[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_213":214,"_215":216},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_159":-5,"_20":160,"_22":161,"_162":163,"_164":165,"_25":166,"_24":-5,"_167":-5,"_168":-5,"_169":55,"_170":171,"_172":46,"_173":-5,"_174":-5,"_175":176},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","ngzvhmcf","name","sambkw","branchName","main","version","path","","project",{"_35":103,"_13":14,"_47":104,"_105":-5,"_106":55,"_107":108,"_109":108,"_110":111,"_112":-5,"_113":114,"_115":39,"_116":46,"_117":-5,"_118":-5,"_119":63,"_120":121,"_122":123,"_124":125,"_126":127,"_128":-5,"_129":130,"_131":130,"_132":133,"_134":133,"_135":133,"_136":130,"_137":130,"_138":139,"_140":141,"_142":143,"_144":55},"tree",[73,74,75],"file","contents",[32,33,34],"upstream","pull","ahead","behind","envVars",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":63,"_50":71,"_52":-5,"_54":55,"_56":-5,"_18":72},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":65},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":14,"_18":57},"id","fee6e4cf-b54a-44b9-8111-8110becc04c1","index.tsx","fileId","89687324-a740-11f1-8395-1607ee4eb77e","parentId","branchId","f3696943-a273-4717-a367-2529b8699f92","branchVersion",8,"latest",true,"createdAt",["D",1788403126103],3,"fileType","http","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getCookie, setCookie, deleteCookie } from \"npm:hono@4/cookie\";\nimport {\n base64urlEncode,\n hashPassword,\n sign,\n verify,\n verifyPassword,\n} from \"./lib/security.ts\";\nimport {\n createSession,\n createUser,\n deleteSession,\n findSession,\n findUserByEmail,\n findUserById,\n initDb,\n} from \"./lib/db.ts\";\n\n// Cookie-signing secret. Set SESSION_SECRET env var; falls back to a dev value.\nconst SESSION_SECRET = Deno.env.get(\"SESSION_SECRET\") ?? \"dev-insecure-secret-change-me\";\nconst SESSION_COOKIE = \"sambkw_session\";\nconst SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days\n\nawait initDb();\n\n/** The currently logged-in user, or null. */\nasync function getCurrentUser(c: any) {\n const raw = getCookie(c, SESSION_COOKIE);\n if (!raw) return null;\n const token = await verify(raw, SESSION_SECRET);\n if (!token) return null;\n const session = await findSession(token);\n if (!session) return null;\n if (Date.now() - session.createdAt > SESSION_TTL_MS) {\n await deleteSession(token);\n return null;\n }\n return findUserById(session.userId);\n}\n\nasync function startSession(c: any, userId: number) {\n const token = base64urlEncode(crypto.getRandomValues(new Uint8Array(32)));\n await createSession(token, userId);\n const signed = await sign(token, SESSION_SECRET);\n setCookie(c, SESSION_COOKIE, signed, {\n httpOnly: true,\n sameSite: \"Lax\",\n secure: true,\n maxAge: 30 * 24 * 60 * 60,\n path: \"/\",\n });\n}\n\nconst app = new Hono();\n\n// ---------------------------------------------------------------- Layout\nfunction Layout(props: {\n title: string;\n user?: { email: string } | null;\n children: any;\n}) {\n return (\n \n \n \n \n {props.title} · Sambkw\n \n \n \n \n

{props.children}

\n \n \n );\n}\n\nfunction Input(props: any) {\n return (\n \n );\n}\n\n// ---------------------------------------------------------------- Homepage\napp.get(\"/\", async (c) => {\n const user = await getCurrentUser(c);\n return c.html(\n \n

\n Welcome to sambkw\n

\n A sample website with a complete email + password authentication\n system built on Val Town — SQLite storage, PBKDF2 password hashing,\n and signed session cookies.\n

\n {user ? (\n \n Go to your dashboard\n \n ) : (\n <>\n \n Create an account\n \n \n Log in\n \n \n )}\n

SQLite users

\n Accounts are stored in this val's scoped database.\n

Secure passwords

\n PBKDF2 with per-user salts — plaintext is never stored.\n

Signed sessions

\n HttpOnly cookies with HMAC signatures and expiry.\n

\n ,\n );\n});\n\n// ---------------------------------------------------------------- Signup\napp.get(\"/signup\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(\"/dashboard\", 303);\n return c.html(\n \n

Create your account

Join Sambkw.

