[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_154":155,"_156":157},"routes/_app.x.$handle.$name",{"_95":94,"_32":45,"_104":85,"_27":53,"_13":14,"_105":-5,"_11":106,"_107":108,"_109":110,"_111":112,"_113":114,"_20":-5,"_115":-5,"_116":-5,"_117":25,"_118":119,"_120":121,"_122":-5,"_123":-5,"_124":125},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_43":44,"_32":45,"_38":46,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":78,"_79":80,"_81":82,"_83":25},"version",10,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":23,"_24":25,"_26":25,"_27":28,"_29":28},"file",{"_30":31,"_32":28,"_33":34,"_35":37,"_38":39,"_40":14,"_41":42,"_24":25},"previous",{"_30":31,"_32":28,"_33":34,"_35":36},"deleted",false,"deletedHere","path","main.ts","latestPath","fileId","741c2a60-76e9-11f1-ad70-1607ee4eb77e","name","fileType","http","content","/**\n * ESCAPE ROOM — CHALLENGE 5 API\n * Paste this whole file into a Val Town HTTP trigger.\n *\n * HOW IT WORKS (escalating validation, one wrong-thing-at-a-time):\n * 1. Wrong HTTP method -> 405\n * 2. POST with missing headers -> 400, lists which headers are missing\n * (this now includes \"authorization\" alongside your other headers)\n * 3. Right headers, wrong values -> 403 (doesn't say what the right value is)\n * 4. Authorization not a Bearer JWT -> 400\n * 5. JWT payload's \"tenantid\" claim doesn't match EXPECTED_TENANT_ID -> 403\n * 6. Right headers, missing body -> 422, lists which fields are missing\n * 7. Right headers + body, wrong values -> 422\n * 8. Everything correct -> 200, decoy JSON body, REAL CODE hidden\n * in the \"X-Debug-Trace\" response header (players must check headers,\n * not just the body — mirrors your color-camouflage letter challenge).\n *\n * SECURITY NOTE — read before the event:\n * Do NOT paste a real production JWT (or any token tied to a real account/\n * tenant) into this file or into anything players will see. This val is\n * public. The demo token below is 100% fake — a hand-built header.payload.\n * signature string with a made-up signature — it decodes fine but isn't\n * signed by anything real. Keep it that way: fabricate the puzzle's JWT,\n * don't repurpose a live one.\n *\n * CUSTOMIZE BEFORE THE OFFSITE — edit the CONFIG block below:\n * - EXACT_MATCH_HEADERS: header name -> expected value.\n * - EXPECTED_TENANT_ID: the \"tenantid\" claim players' JWT must decode to.\n * - REQUIRED_BODY_FIELDS: JSON field name -> expected value.\n * - SECRET_CODE: the letter/fragment this challenge contributes to the\n * final password.\n */\n\nfunction base64UrlDecode(segment: string): string {\n const base64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = base64.padEnd(\n base64.length + ((4 - (base64.length % 4)) % 4),\n \"=\",\n );\n return atob(padded);\n}\n\nexport default async function (req: Request): Promise {\n // ---------------- CONFIG: edit these ----------------\n const EXACT_MATCH_HEADERS: Record = {\n \"x-tenant-id\": \"vinci_admin\",\n };\n const EXPECTED_TENANT_ID = \"vinci_admin\"; // must match the JWT's \"tenantid\" claim\n const REQUIRED_BODY_FIELDS: Record = {\n codename: \"nightfall\",\n extraction_point: \"tel-aviv\",\n };\n const SECRET_CODE = \"N\";\n // ------------------------------------------------------\n\n // 1. Method check\n if (req.method !== \"POST\") {\n return Response.json(\n {\n error: \"Method Not Allowed\",\n detail: \"This method is not authorized.