const)\n .filter(([, value]) => typeof value === \"string\" && value.length > 0);\n\n if (entries.length === 0) {\n console.log(`[${requestId}] No secrets defined in env config`, {\n projectType,\n envPrefix,\n });\n return false;\n }\n\n const publicKeyResponse = await octokit.request(\"GET /repos/{owner}/{repo}/actions/secrets/public-key\", {\n owner,\n repo,\n }) as { data: { key_id: string; key: string } };\n\n const { key_id: keyId, key } = publicKeyResponse.data;\n\n for (const [secretName, secretValue] of entries) {\n if (!secretName.startsWith(config.expectedPrefix)) {\n console.log(`[${requestId}] Secret name does not match expected prefix`, {\n secretName,\n expectedPrefix: config.expectedPrefix,\n envVariable: `${envPrefix}${secretName}`,\n });\n }\n\n const encrypted = encryptSecretValue(key, secretValue);\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/secrets/{secret_name}\", {\n owner,\n repo,\n secret_name: secretName,\n encrypted_value: encrypted,\n key_id: keyId,\n });\n console.log(`[${requestId}] Updated secret ${secretName}`);\n }\n\n return true;\n}\n\nasync function findWorkflowWithRetry(\n octokit: OctokitClient,\n owner: string,\n repo: string,\n requestId: string,\n attempts = WORKFLOW_POLL_ATTEMPTS,\n intervalMs = WORKFLOW_POLL_INTERVAL_MS,\n checkFileExistence = true,\n): Promise {\n let fileExists: boolean | undefined = checkFileExistence ? undefined : true;\n\n for (let attempt = 1; attempt <= attempts; attempt++) {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/actions/workflows\", {\n owner,\n repo,\n per_page: 100,\n }) as { data: WorkflowListResponse };\n\n const workflows = response.data.workflows ?? [];\n const match = workflows.find((workflow) => workflow.path?.endsWith(`/${TARGET_WORKFLOW_FILE}`));\n if (match) {\n return match;\n }\n\n if (fileExists === undefined) {\n fileExists = await doesWorkflowFileExist(octokit, owner, repo, TARGET_WORKFLOW_FILE);\n if (!fileExists) {\n console.log(`[${requestId}] Workflow file ${TARGET_WORKFLOW_FILE} missing from repository`, { owner, repo });\n return null;\n }\n }\n\n if (attempt < attempts) {\n console.log(`[${requestId}] Waiting for workflow registration (${attempt}/${attempts})`);\n await sleep(intervalMs);\n }\n }\n\n return null;\n}\n\nasync function doesWorkflowFileExist(octokit: OctokitClient, owner: string, repo: string, fileName: string): Promise {\n try {\n const response = await octokit.request(\"GET /repos/{owner}/{repo}/contents/.github/workflows/{path}\", {\n owner,\n repo,\n path: fileName,\n });\n return Array.isArray(response.data) ? response.data.length > 0 : Boolean(response.data);\n } catch (error) {\n if ((error as { status?: number }).status === 404) {\n return false;\n }\n throw error;\n }\n}\n\nasync function enableWorkflow(octokit: OctokitClient, owner: string, repo: string, workflowId: number | string): Promise {\n await octokit.request(\"PUT /repos/{owner}/{repo}/actions/workflows/{workflow_id}/enable\", {\n owner,\n repo,\n workflow_id: workflowId,\n });\n}\n\nfunction sleep(ms: number): Promise {\n return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\nfunction normalizePrivateKey(pem: string): string {\n const cleaned = pem.replace(/\\r/g, \"\").replace(/\\\\n/g, \"\\n\").replace(/\\n+/g, \"\\n\").trim();\n\n if (cleaned.includes(\"-----BEGIN PRIVATE KEY-----\")) {\n return cleaned;\n }\n\n if (!cleaned.includes(\"-----BEGIN RSA PRIVATE KEY-----\")) {\n throw new Error(\"Unsupported private key format. Provide PKCS#8 or PKCS#1 PEM\");\n }\n\n const base64 = cleaned\n .replace(\"-----BEGIN RSA PRIVATE KEY-----\", \"\")\n .replace(\"-----END RSA PRIVATE KEY-----\", \"\")\n .replace(/\\s+/g, \"\");\n\n const pkcs1Bytes = decodeBase64(base64);\n const pkcs8Bytes = wrapPkcs1InPkcs8(pkcs1Bytes);\n const pkcs8Base64 = encodeBase64(pkcs8Bytes);\n const body = pkcs8Base64.match(/.