\n ,\n );\n});\n\napp.post(\"/signup\", async (c) => {\n const body = await c.req.parseBody();\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(email)) {\n return c.html(\"Invalid email address.\", 400);\n }\n if (password.length < 8) {\n return c.html(\"Password must be at least 8 characters.\", 400);\n }\n if (await findUserByEmail(email)) {\n return c.html(\"An account with that email already exists.\", 409);\n }\n const hash = await hashPassword(password);\n const user = await createUser(email, hash);\n await startSession(c, user.id);\n return c.redirect(\"/dashboard\", 303);\n});\n\n// ---------------------------------------------------------------- Login\napp.get(\"/login\", async (c) => {\n const user = await getCurrentUser(c);\n if (user) return c.redirect(\"/dashboard\", 303);\n return c.html(\n \n

Welcome back

\n ,\n );\n});\n\napp.post(\"/login\", async (c) => {\n const body = await c.req.parseBody();\n const email = String(body.email ?? \"\").trim().toLowerCase();\n const password = String(body.password ?? \"\");\n const user = await findUserByEmail(email);\n const ok = user ? await verifyPassword(password, user.passwordHash) : false;\n if (!user || !ok) {\n // Same error for unknown email vs wrong password (no user enumeration).\n return c.html(\"Invalid email or password.\", 401);\n }\n await startSession(c, user.id);\n return c.redirect(\"/dashboard\", 303);\n});\n\n// ---------------------------------------------------------------- Logout\napp.post(\"/logout\", async (c) => {\n const raw = getCookie(c, SESSION_COOKIE);\n if (raw) {\n const token = await verify(raw, SESSION_SECRET);\n if (token) await deleteSession(token);\n }\n deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n return c.redirect(\"/\", 303);\n});\n\n// ---------------------------------------------------------------- Dashboard (protected)\napp.get(\"/dashboard\", async (c) => {\n const user = await getCurrentUser(c);\n if (!user) return c.redirect(\"/login\", 303);\n return c.html(\n \n

Your dashboard

\n You're logged in. This page is only visible to authenticated users.\n

\n Account\n

Email: {user.email}
User ID: {user.id}
Member since: {new Date(user.createdAt).toLocaleDateString()}

