[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_153":154,"_155":156},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_115":-5,"_20":116,"_22":117,"_118":119,"_120":121,"_25":122,"_24":-5,"_123":-5,"_124":-5,"_125":53,"_126":127,"_128":44,"_129":-5,"_130":-5,"_131":132},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","palomakop","name","avclub-rolodex","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":94,"_95":96,"_97":98,"_99":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","49d59cf2-a366-422b-a0db-fbab95e5d8dc","main.ts","fileId","eab87030-6135-11f1-9717-1607ee4eb77e","parentId","branchId","0326d693-b7fc-42b4-9c15-ac8fce34c7e2","branchVersion",18,"latest",true,"createdAt",["D",1780716875027],17,"fileType","http","content","import { sqlite } from \"https://esm.town/v/std/sqlite\";\nimport { SignJWT } from \"https://esm.sh/jose@5\";\n\nconst GHOST_URL = Deno.env.get(\"GHOST_URL\"); // e.g. https://yoursite.ghost.io — no trailing slash\nconst GHOST_ADMIN_KEY = Deno.env.get(\"GHOST_ADMIN_KEY\"); // id:secret format from Ghost Admin > Integrations\nconst ADMIN_TOKEN = Deno.env.get(\"ADMIN_TOKEN\"); // any long random string you generate\nconst BUTTONDOWN_API_KEY = Deno.env.get(\"BUTTONDOWN_API_KEY\");\n\n// ---------------------------------------------------------------------------\n// DB setup\n// ---------------------------------------------------------------------------\n\nawait sqlite.execute(`\n CREATE TABLE IF NOT EXISTS addresses (\n member_uuid TEXT PRIMARY KEY,\n name TEXT,\n address1 TEXT,\n address2 TEXT,\n city TEXT,\n state TEXT,\n zip TEXT,\n country TEXT\n )\n`);\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction hexToBytes(hex) {\n const bytes = new Uint8Array(hex.length / 2);\n for (let i = 0; i < hex.length; i += 2) {\n bytes[i / 2] = parseInt(hex.slice(i, i + 2), 16);\n }\n return bytes;\n}\n\nfunction rowToAddress(row) {\n if (!row) return null;\n // sqlite returns rows as arrays; columns are in CREATE TABLE order:\n // member_uuid, name, address1, address2, city, state, zip, country\n const [member_uuid, name, address1, address2, city, state, zip, country] =\n row;\n return { member_uuid, name, address1, address2, city, state, zip, country };\n}\n\nfunction jsonResponse(data, status = 200, extraHeaders = {}) {\n return new Response(JSON.stringify(data), {\n status,\n headers: { \"Content-Type\": \"application/json\", ...extraHeaders },\n });\n}\n\n// ---------------------------------------------------------------------------\n// CORS\n// ---------------------------------------------------------------------------\n\nconst corsHeaders = {\n \"Access-Control-Allow-Origin\": GHOST_URL,\n \"Access-Control-Allow-Methods\": \"GET, POST, OPTIONS\",\n \"Access-Control-Allow-Headers\": \"Authorization, Content-Type\",\n};\n\n// ---------------------------------------------------------------------------\n// Ghost Admin JWT (HS256, generated server-side with jose)\n// ---------------------------------------------------------------------------\n\nasync function getGhostAdminToken() {\n const [id, secret] = GHOST_ADMIN_KEY.split(\":\");\n const keyBytes = hexToBytes(secret);\n return new SignJWT({})\n .setProtectedHeader({ alg: \"HS256\", kid: id })\n .setIssuedAt()\n .setExpirationTime(\"5m\")\n .setAudience(\"/admin/\")\n .sign(keyBytes);\n}\n\nasync function ghostAdminFetch(path) {\n const adminToken = await getGhostAdminToken();\n const response = await fetch(`${GHOST_URL}/ghost/api/admin/${path}`, {\n headers: { Authorization: `Ghost ${adminToken}` },\n });\n if (!response.ok) {\n throw new Error(`Ghost Admin API error: ${response.status} ${path}`);\n }\n return response.json();\n}\n\n// ---------------------------------------------------------------------------\n// Member JWT verification (RS512, Ghost-signed)\n// ---------------------------------------------------------------------------\n\nasync function verifyMemberToken(request) {\n const authHeader = request.headers.get(\"Authorization\");\n if (!authHeader?.startsWith(\"Bearer \")) return null;\n const token = authHeader.slice(7);\n\n const [headerB64, payloadB64, sigB64] = token.split(\".\");\n\n // Fetch JWKS and find the right key by kid\n const jwksRes = await fetch(`${GHOST_URL}/members/.well-known/jwks.json`);\n const jwks = await jwksRes.json();\n const header = JSON.parse(\n atob(headerB64.