{1,64}/g)?.join(\"\\n\") ?? pkcs8Base64;\n return `-----BEGIN PRIVATE KEY-----\\n${body}\\n-----END PRIVATE KEY-----`;\n}\n\nfunction wrapPkcs1InPkcs8(pkcs1: Uint8Array): Uint8Array {\n const version = new Uint8Array([0x02, 0x01, 0x00]);\n const algorithm = new Uint8Array([\n 0x30, 0x0d,\n 0x06, 0x09,\n 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01,\n 0x05, 0x00,\n ]);\n const privateKey = encodeDerOctetString(pkcs1);\n const totalLength = version.length + algorithm.length + privateKey.length;\n const sequenceHeader = encodeDerSequence(totalLength);\n const result = new Uint8Array(sequenceHeader.length + version.length + algorithm.length + privateKey.length);\n let offset = 0;\n result.set(sequenceHeader, offset);\n offset += sequenceHeader.length;\n result.set(version, offset);\n offset += version.length;\n result.set(algorithm, offset);\n offset += algorithm.length;\n result.set(privateKey, offset);\n return result;\n}\n\nfunction encodeDerSequence(contentLength: number): Uint8Array {\n const lengthBytes = encodeDerLength(contentLength);\n const result = new Uint8Array(1 + lengthBytes.length);\n result[0] = 0x30;\n result.set(lengthBytes, 1);\n return result;\n}\n\nfunction encodeDerOctetString(value: Uint8Array): Uint8Array {\n const lengthBytes = encodeDerLength(value.length);\n const result = new Uint8Array(1 + lengthBytes.length + value.length);\n result[0] = 0x04;\n result.set(lengthBytes, 1);\n result.set(value, 1 + lengthBytes.length);\n return result;\n}\n\nfunction encodeDerLength(length: number): Uint8Array {\n if (length < 0x80) {\n return new Uint8Array([length]);\n }\n const bytes: number[] = [];\n let temp = length;\n while (temp > 0) {\n bytes.unshift(temp & 0xff);\n temp >>= 8;\n }\n return new Uint8Array([0x80 | bytes.length, ...bytes]);\n}\n\nfunction encryptSecretValue(publicKey: string, secretValue: string): string {\n const publicKeyBytes = decodeBase64(publicKey);\n if (publicKeyBytes.length !== nacl.box.publicKeyLength) {\n throw new Error(`Unexpected public key length: ${publicKeyBytes.length}`);\n }\n\n const messageBytes = new TextEncoder().encode(secretValue);\n const sealed = sealBox(messageBytes, publicKeyBytes);\n return encodeBase64(sealed);\n}\n\nfunction sealBox(message: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array {\n const ephemeral = nacl.box.keyPair();\n const nonce = deriveSealNonce(ephemeral.publicKey, recipientPublicKey);\n const cipher = nacl.box(message, nonce, recipientPublicKey, ephemeral.secretKey);\n const sealed = new Uint8Array(ephemeral.publicKey.length + cipher.length);\n sealed.set(ephemeral.publicKey, 0);\n sealed.set(cipher, ephemeral.publicKey.length);\n return sealed;\n}\n\nfunction deriveSealNonce(ephemeralPublicKey: Uint8Array, recipientPublicKey: Uint8Array): Uint8Array {\n const input = new Uint8Array(ephemeralPublicKey.length + recipientPublicKey.length);\n input.set(ephemeralPublicKey, 0);\n input.set(recipientPublicKey, ephemeralPublicKey.length);\n const hash = blake2b(input, { dkLen: nacl.box.nonceLength });\n return hash instanceof Uint8Array ? hash : new Uint8Array(hash);\n}\n\nfunction decodeBase64(base64: string): Uint8Array {\n const binary = atob(base64);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\nfunction encodeBase64(bytes: Uint8Array): string {\n let binary = \"\";\n bytes.forEach((byte) => {\n binary += String.fromCharCode(byte);\n });\n return