\n ,\n );\n});\n\napp.onError((err, c) => {\n console.error(\"Error:\", err);\n return c.html(\"Something went wrong on the server.\", 500);\n});\n\nexport default app.fetch;\n","deleted",false,"label",[37],"8a0fcf62-8ea2-4856-b0e4-ccb63d1a7be1","README.md","acd433a2-a740-11f1-ad54-1607ee4eb77e",9,["D",1788403164429],0,"# sambkw\n\nA sample website with a complete, working **email + password authentication system** built on Val Town.\n\n## ✨ Try it\n\n[Visit the live site](url:index.tsx)\n\nCreate an account (or log in with the test user `sam@example.com` / `supersecret1`), and you'll land on a members-only dashboard.\n\n## How it works\n\n| Capability | Implementation |\n| --- | --- |\n| Server | [Hono](https://hono.dev) + JSX (`index.tsx`) |\n| Users & sessions | SQLite, scoped to this val (`lib/db.ts`) |\n| Password hashing | PBKDF2 (100k iterations, per-user 16-byte salt) via WebCrypto (`lib/security.ts`) |\n| Sessions | Random 256-bit token stored in the DB, delivered as an **HttpOnly, Secure, SameSite=Lax** cookie signed with HMAC-SHA256 |\n| Route protection | `/dashboard` requires a valid session; otherwise redirects to `/login` |\n\n### Routes\n- `GET /` — homepage\n- `GET/POST /signup` — create an account (auto-logs you in)\n- `GET/POST /login` — sign in\n- `POST /logout` — destroy the session\n- `GET /dashboard` — protected page for authenticated users\n\n## Security notes\n- Passwords are never stored in plaintext; each is hashed with a unique random salt.\n- Login returns the same error for an unknown email and a wrong password, preventing user enumeration.\n- Session cookies are signed so they can't be forged without `SESSION_SECRET`, and sessions can be revoked server-side on logout.\n\n### Environment variables\n- `SESSION_SECRET` — secret used to sign session cookies. Set it to a long random string before going to production. It's already configured on this val.\n\n## Files\n- `index.tsx` — HTTP entrypoint (routes + views)\n- `lib/security.ts` — password hashing and cookie signing\n- `lib/db.ts` — SQLite schema and queries\n",[59],"cf26488e-ece1-419b-a180-8245494bfab9","lib","33c1a848-fdd3-40ee-89f1-dbfc3d09a30d",2,["D",1788403065948],"directory",[67],{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":83,"_17":63,"_50":71,"_52":-5,"_54":55,"_56":-5,"_77":84,"_18":85},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":80,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_77":81,"_18":82},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":76,"_17":49,"_50":51,"_52":53,"_54":55,"_56":14,"_77":78,"_18":79},["D",1788403126103],"children",[],[37],["D",1788403164429],[],[59],["D",1788403065948],[86,87],[67],{"_35":96,"_13":97,"_38":98,"_40":68,"_41":42,"_43":49,"_45":46,"_47":99,"_17":63,"_50":92,"_52":100,"_54":55,"_56":-5,"_77":101,"_18":102},{"_35":88,"_13":89,"_38":90,"_40":68,"_41":42,"_43":69,"_45":46,"_47":91,"_17":63,"_50":92,"_52":93,"_54":55,"_56":-5,"_77":94,"_18":95},"aa7922d5-c9d1-4c4a-905a-0a95a437421b","security.ts","72208490-a740-11f1-9639-1607ee4eb77e",["D",1788403065948],"script","/**\n * Security helpers: password hashing (PBKDF2 via WebCrypto) and\n * HMAC-signed session cookies.\n */\n\nconst encoder = new TextEncoder();\n\n/** Derive a session cookie signing key from a secret. */\nasync function cookieKey(secret: string): Promise {\n return await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\", \"verify\"],\n );\n}\n\n/** Hash a plaintext password. Store the returned string in the DB. */\nexport async function hashPassword(password: string): Promise {\n const salt = crypto.getRandomValues(new Uint8Array(16));\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n { name: \"PBKDF2\" },\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n salt,\n iterations: 100_000,\n hash: \"SHA-256\",\n },\n key,\n 256,\n );\n const hash = new Uint8Array(bits);\n const saltB64 = btoa(String.fromCharCode(...salt));\n const hashB64 = btoa(String.fromCharCode(...hash));\n return `pbkdf2$${saltB64}$${hashB64}`;\n}\n\n/** Verify a plaintext password against a stored hash string. */\nexport async function verifyPassword(\n password: string,\n stored: string,\n): Promise {\n const [scheme, saltB64, hashB64] = stored.split(\"$\");\n if (scheme !