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n );\n const jwk = jwks.keys.find((k) => k.kid === header.kid);\n if (!jwk) return null;\n\n // Import key via Web Crypto directly — no key length restrictions\n const key = await crypto.subtle.importKey(\n \"jwk\",\n jwk,\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-512\" },\n false,\n [\"verify\"],\n );\n\n // Verify signature\n const sigBytes = Uint8Array.from(\n atob(sigB64.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n (c) => c.charCodeAt(0),\n );\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n const valid = await crypto.subtle.verify(\n \"RSASSA-PKCS1-v1_5\",\n key,\n sigBytes,\n data,\n );\n if (!valid) return null;\n\n // Decode and validate payload claims\n const payload = JSON.parse(\n atob(payloadB64.replace(/-/g, \"+\").replace(/_/g, \"/\")),\n );\n const now = Math.floor(Date.now() / 1000);\n if (payload.exp < now) return null;\n if (payload.iss !== `${GHOST_URL}/members/api`) return null;\n if (payload.aud !== `${GHOST_URL}/members/api`) return null;\n\n return payload.sub;\n}\n\n// ---------------------------------------------------------------------------\n// Ghost member lookup\n// ---------------------------------------------------------------------------\n\nasync function getMemberByEmail(email) {\n const data = await ghostAdminFetch(\n `members/?filter=email:'${encodeURIComponent(email)}'&include=tiers`,\n );\n return data.members?.[0] ?? null;\n}\n\nasync function getPhysicalMembers() {\n // Get all tiers, filter to ones starting with \"Physical Objects\"\n const tiersData = await ghostAdminFetch(\"tiers/?limit=all\");\n const physicalTiers = tiersData.tiers.filter((t) =>\n t.name.startsWith(\"Physical Objects\")\n );\n const tierIds = new Set(physicalTiers.map((t) => t.id));\n const tierMap = Object.fromEntries(physicalTiers.map((t) => [t.id, t.name]));\n\n // Paginate through all members\n let members = [];\n let page = 1;\n while (true) {\n const data = await ghostAdminFetch(\n `members/?limit=100&page=${page}&include=tiers`,\n );\n members = members.concat(data.members);\n if (data.meta.pagination.page >= data.meta.pagination.pages) break;\n page++;\n }\n\n // Filter to physical tier members\n return members\n .filter((m) => m.tiers?.some((t) => tierIds.has(t.id)))\n .map((m) => {\n const tier = m.tiers.find((t) => tierIds.has(t.id));\n return {\n uuid: m.id,\n email: m.email,\n name: m.name,\n tierName: tierMap[tier.id],\n };\n });\n}\n\n// ---------------------------------------------------------------------------\n// TSV export (UTF-16 LE with BOM, tab-delimited)\n// ---------------------------------------------------------------------------\n\nfunction toUTF16TSV(rows) {\n const tsv = rows.map((r) => r.join(\"\\t\")).join(\"\\n\");\n const buf = new ArrayBuffer(2 + tsv.length * 2);\n const view = new DataView(buf);\n view.setUint16(0, 0xfeff, true); // BOM\n for (let i = 0; i < tsv.length; i++) {\n view.setUint16(2 + i * 2, tsv.charCodeAt(i), true);\n }\n return new Uint8Array(buf);\n}\n\n// ---------------------------------------------------------------------------\n// Admin HTML\n// ---------------------------------------------------------------------------\n\nfunction adminHTML(members, addressRows, adminToken) {\n const addrMap = Object.fromEntries(\n addressRows.map((row) => {\n const a = rowToAddress(row);\n return [a.member_uuid, a];\n }),\n );\n\n const escape = (s) => (s || \"\").replace(/\"/g, \""\").replace(/ {\n const a = addrMap[m.uuid] || {};\n return `\n \n ${escape(m.email)}\n ${escape(m.tierName)}\n \n \n \n \n \n \n \n \n `;\n }).join(\"\");\n\n return `\n\n\n \n Member Addresses\n \n\n\n

Member Addresses

\n ⬇ Download TSV\n

\n \n \n \n \n \n \n \n \n ${tableRows}\n

Email	Tier	Name	Address	Address Line 2	City	State	Zip	Country