btoa(binary);\n}\n","createdAt",["D",1763279292407],"branchVersion","branchId","4b0ef6fa-b963-11f0-9f51-0224a6c84d84","id","4b0e9a5c-b963-11f0-9f51-0224a6c84d84","min-github-app",["D",1762249656057],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","4beef6df-3843-4b72-89fa-30221ff3dc3f","pinnedFileId","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","d71a7b3f-2bac-4e0a-ab86-45a2cb8e73e6","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_96":95,"_103":99},"org",{"_96":95,"_97":-5,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"isOwned",25,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","min","handle","displayName","avatar","https://images.clerk.dev/oauth_github/img_2SaTZZASBW3zWmhsdpd5gxwllMY.jpeg","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":197,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":31,"_57":58,"_59":58,"_60":-5,"_61":62,"_63":64,"_65":-5,"_66":-5,"_67":-5,"_68":-5,"_69":70,"_71":70,"_72":73,"_74":73,"_75":73,"_76":70,"_77":70,"_78":198,"_80":199,"_82":200,"_84":25},"tree",[176,177,178,179,180],"files",[176,177,178,179,180],"counts",{"_165":62,"_166":140,"_167":62,"_168":169,"_170":171},"contents",[125,126,127,128,129],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_43":158,"_32":159,"_30":160,"_131":-5,"_41":42,"_40":161,"_132":58,"_38":162,"_13":62,"_33":20,"_35":163,"_24":25,"_135":-5,"_27":164},{"_43":152,"_32":153,"_30":154,"_131":-5,"_41":42,"_40":149,"_132":58,"_38":155,"_13":62,"_33":20,"_35":156,"_24":25,"_135":-5,"_27":157},{"_43":144,"_32":145,"_30":146,"_131":-5,"_41":42,"_40":147,"_132":25,"_38":148,"_13":149,"_33":20,"_35":150,"_24":25,"_135":-5,"_27":151},{"_43":137,"_32":138,"_30":139,"_131":-5,"_41":42,"_40":140,"_132":58,"_38":141,"_13":62,"_33":20,"_35":142,"_24":25,"_135":-5,"_27":143},{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":25,"_38":133,"_13":134,"_33":34,"_35":37,"_24":25,"_135":-5,"_27":136},"9a2adec8-c2c0-11f0-8092-42dde27851f2","parentId","latest",["D",1763279292407],14,"label",[28],"39295fe6-b965-11f0-833a-0224a6c84d84","deno.json","3929607c-b965-11f0-833a-0224a6c84d84",1,["D",1762250485022],"{\n \"$schema\": \"https://raw.githubusercontent.com/denoland/deno/98f62cee78e85bfc47c62ed703777c6bc8794f1c/cli/schemas/config-file.v1.json\",\n \"lock\": false,\n \"compilerOptions\": {\n \"noImplicitAny\": false,\n \"strict\": true,\n \"types\": [\"https://www.val.town/types/valtown.d.ts\"],\n \"lib\": [\n \"dom\",\n \"dom.iterable\",\n \"dom.asynciterable\",\n \"deno.ns\",\n \"deno.unstable\"\n ]\n },\n \"lint\": {\n \"include\": [\"deno:/https/esm.town/**/*\"],\n \"rules\": {\n \"exclude\": [\"no-explicit-any\"]\n }\n },\n \"node_modules_dir\": false,\n \"experimental\": {\n \"unstable-node-globals\": true,\n \"unstable-temporal\": true,\n \"unstable-worker-options\": true,\n \"unstable-sloppy-imports\": true\n }\n}",[138],"9a25f52a-c2c0-11f0-b0f5-42dde27851f2","README.md","04cb1978-b9c0-11f0-8c37-0224a6c84d84",20,["D",1763279292406],2,"# GitHub App Bootstrap Val\n\nThis Val Town project exposes an HTTP webhook that acts as a lightweight GitHub App backend. It listens for `repository` creation events, verifies the webhook signature, infers the project type (Android vs. Node.js), synchronizes the required GitHub Actions secrets, and finally dispatches a bootstrap workflow in the new repository.\n\n## Request Flow\n\n- Validates `POST` requests signed with `x-hub-signature-256` using `GITHUB_APP_WEBHOOK_SECRET`.\n- Confirms the repository was cloned from an approved template. If the template is unknown, it scores the repo tree for Android or Node.js indicators.\n- Creates an installation-scoped Octokit client, normalizes the app private key (PKCS#1 → PKCS#8), and hydrates GitHub Actions secrets using the repo public key.\n- Waits for `.github/workflows/bootstrap-action.yml` to register, enables it if necessary, and triggers a workflow dispatch on the default branch.