== \"pbkdf2\") return false;\n const salt = Uint8Array.from(atob(saltB64), (c) => c.charCodeAt(0));\n const expected = Uint8Array.from(atob(hashB64), (c) => c.charCodeAt(0));\n const key = await crypto.subtle.importKey(\n \"raw\",\n encoder.encode(password),\n { name: \"PBKDF2\" },\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n { name: \"PBKDF2\", salt, iterations: 100_000, hash: \"SHA-256\" },\n key,\n 256,\n );\n const actual = new Uint8Array(bits);\n if (actual.length !== expected.length) return false;\n let diff = 0;\n for (let i = 0; i < actual.length; i++) diff |= actual[i] ^ expected[i];\n return diff === 0;\n}\n\n/**\n * Sign an opaque token with the secret. Returns \"payload.signature\".\n * `payload` is base64url of the plaintext value we want to carry.\n */\nexport async function sign(payload: string, secret: string): Promise {\n const key = await cookieKey(secret);\n const sig = new Uint8Array(\n await crypto.subtle.sign(\"HMAC\", key, encoder.encode(payload)),\n );\n const sigB64 = btoa(String.fromCharCode(...sig))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n return `${payload}.${sigB64}`;\n}\n\n/** Verify a signed token; returns the original payload or null if invalid. */\nexport async function verify(\n token: string,\n secret: string,\n): Promise {\n const lastDot = token.lastIndexOf(\".\");\n if (lastDot === -1) return null;\n const payload = token.slice(0, lastDot);\n const sigB64 = token.slice(lastDot + 1);\n const sig = Uint8Array.from(\n atob(sigB64.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n const key = await cookieKey(secret);\n // timing-safe verify\n try {\n const valid = await crypto.subtle.verify(\n \"HMAC\",\n key,\n sig,\n encoder.encode(payload),\n );\n return valid ? payload : null;\n } catch {\n return null;\n }\n}\n\nexport function base64urlEncode(bytes: Uint8Array): string {\n return btoa(String.fromCharCode(...bytes))\n .replace(/\\+/g, \"-\")\n .replace(/\\//g, \"_\")\n .replace(/=+$/, \"\");\n}\n\nexport function base64urlDecode(str: string): Uint8Array {\n return Uint8Array.from(atob(str.replace(/-/g, \"+\").replace(/_/g, \"/\")), (c) =>\n c.charCodeAt(0),\n );\n}\n",[],[67,89],"93c7983a-fd89-49dd-852c-c7a263e8bc2e","db.ts","7522e8a4-a740-11f1-9639-1607ee4eb77e",["D",1788403071003],"/**\n * SQLite schema + queries for users and sessions.\n * Database is scoped to this val.\n */\nimport { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nexport interface User {\n id: number;\n email: string;\n passwordHash: string;\n createdAt: number;\n}\n\nexport interface Session {\n token: string;\n userId: number;\n createdAt: number;\n}\n\nexport async function initDb(): Promise {\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS users (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n email TEXT NOT NULL UNIQUE,\n passwordHash TEXT NOT NULL,\n createdAt INTEGER NOT NULL\n )`);\n await sqlite.execute(`CREATE TABLE IF NOT EXISTS sessions (\n token TEXT PRIMARY KEY,\n userId INTEGER NOT NULL REFERENCES users(id) ON DELETE CASCADE,\n createdAt INTEGER NOT NULL\n )`);\n}\n\nexport async function createUser(\n email: string,\n passwordHash: string,\n): Promise {\n const res = await sqlite.execute({\n sql: \"INSERT INTO users (email, passwordHash, createdAt) VALUES (?, ?, ?)\",\n args: [email, passwordHash, Date.now()],\n });\n const id = Number(res.lastInsertRowid);\n return { id, email, passwordHash, createdAt: Date.now() };\n}\n\nexport async function findUserByEmail(email: string): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT id, email, passwordHash, createdAt FROM users WHERE email = ?\",\n args: [email],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n id: row.id as number,\n email: row.email as string,\n passwordHash: row.passwordHash as string,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function findUserById(id: number): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT id, email, passwordHash, createdAt FROM users WHERE id = ?