\n \n\n`;\n}\n\n// ---------------------------------------------------------------------------\n// Buttondown newsletter helpers\n// ---------------------------------------------------------------------------\n\nasync function getButtondownSubscriber(email) {\n const res = await fetch(\n `https://api.buttondown.email/v1/subscribers/${encodeURIComponent(email)}`,\n { headers: { Authorization: `Token ${BUTTONDOWN_API_KEY}` } },\n );\n if (res.status === 404) return null;\n if (!res.ok) throw new Error(`Buttondown error: ${res.status}`);\n return res.json();\n}\n\nasync function subscribeToButtondown(email) {\n const existing = await getButtondownSubscriber(email);\n if (existing && existing.type === \"unsubscribed\") {\n // Use bulk resubscribe action for previously unsubscribed subscribers\n const res = await fetch(\"https://api.buttondown.email/v1/bulk-actions\", {\n method: \"POST\",\n headers: {\n Authorization: `Token ${BUTTONDOWN_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({\n action: \"resubscribe\",\n metadata: { ids: [existing.id] },\n }),\n });\n if (!res.ok) throw new Error(`Buttondown resubscribe error: ${res.status}`);\n return res.json();\n }\n // Create new subscriber (or existing with non-unsubscribed status)\n const res = await fetch(\"https://api.buttondown.email/v1/subscribers\", {\n method: \"POST\",\n headers: {\n Authorization: `Token ${BUTTONDOWN_API_KEY}`,\n \"Content-Type\": \"application/json\",\n },\n body: JSON.stringify({ email_address: email, type: \"regular\" }),\n });\n if (!res.ok) throw new Error(`Buttondown subscribe error: ${res.status}`);\n return res.json();\n}\n\n// ---------------------------------------------------------------------------\n// Main handler\n// ---------------------------------------------------------------------------\n\nexport default async function handler(request) {\n const url = new URL(request.url);\n const path = url.pathname;\n\n // Handle CORS preflight for member-facing endpoints\n if (request.method === \"OPTIONS\") {\n return new Response(null, { status: 204, headers: corsHeaders });\n }\n\n // -------------------------------------------------------------------------\n // Member-facing: GET /address — check + return current address\n // POST /address — upsert address\n // -------------------------------------------------------------------------\n\n if (path === \"/address\") {\n const email = await verifyMemberToken(request);\n if (!email) {\n return jsonResponse({ error: \"Unauthorized\" }, 401, corsHeaders);\n }\n\n const member = await getMemberByEmail(email);\n if (!member) {\n return jsonResponse({ error: \"Member not found\" }, 404, corsHeaders);\n }\n\n const memberUUID = member.id;\n\n if (request.method === \"GET\") {\n const result = await sqlite.execute({\n sql: \"SELECT * FROM addresses WHERE member_uuid = ?\",\n args: [memberUUID],\n });\n const address = result.rows.length ? rowToAddress(result.rows[0]) : null;\n return jsonResponse({ address }, 200, corsHeaders);\n }\n\n if (request.method === \"POST\") {\n const { name, address1, address2, city, state, zip, country } =\n await request.json();\n await sqlite.execute({\n sql:\n `INSERT INTO addresses (member_uuid, name, address1, address2, city, state, zip, country)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(member_uuid) DO UPDATE SET\n name = excluded.name,\n address1 = excluded.address1,\n address2 = excluded.address2,\n city = excluded.city,\n state = excluded.state,\n zip = excluded.zip,\n country = excluded.country`,\n args: [memberUUID, name, address1, address2, city, state, zip, country],\n });\n return jsonResponse({ success: true }, 200, corsHeaders);\n }\n\n return jsonResponse({ error: \"Method not allowed\" }, 405, corsHeaders);\n }\n\n // -------------------------------------------------------------------------\n // Admin: GET /admin — table UI + optional ?download=1 for TSV\n // POST /admin/save — upsert address by uuid\n // -------------------------------------------------------------------------\n\n if (path === \"/admin\" || path === \"/admin/save\") {\n if (url.searchParams.get(\"token\") !== ADMIN_TOKEN) {\n return new Response(\"Unauthorized\", { status: 401 });\n }\n\n // Save endpoint\n if (path === \"/admin/save\" && request.method === \"POST\") {\n const {\n member_uuid,\n name,\n address1,\n address2,\n city,\n state,\n zip,\n country,\n } = await request.json();\n await sqlite.execute({\n sql:\n `INSERT INTO addresses (member_uuid, name, address1, address2, city, state, zip, country)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)\n ON CONFLICT(member_uuid) DO UPDATE SET\n name = excluded.name,\n address1 = excluded.address1,\n address2 = excluded.address2,\n city = excluded.city,\n state = excluded.state,\n zip = excluded.zip,\n country = excluded.country`,\n args: [\n member_uuid,\n name,\n address1,\n address2,\n city,\n state,\n zip,\n country,\n ],\n });\n return jsonResponse({ success: true });\n }\n\n // Admin UI + TSV download\n if (path === \"/admin\" && request.method === \"GET\") {\n const members = await getPhysicalMembers();\n\n const addressResult = members.length\n ? await sqlite.execute({\n sql: `SELECT * FROM addresses WHERE member_uuid IN (${\n members.map(() => \"?