\",\n },\n { status: 405 },\n );\n }\n\n // 2. Header presence check (exact-match headers + authorization)\n const requiredHeaderNames = [\n ...Object.keys(EXACT_MATCH_HEADERS),\n \"authorization\",\n ];\n const missingHeaders = requiredHeaderNames.filter((h) => !req.headers.has(h));\n if (missingHeaders.length > 0) {\n return Response.json(\n {\n error: \"Bad Request\",\n detail: \"Missing required header(s).\",\n missing_headers: missingHeaders,\n },\n { status: 400 },\n );\n }\n\n // 3. Exact-match header value check (wrong values -> reject, don't reveal the answer)\n const invalidHeaders = Object.entries(EXACT_MATCH_HEADERS)\n .filter(([key, expected]) =>\n req.headers.get(key)?.toLowerCase() !== expected.toLowerCase()\n )\n .map(([key]) => key);\n if (invalidHeaders.length > 0) {\n return Response.json(\n {\n error: \"Forbidden\",\n detail: \"One or more header values were rejected by clearance control.\",\n invalid_headers: invalidHeaders,\n },\n { status: 403 },\n );\n }\n\n // 4. Authorization must be \"Bearer \" with 3 dot-separated segments\n const authHeader = req.headers.get(\"authorization\") ?? \"\";\n const bearerMatch = authHeader.match(/^Bearer\\s+(.+)$/i);\n const token = bearerMatch?.[1];\n const segments = token?.split(\".\") ?? [];\n if (!bearerMatch || segments.length !== 3) {\n return Response.json(\n {\n error: \"Bad Request\",\n detail:\n \"Authorization header must be a Bearer token in JWT format (header.payload.signature).\",\n },\n { status: 400 },\n );\n }\n\n // 5. Decode the JWT payload and check the \"tenantid\" claim\n let payload: Record;\n try {\n payload = JSON.parse(base64UrlDecode(segments[1]));\n } catch {\n return Response.json(\n {\n error: \"Bad Request\",\n detail:\n \"Could not decode the JWT payload. Is it valid base64url-encoded JSON?\",\n },\n { status: 400 },\n );\n }\n if (payload.tenantid !== EXPECTED_TENANT_ID) {\n return Response.json(\n {\n error: \"Forbidden\",\n detail: \"Token tenant does not match the required tenant.\",\n },\n { status: 403 },\n );\n }\n\n // 6. Body must be valid JSON\n let body: Record;\n try {\n body = await req.json();\n } catch {\n return Response.json(\n { error: \"Bad Request\", detail: \"Request body must be valid JSON.\" },\n { status: 400 },\n );\n }\n\n // 7. Body field presence check\n const missingFields = Object.keys(REQUIRED_BODY_FIELDS).filter(\n (f) => !(f in body),\n );\n if (missingFields.length > 0) {\n return Response.json(\n {\n error: \"Unprocessable Entity\",\n detail: \"Missing required field(s) in body.\",\n missing_fields: missingFields,\n },\n { status: 422 },\n );\n }\n\n // 8. Body field value check\n const invalidFields = Object.entries(REQUIRED_BODY_FIELDS)\n .filter(([key, expected]) =>\n String(body[key]).toLowerCase() !== expected.toLowerCase()\n )\n .map(([key]) => key);\n if (invalidFields.length > 0) {\n return Response.json(\n {\n error: \"Unprocessable Entity\",\n detail: \"One or more field values were rejected.\",\n invalid_fields: invalidFields,\n },\n { status: 422 },\n );\n }\n\n // 9. Success — decoy in the body, real code hidden in a response header\n return Response.json(\n {\n status: \"ACCESS GRANTED\",\n access_log: \"handshake complete\",\n code: \"XX-REDACTED-XX\",\n note: \"Transmission received. Await further instructions.\",\n },\n {\n status: 200,\n headers: {\n \"X-Debug-Trace\": SECRET_CODE,\n },\n },\n );\n}\n\n/**\n * The handler above never hardcodes an expected token — it decodes whatever\n * JWT the request actually sends and only checks the \"tenantid\" claim. Any\n * self-generated JWT (built by hand, via jwt.io, a script, whatever) that\n * decodes to a payload containing \"tenantid\": \"vinci_admin\" will pass,\n * regardless of its other claims or signature.