\",\n args: [id],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n id: row.id as number,\n email: row.email as string,\n passwordHash: row.passwordHash as string,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function createSession(\n token: string,\n userId: number,\n): Promise {\n await sqlite.execute({\n sql: \"INSERT INTO sessions (token, userId, createdAt) VALUES (?, ?, ?)\",\n args: [token, userId, Date.now()],\n });\n}\n\nexport async function findSession(\n token: string,\n): Promise {\n const res = await sqlite.execute({\n sql: \"SELECT token, userId, createdAt FROM sessions WHERE token = ?\",\n args: [token],\n });\n const row = res.rows[0] as Record | undefined;\n if (!row) return null;\n return {\n token: row.token as string,\n userId: row.userId as number,\n createdAt: row.createdAt as number,\n };\n}\n\nexport async function deleteSession(token: string): Promise {\n await sqlite.execute({\n sql: \"DELETE FROM sessions WHERE token = ?\",\n args: [token],\n });\n}\n",[],[67,97],"7c95e742-1d59-467e-b1f7-289effbf1692",["D",1788403044901],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Sambkw sample website with working email+password authentication","imageUrl","userId","c1f94b8c-4441-434e-8b7b-3ee79bd9e8f8","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount","orgId","01a0651e-7b41-76ac-a4dd-a5dbdd5a1174","tursoName","7c95e7421d59467eb1f7289effbf1692","tursoHostname","7c95e7421d59467eb1f7289effbf1692-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789533091345],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_158":19},"org",{"_11":12,"_153":19,"_154":19,"_113":114,"_155":156,"_157":55},"branch",{"_17":61,"_13":16,"_35":42,"_145":103,"_146":-5,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":14,"_152":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_35":103,"_13":14,"_47":208,"_105":-5,"_106":55,"_107":108,"_109":108,"_110":111,"_112":-5,"_113":114,"_115":39,"_116":46,"_117":-5,"_118":-5,"_119":63,"_120":121,"_122":123,"_124":125,"_126":209,"_128":-5,"_129":130,"_131":130,"_132":133,"_134":133,"_135":133,"_136":130,"_137":130,"_138":210,"_140":211,"_142":212,"_144":55},[193,196,197],"files",[193,194,195,196,197],"counts",{"_183":63,"_184":185,"_186":63,"_31":187,"_188":189},[177,178,179],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":70,"_17":63,"_50":71,"_52":-5,"_54":55,"_56":-5,"_18":182},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":62,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_18":181},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":48,"_17":49,"_50":51,"_52":53,"_54":55,"_56":14,"_18":180},[37],[59],[67],"pulls","branches",1,"forks",{"_190":185,"_192":63},"connections",{"_190":63,"_191":63},"count","unfilledCount","emptyCount",{"_35":66,"_13":67,"_38":68,"_40":-5,"_41":42,"_43":69,"_45":46,"_47":83,"_17":63,"_50":71,"_52":-5,"_54":55,"_56":-5,"_77":206,"_18":207},{"_35":96,"_13":97,"_38":98,"_40":68,"_41":42,"_43":49,"_45":46,"_47":99,"_17":63,"_50":92,"_52":100,"_54":55,"_56":-5,"_77":204,"_18":205},{"_35":88,"_13":89,"_38":90,"_40":68,"_41":42,"_43":69,"_45":46,"_47":91,"_17":63,"_50":92,"_52":93,"_54":55,"_56":-5,"_77":202,"_18":203},{"_35":58,"_13":59,"_38":60,"_40":-5,"_41":42,"_43":61,"_45":46,"_47":80,"_17":63,"_50":24,"_52":64,"_54":55,"_56":-5,"_77":200,"_18":201},{"_35":36,"_13":37,"_38":39,"_40":-5,"_41":42,"_43":44,"_45":46,"_47":76,"_17":49,"_50":51,"_52":53,"_54":55,"_56":14,"_77":198,"_18":199},[],[37],[],[59],[],[67,89],[],[67,97],[194,195],[67],["D",1788403044901],["D",1789533091345],{"_11":12,"_158":19},{"_11":12,"_153":19,"_154":19,"_113":114,"_155":156,"_157":55},{"_17":61,"_13":16,"_35":42,"_145":103,"_146":-5,"_147":-5,"_148":-5,"_149":-5,"_150":-5,"_151":14,"_152":12},"ctx",{"_138":-5,"_174":246,"_247":248,"_249":250,"_251":55,"_252":55,"_253":55,"_254":46,"_255":-5,"_256":-7,"_257":-7,"_258":63,"_259":55,"_260":55,"_261":-5,"_262":55,"_263":55,"_264":55,"_265":-5},"ENV",{"_217":218,"_219":220,"_221":16,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239,"_240":241,"_242":243,"_244":245},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]