\n\n## Environment Configuration\n\nSet these secrets in the Val configuration before deploying:\n\n| Variable | Description |\n| --- | --- |\n| `GITHUB_APP_WEBHOOK_SECRET` | Shared secret used to validate incoming GitHub webhooks. |\n| `GITHUB_APP_ID` | Numeric GitHub App identifier. |\n| `GITHUB_APP_PRIVATE_KEY` | PEM string for the GitHub App private key (PKCS#1 or PKCS#8; literal newlines or `\\n` escapes both work). |\n| `ANDROID_ACTION_SECRET__*` | One env var per secret. Name must start with `ANDROID_ACTION_SECRET__` and continue with the GitHub secret key (e.g. `ANDROID_ACTION_SECRET__ANDROID_KEYSTORE`). |\n| `NODE_ACTION_SECRET__*` | One env var per secret. Name must start with `NODE_ACTION_SECRET__` and continue with the GitHub secret key (e.g. `NODE_ACTION_SECRET__NPM_TOKEN`). |\n\nExample env layout:\n\n```\nANDROID_ACTION_SECRET__ANDROID_KEYSTORE=base64-keystore\nANDROID_ACTION_SECRET__ANDROID_KEYSTORE_PASSWORD=super-secret\nNODE_ACTION_SECRET__NPM_TOKEN=ghs_...\n```\n\nWhen a repository is created from `cmwen/min-node-app-template`, the handler will upsert the `NPM_TOKEN` secret in that repo using `NODE_ACTION_SECRET__NPM_TOKEN` from Val's environment.\n\n## Project Type Detection\n\n1. **Template Mapping** – Known templates map directly to a project type:\n - Android: `https://github.com/cmwen/min-android-app-template` → `android`\n - Node.js: `https://github.com/cmwen/min-node-app-template` → `node`\n2. **Repo Tree Heuristics** – If the template is unknown, the handler fetches the git tree and counts indicator files:\n - Android: `build.gradle`, `gradlew`, `AndroidManifest.xml`, etc.\n - Node.js: `package.json`, `pnpm-lock.yaml`, `vite.config.ts`, etc.\n3. **Fallback** – When the score is inconclusive, type becomes `unknown` and no secrets are synced.\n\n## Secret Synchronization\n\n- Pulls the repo public key via the Actions API.\n- Encrypts each secret with Tweetsodium (`crypto_box_seal`).\n- Upserts secrets using the installation token. Secret names missing the expected prefix still upload, but a warning is logged.\n\n## Workflow Dispatch Logic\n\n- Polls for `bootstrap-action.yml` registration (up to ~60 seconds).\n- Enables the workflow if it is disabled.\n- Dispatches the workflow once the repo is ready; otherwise responds with a 202 to allow retrying later.\n\n## Extending the Handler\n\n- **Add Templates:** Update `TEMPLATE_TYPE_MAP` with new template URLs.\n- **Add Heuristics:** Extend `ANDROID_INDICATORS` / `NODE_INDICATORS` or introduce new project types.\n- **Add Secrets:** Include additional key/value pairs in the JSON env vars. The handler will encrypt and upload everything it finds.\n\n## Testing Tips\n\n- Use `vt watch` for rapid iteration while sending signed webhook payloads (e.g., via `curl`).\n- Inspect Val Town logs to confirm classification, secret sync status, and workflow dispatch attempts.\n- If workflow dispatch fails with `404`, ensure the workflow file exists on the default branch and that GitHub has finished initializing the repo (may take a minute on newly-created repositories).\n",[145],"392e5fc8-b965-11f0-8529-0224a6c84d84","AGENTS.md","392e6068-b965-11f0-8529-0224a6c84d84",["D",1762250485054],"You are an advanced assistant specialized in generating Val Town code.