\n *\n * FOR TESTING ONLY — this is a throwaway example JWT, not something to hand\n * to players or leave in any player-facing material. It decodes to\n * {\"tenantid\":\"vinci_admin\",\"agent\":\"unknown\",\"exp\":4102444800} and its\n * signature segment is made-up text (this val never verifies signatures).\n * eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\n */\n\n/**\n * TEST PROGRESSION (run these yourself before the event):\n *\n * 1) GET -> 405\n * curl -i https://yourname-challenge5.web.val.run\n *\n * 2) POST, no headers -> 400 missing_headers (includes \"authorization\")\n * curl -i -X POST https://yourname-challenge5.web.val.run\n *\n * 3) POST, headers present but wrong -> 403\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: wrong\" -H \"x-clearance-level: wrong\" \\\n * -H \"Authorization: Bearer x.y.z\"\n *\n * 4) POST, correct exact-match headers, malformed Authorization -> 400\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: not-a-bearer-token\"\n *\n * 5) POST, well-formed but wrong-tenant JWT -> 403\n * (swap in any JWT whose payload's tenantid isn't \"vinci_admin\")\n *\n * 6) POST, correct headers + DEMO_JWT, no body -> 422 missing_fields\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\" \\\n * -H \"Content-Type: application/json\" -d \"{}\"\n *\n * 7) POST, everything correct -> 200, check response HEADERS for X-Debug-Trace\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\" \\\n * -H \"Content-Type: application/json\" \\\n * -d \"{\\\"codename\\\":\\\"nightfall\\\",\\\"extraction_point\\\":\\\"tel-aviv\\\"}\"\n */","/**\n * ESCAPE ROOM — CHALLENGE 5 API\n * Paste this whole file into a Val Town HTTP trigger.\n *\n * HOW IT WORKS (escalating validation, one wrong-thing-at-a-time):\n * 1. Wrong HTTP method -> 405\n * 2. POST with missing headers -> 400, lists which headers are missing\n * (this now includes \"authorization\" alongside your other headers)\n * 3. Right headers, wrong values -> 403 (doesn't say what the right value is)\n * 4. Authorization not a Bearer JWT -> 400\n * 5. JWT payload's \"tenantid\" claim doesn't match EXPECTED_TENANT_ID -> 403\n * 6. Right headers, missing body -> 422, lists which fields are missing\n * 7. Right headers + body, wrong values -> 422\n * 8. Everything correct -> 200, decoy JSON body, REAL CODE hidden\n * in the \"X-Debug-Trace\" response header (players must check headers,\n * not just the body — mirrors your color-camouflage letter challenge).\n *\n * SECURITY NOTE — read before the event:\n * Do NOT paste a real production JWT (or any token tied to a real account/\n * tenant) into this file or into anything players will see. This val is\n * public. The demo token below is 100% fake — a hand-built header.payload.\n * signature string with a made-up signature — it decodes fine but isn't\n * signed by anything real. Keep it that way: fabricate the puzzle's JWT,\n * don't repurpose a live one.\n *\n * CUSTOMIZE BEFORE THE OFFSITE — edit the CONFIG block below:\n * - EXACT_MATCH_HEADERS: header name -> expected value.\n * - EXPECTED_TENANT_ID: the \"tenantid\" claim players' JWT must decode to.\n * - REQUIRED_BODY_FIELDS: JSON field name -> expected value.\n * - SECRET_CODE: the letter/fragment this challenge contributes to the\n * final password.\n */\n\nfunction base64UrlDecode(segment: string): string {\n const base64 = segment.