\").join(\",\")\n })`,\n args: members.map((m) => m.uuid),\n })\n : { rows: [] };\n\n // TSV download\n if (url.searchParams.get(\"download\") === \"1\") {\n const addrMap = Object.fromEntries(\n addressResult.rows.map((row) => {\n const a = rowToAddress(row);\n return [a.member_uuid, a];\n }),\n );\n const header = [\n \"Email\",\n \"Name\",\n \"Address\",\n \"Address Line 2\",\n \"City\",\n \"State\",\n \"Zipcode\",\n \"Country\",\n \"Ounces\",\n \"Length\",\n \"Width\",\n \"Height\",\n \"Tier\",\n ];\n const rows = [\n header,\n ...members.map((m) => {\n const a = addrMap[m.uuid] || {};\n return [\n m.email,\n a.name || \"\",\n a.address1 || \"\",\n a.address2 || \"\",\n a.city || \"\",\n a.state || \"\",\n a.zip || \"\",\n a.country || \"\",\n \"\",\n \"\",\n \"\",\n \"\",\n m.tierName,\n ];\n }),\n ];\n const tsv = toUTF16TSV(rows);\n return new Response(tsv, {\n headers: {\n \"Content-Type\": \"text/tab-separated-values; charset=utf-16le\",\n \"Content-Disposition\": 'attachment; filename=\"addresses.txt\"',\n },\n });\n }\n\n // HTML table\n const html = adminHTML(members, addressResult.rows, ADMIN_TOKEN);\n return new Response(html, {\n headers: { \"Content-Type\": \"text/html; charset=utf-8\" },\n });\n }\n }\n\n // -------------------------------------------------------------------------\n // Newsletter: GET /newsletter — check Buttondown status\n // POST /newsletter — subscribe\n // -------------------------------------------------------------------------\n\n if (path === \"/newsletter\") {\n const email = await verifyMemberToken(request);\n if (!email) {\n return jsonResponse({ error: \"Unauthorized\" }, 401, corsHeaders);\n }\n\n if (request.method === \"GET\") {\n try {\n const subscriber = await getButtondownSubscriber(email);\n const subscribed = subscriber !== null && subscriber.type === \"regular\";\n return jsonResponse({ subscribed }, 200, corsHeaders);\n } catch (e) {\n return jsonResponse({ error: e.message }, 500, corsHeaders);\n }\n }\n\n if (request.method === \"POST\") {\n try {\n await subscribeToButtondown(email);\n return jsonResponse(\n { success: true, subscribed: true },\n 200,\n corsHeaders,\n );\n } catch (e) {\n return jsonResponse({ error: e.message }, 500, corsHeaders);\n }\n }\n }\n\n return new Response(\"Not found\", { status: 404 });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1780716875027],"children",[],[35],"b69e0fb2-de21-412f-b7f5-7e2fb4b6c395",["D",1780701962396],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","userId","78d840e0-15a9-11f0-a1b0-11dba95637f5","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","d9636d82-7655-4bde-8177-f99101e28946","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_114":110},"org",{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},"branch",{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://img.clerk.com/eyJ0eXBlIjoiZGVmYXVsdCIsImlpZCI6Imluc18yTm10cGhQUklwU0tqZHNiOHNnNGd2ZjJURFUiLCJyaWQiOiJ1c2VyXzJ2VzU0Y2Z5UkMzR2VjY0o4bjJZdkxwdW43RSIsImluaXRpYWxzIjoiUEsifQ","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":149,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":-5,"_70":71,"_72":-5,"_73":53,"_74":-5,"_75":-5,"_76":77,"_78":79,"_80":-5,"_81":-5,"_82":-5,"_83":-5,"_84":85,"_86":85,"_87":88,"_89":88,"_90":88,"_91":85,"_92":85,"_93":150,"_95":151,"_97":152,"_99":53},[146],"files",[146],"counts",{"_135":77,"_136":137,"_138":77,"_31":139,"_140":141},[133],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":134},[35],"pulls","branches",1,"forks",{"_142":144,"_145":77},"connections",{"_142":77,"_143":77},"count","unfilledCount",4,"emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":147,"_18":148},[],[35],["D",1780701962396],{"_11":12,"_114":110},{"_11":12,"_108":-5,"_109":110,"_70":71,"_111":112,"_113":53},{"_17":42,"_13":16,"_33":40,"_100":61,"_101":-5,"_102":-5,"_103":-5,"_104":-5,"_105":-5,"_106":14,"_107":12},"ctx",{"_93":-5,"_130":186,"_187":188,"_189":190,"_191":53,"_192":53,"_193":53,"_194":44,"_195":-5,"_196":-7,"_197":-7,"_198":77,"_199":53,"_200":53,"_201":-5,"_202":53,"_203":53,"_204":53,"_205":-5},"ENV",{"_157":158,"_159":160,"_161":16,"_162":163,"_164":165,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]