\n\n## Core Guidelines\n\n- Ask clarifying questions when requirements are ambiguous\n- Provide complete, functional solutions rather than skeleton implementations\n- Test your logic against edge cases before presenting the final solution\n- Ensure all code follows Val Town's specific platform requirements\n- If a section of code that you're working on is getting too complex, consider refactoring it into subcomponents\n\n## Code Standards\n\n- Generate code in TypeScript or TSX\n- Add appropriate TypeScript types and interfaces for all data structures\n- Prefer official SDKs or libraries than writing API calls directly\n- Ask the user to supply API or library documentation if you are at all unsure about it\n- **Never bake in secrets into the code** - always use environment variables\n- Include comments explaining complex logic (avoid commenting obvious operations)\n- Follow modern ES6+ conventions and functional programming practices if possible\n\n## Types of triggers\n\n### 1. HTTP Trigger\n\n- Create web APIs and endpoints\n- Handle HTTP requests and responses\n- Example structure:\n\n```ts\nexport default async function (req: Request) {\n return new Response(\"Hello World\");\n}\n```\n\nFiles that are HTTP triggers have http in their name like `foobar.http.tsx`\n\n### 2. Cron Triggers\n\n- Run on a schedule\n- Use cron expressions for timing\n- Example structure:\n\n```ts\nexport default async function () {\n // Scheduled task code\n}\n```\n\nFiles that are Cron triggers have cron in their name like `foobar.cron.tsx`\n\n### 3. Email Triggers\n\n- Process incoming emails\n- Handle email-based workflows\n- Example structure:\n\n```ts\nexport default async function (email: Email) {\n // Process email\n}\n```\n\nFiles that are Email triggers have email in their name like `foobar.email.tsx`\n\n\n## Val Town Standard Libraries\n\nVal Town provides several hosted services and utility functions.\n\n### Blob Storage\n\n```ts\nimport { blob } from \"https://esm.town/v/std/blob\";\nawait blob.setJSON(\"myKey\", { hello: \"world\" });\nlet blobDemo = await blob.getJSON(\"myKey\");\nlet appKeys = await blob.list(\"app_\");\nawait blob.delete(\"myKey\");\n```\n\n### SQLite\n\n```ts\nimport { sqlite } from \"https://esm.town/v/stevekrouse/sqlite\";\nconst TABLE_NAME = 'todo_app_users_2';\n// Create table - do this before usage and change table name when modifying schema\nawait sqlite.execute(`CREATE TABLE IF NOT EXISTS ${TABLE_NAME} (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n name TEXT NOT NULL\n)`);\n// Query data\nconst result = await sqlite.execute(`SELECT * FROM ${TABLE_NAME} WHERE id = ?`, [1]);\n```\n\nNote: When changing a SQLite table's schema, change the table's name (e.g., add _2 or _3) to create a fresh table.\n\n### OpenAI\n\n```ts\nimport { OpenAI } from \"https://esm.town/v/std/openai\";\nconst openai = new OpenAI();\nconst completion = await openai.chat.completions.create({\n messages: [\n { role: \"user\", content: \"Say hello in a creative way\" },\n ],\n model: \"gpt-4o-mini\",\n max_tokens: 30,\n});\n```\n\n### Email\n\n```ts\nimport { email } from \"https://esm.town/v/std/email\";\n// By default emails the owner of the val\nawait email({ \n subject: \"Hi\", \n text: \"Hi\", \n html: \"

Hi

\"\n});\n```\n\n## Val Town Utility Functions\n\nVal Town provides several utility functions to help with common project tasks.\n\n### Importing Utilities\n\nAlways import utilities with version pins to avoid breaking changes:\n\n```ts\nimport { parseProject, readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n```\n\n### Available Utilities\n\n\n#### **serveFile** - Serve project files with proper content types\n\nFor example, in Hono:\n\n```ts\n// serve all files in frontend/ and shared/\napp.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\napp.