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = base64.padEnd(\n base64.length + ((4 - (base64.length % 4)) % 4),\n \"=\",\n );\n return atob(padded);\n}\n\nexport default async function (req: Request): Promise {\n // ---------------- CONFIG: edit these ----------------\n const EXACT_MATCH_HEADERS: Record = {\n \"x-tenant-id\": \"vinci_admin\",\n };\n const EXPECTED_TENANT_ID = \"vinci_admin\"; // must match the JWT's \"tenantid\" claim\n const REQUIRED_BODY_FIELDS: Record = {\n codename: \"nightfall\",\n extraction_point: \"tel-aviv\",\n };\n const SECRET_CODE = \"N\";\n // ------------------------------------------------------\n\n // 1. Method check\n if (req.method !== \"POST\") {\n return Response.json(\n {\n error: \"Method Not Allowed\",\n detail: \"This method is not authorized.\",\n },\n { status: 405 },\n );\n }\n\n // 2. Header presence check (exact-match headers + authorization)\n const requiredHeaderNames = [\n ...Object.keys(EXACT_MATCH_HEADERS),\n \"authorization\",\n ];\n const missingHeaders = requiredHeaderNames.filter((h) => !req.headers.has(h));\n if (missingHeaders.length > 0) {\n return Response.json(\n {\n error: \"Bad Request\",\n detail: \"Missing required header(s).\",\n missing_headers: missingHeaders,\n },\n { status: 400 },\n );\n }\n\n // 3. Exact-match header value check (wrong values -> reject, don't reveal the answer)\n const invalidHeaders = Object.entries(EXACT_MATCH_HEADERS)\n .filter(([key, expected]) =>\n req.headers.get(key)?.toLowerCase() !== expected.toLowerCase()\n )\n .map(([key]) => key);\n if (invalidHeaders.length > 0) {\n return Response.json(\n {\n error: \"Forbidden\",\n detail: \"One or more header values were rejected by clearance control.\",\n invalid_headers: invalidHeaders,\n },\n { status: 403 },\n );\n }\n\n // 4. Authorization must be \"Bearer \" with 3 dot-separated segments\n const authHeader = req.headers.get(\"authorization\") ?? \"\";\n const bearerMatch = authHeader.match(/^Bearer\\s+(.+)$/i);\n const token = bearerMatch?.[1];\n const segments = token?.split(\".\") ?? [];\n if (!bearerMatch || segments.length !== 3) {\n return Response.json(\n {\n error: \"Bad Request\",\n detail: \"Authorization header is not valid.\",\n },\n { status: 400 },\n );\n }\n\n // 5. Decode the JWT payload and check the \"tenantid\" claim\n let payload: Record;\n try {\n payload = JSON.parse(base64UrlDecode(segments[1]));\n } catch {\n return Response.json(\n {\n error: \"Bad Request\",\n detail:\n \"Could not decode the JWT payload. Is it valid base64url-encoded JSON?\",\n },\n { status: 400 },\n );\n }\n if (payload.tenantid !== EXPECTED_TENANT_ID) {\n return Response.json(\n {\n error: \"Forbidden\",\n detail: \"Token tenant does not match the required tenant.\",\n },\n { status: 403 },\n );\n }\n\n // 6. Body must be valid JSON\n let body: Record;\n try {\n body = await req.json();\n } catch {\n return Response.json(\n { error: \"Bad Request\", detail: \"Request body must be valid JSON.\" },\n { status: 400 },\n );\n }\n\n // 7. Body field presence check\n const missingFields = Object.keys(REQUIRED_BODY_FIELDS).filter(\n (f) => !(f in body),\n );\n if (missingFields.length > 0) {\n return Response.json(\n {\n error: \"Unprocessable Entity\",\n detail: \"Missing required field(s) in body.\",\n missing_fields: missingFields,\n },\n { status: 422 },\n );\n }\n\n // 8. Body field value check\n const invalidFields = Object.entries(REQUIRED_BODY_FIELDS)\n .filter(([key, expected]) =>\n String(body[key]).toLowerCase() !== expected.toLowerCase()\n )\n .map(([key]) => key);\n if (invalidFields.length > 0) {\n return Response.json(\n {\n error: \"Unprocessable Entity\",\n detail: \"One or more field values were rejected.