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n```\n\n#### **readFile** - Read files from within the project:\n\n```ts\n// Read a file from the project\nconst fileContent = await readFile(\"/frontend/index.html\", import.meta.url);\n```\n\n#### **listFiles** - List all files in the project\n\n```ts\nconst files = await listFiles(import.meta.url);\n```\n\n#### **parseProject** - Extract information about the current project from import.meta.url\n\nThis is useful for including info for linking back to a val, ie in \"view source\" urls:\n\n```ts\nconst projectVal = parseProject(import.meta.url);\nconsole.log(projectVal.username); // Owner of the project\nconsole.log(projectVal.name); // Project name\nconsole.log(projectVal.version); // Version number\nconsole.log(projectVal.branch); // Branch name\nconsole.log(projectVal.links.self.project); // URL to the project page\n```\n\nHowever, it's *extremely importing* to note that `parseProject` and other Standard Library utilities ONLY RUN ON THE SERVER.\nIf you need access to this data on the client, run it in the server and pass it to the client by splicing it into the HTML page\nor by making an API request for it.\n\n## Val Town Platform Specifics\n\n- **Redirects:** Use `return new Response(null, { status: 302, headers: { Location: \"/place/to/redirect\" }})` instead of `Response.redirect` which is broken\n- **Images:** Avoid external images or base64 images. Use emojis, unicode symbols, or icon fonts/libraries instead\n- **AI Image:** To inline generate an AI image use: `

`\n- **Storage:** DO NOT use the Deno KV module for storage\n- **Browser APIs:** DO NOT use the `alert()`, `prompt()`, or `confirm()` methods\n- **Weather Data:** Use open-meteo for weather data (doesn't require API keys) unless otherwise specified\n- **View Source:** Add a view source link by importing & using `import.meta.url.replace(\"ems.sh\", \"val.town)\"` (or passing this data to the client) and include `target=\"_top\"` attribute\n- **Error Debugging:** Add `` to HTML to capture client-side errors\n- **Error Handling:** Only use try...catch when there's a clear local resolution; Avoid catches that merely log or return 500s. Let errors bubble up with full context\n- **Environment Variables:** Use `Deno.env.get('keyname')` when you need to, but generally prefer APIs that don't require keys\n- **Imports:** Use `https://esm.sh` for npm and Deno dependencies to ensure compatibility on server and browser\n- **Storage Strategy:** Only use backend storage if explicitly required; prefer simple static client-side sites\n- **React Configuration:** When using React libraries, pin versions with `?deps=react@18.2.0,react-dom@18.2.0` and start the file with `/** @jsxImportSource https://esm.sh/react@18.2.0 */`\n- Ensure all React dependencies and sub-dependencies are pinned to the same version\n- **Styling:** Default to using TailwindCSS via `` unless otherwise specified\n\n## Project Structure and Design Patterns\n\n### Recommended Directory Structure\n```\n├── backend/\n│ ├── database/\n│ │ ├── migrations.ts # Schema definitions\n│ │ ├── queries.ts # DB query functions\n│ │ └── README.md\n│ └── routes/ # Route modules\n│ ├── [route].ts\n│ └── static.ts # Static file serving\n│ ├── index.ts # Main entry point\n│ └── README.md\n├── frontend/\n│ ├── components/\n│ │ ├── App.tsx\n│ │ └── [Component].tsx\n│ ├── favicon.svg\n│ ├── index.html # Main HTML template\n│ ├── index.tsx # Frontend JS entry point\n│ ├── README.md\n│ └── style.css\n├── README.md\n└── shared/\n ├── README.md\n └── utils.ts # Shared types and functions\n```\n\n### Backend (Hono) Best Practices\n\n- Hono is the recommended API framework\n- Main entry point should be `backend/index.ts`\n- **Static asset serving:** Use the utility functions to read and serve project files:\n ```ts\n import { readFile, serveFile } from \"https://esm.town/v/std/utils@85-main/index.ts\";\n \n // serve all files in frontend/ and shared/\n app.get(\"/frontend/*\", c => serveFile(c.req.path, import.meta.url));\n app.get(\"/shared/*\", c => serveFile(c.req.path, import.meta.url));\n \n // For index.html, often you'll want to bootstrap with initial data\n app.get(\"/\", async c => {\n let html = await readFile(\"/frontend/index.html\", import.meta.url);\n \n // Inject data to avoid extra round-trips\n const initialData = await fetchInitialData();\n const dataScript = ``;\n \n html = html.replace(\"\", `${dataScript}`);\n return c.html(html);\n });\n ```\n- Create RESTful API routes for CRUD operations\n- Always include this snippet at the top-level Hono app to re-throwing errors to see full stack traces:\n ```ts\n // Unwrap Hono errors to see original error details\n app.onError((err, c) => {\n throw err;\n });\n ```\n\n### Database Patterns\n- Run migrations on startup or comment out for performance\n- Change table names when modifying schemas rather than altering\n- Export clear query functions with proper TypeScript typing\n\n## Common Gotchas and Solutions\n\n1. **Environment Limitations:** \n - Val Town runs on Deno in a serverless context, not Node.js\n - Code in `shared/` must work in both frontend and backend environments\n - Cannot use `Deno` keyword in shared code\n - Use `https://esm.sh` for imports that work in both environments\n\n2. **SQLite Peculiarities:**\n - Limited support for ALTER TABLE operations\n - Create new tables with updated schemas and copy data when needed\n - Always run table creation before querying\n\n3. **React Configuration:**\n - All React dependencies must be pinned to 18.2.0\n - Always include `@jsxImportSource https://esm.sh/react@18.2.0` at the top of React files\n - Rendering issues often come from mismatched React versions\n\n4. **File Handling:**\n - Val Town only supports text files, not binary\n - Use the provided utilities to read files across branches and forks\n - For files in the project, use `readFile` helpers\n\n5. **API Design:**\n - `fetch` handler is the entry point for HTTP vals\n - Run the Hono app with `export default app.fetch // This is the entry point for HTTP vals`\n\n",[153],"3943b094-b965-11f0-b5f9-0224a6c84d84",".vtignore","3943b148-b965-11f0-b5f9-0224a6c84d84",4,["D",1762250485036],".git\n.vscode\n.cursorrules\n.DS_Store\nnode_modules\nvendor",[159],"pulls","branches","forks","envVars",{"_172":174,"_175":62},"connections",{"_172":62,"_173":62},"count","unfilledCount",7,"emptyCount",{"_43":158,"_32":159,"_30":160,"_131":-5,"_41":42,"_40":161,"_132":58,"_38":194,"_13":62,"_33":20,"_35":163,"_24":25,"_135":-5,"_182":195,"_27":196},{"_43":152,"_32":153,"_30":154,"_131":-5,"_41":42,"_40":149,"_132":58,"_38":191,"_13":62,"_33":20,"_35":156,"_24":25,"_135":-5,"_182":192,"_27":193},{"_43":144,"_32":145,"_30":146,"_131":-5,"_41":42,"_40":147,"_132":25,"_38":188,"_13":149,"_33":20,"_35":150,"_24":25,"_135":-5,"_182":189,"_27":190},{"_43":137,"_32":138,"_30":139,"_131":-5,"_41":42,"_40":140,"_132":58,"_38":185,"_13":62,"_33":20,"_35":142,"_24":25,"_135":-5,"_182":186,"_27":187},{"_43":130,"_32":28,"_30":31,"_131":-5,"_41":42,"_40":14,"_132":25,"_38":181,"_13":134,"_33":34,"_35":37,"_24":25,"_135":-5,"_182":183,"_27":184},["D",1763279292407],"children",[],[28],["D",1762250485022],[],[138],["D",1763279292406],[],[145],["D",1762250485054],[],[153],["D",1762250485036],[],[159],["D",1762249656057],{"_96":95,"_103":99},{"_96":95,"_97":-5,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":85,"_32":86,"_43":42,"_87":44,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":-5,"_93":45,"_94":95},"ctx",{"_78":-5,"_122":234,"_235":236,"_237":238,"_239":25,"_240":25,"_241":25,"_242":58,"_243":-5,"_244":-7,"_245":-7,"_246":62,"_247":25,"_248":25,"_249":-5,"_250":25,"_251":25,"_252":25,"_253":-5},"ENV",{"_205":206,"_207":208,"_209":86,"_210":211,"_212":213,"_214":215,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","fdb67791413f4386b4dbf18f354029a617f6160f","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v21