\",\n invalid_fields: invalidFields,\n },\n { status: 422 },\n );\n }\n\n // 9. Success — decoy in the body, real code hidden in a response header\n return Response.json(\n {\n status: \"ACCESS GRANTED\",\n access_log: \"handshake complete\",\n code: \"XX-REDACTED-XX\",\n note: \"Transmission received. Await further instructions.\",\n },\n {\n status: 200,\n headers: {\n \"X-Debug-Trace\": SECRET_CODE,\n },\n },\n );\n}\n\n/**\n * The handler above never hardcodes an expected token — it decodes whatever\n * JWT the request actually sends and only checks the \"tenantid\" claim. Any\n * self-generated JWT (built by hand, via jwt.io, a script, whatever) that\n * decodes to a payload containing \"tenantid\": \"vinci_admin\" will pass,\n * regardless of its other claims or signature.\n *\n * FOR TESTING ONLY — this is a throwaway example JWT, not something to hand\n * to players or leave in any player-facing material. It decodes to\n * {\"tenantid\":\"vinci_admin\",\"agent\":\"unknown\",\"exp\":4102444800} and its\n * signature segment is made-up text (this val never verifies signatures).\n * eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\n */\n\n/**\n * TEST PROGRESSION (run these yourself before the event):\n *\n * 1) GET -> 405\n * curl -i https://yourname-challenge5.web.val.run\n *\n * 2) POST, no headers -> 400 missing_headers (includes \"authorization\")\n * curl -i -X POST https://yourname-challenge5.web.val.run\n *\n * 3) POST, headers present but wrong -> 403\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: wrong\" -H \"x-clearance-level: wrong\" \\\n * -H \"Authorization: Bearer x.y.z\"\n *\n * 4) POST, correct exact-match headers, malformed Authorization -> 400\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: not-a-bearer-token\"\n *\n * 5) POST, well-formed but wrong-tenant JWT -> 403\n * (swap in any JWT whose payload's tenantid isn't \"vinci_admin\")\n *\n * 6) POST, correct headers + DEMO_JWT, no body -> 422 missing_fields\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\" \\\n * -H \"Content-Type: application/json\" -d \"{}\"\n *\n * 7) POST, everything correct -> 200, check response HEADERS for X-Debug-Trace\n * curl -i -X POST https://yourname-challenge5.web.val.run \\\n * -H \"x-tenant-id: vinci_admin\" -H \"x-clearance-level: kidon\" \\\n * -H \"Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ0ZW5hbnRpZCI6InZpbmNpX2FkbWluIiwiYWdlbnQiOiJ1bmtub3duIiwiZXhwIjo0MTAyNDQ0ODAwfQ.bm90LWEtcmVhbC1zaWduYXR1cmUtdGhpcy1pcy1hLXB1enpsZS1wcm9w\" \\\n * -H \"Content-Type: application/json\" \\\n * -d \"{\\\"codename\\\":\\\"nightfall\\\",\\\"extraction_point\\\":\\\"tel-aviv\\\"}\"\n */","createdAt",["D",1783099783674],"branchVersion","branchId","045e2be1-6190-4028-b2d6-73609433dbfe","id","c123a9d5-9817-4fcf-af90-b88129188604","shubi-dubi-super-secret-much-shhh",["D",1783088047239],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","","imageUrl","67b552b0-2d07-454c-912f-674e739e7415","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","019f268e-fb04-734c-9895-0e3eed575c15","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_95":94,"_103":99},"org",{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},"branch",{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"isOwned",13,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","roiavram","handle","displayName","רועי אברם","avatar","https://lh3.googleusercontent.com/a/ACg8ocJTid4OXMGbRCHwuc_7fWMC9Y8vqaalbiWrhcuqGYfk3jOyudIbRg=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","adoptOrgId",{"_43":44,"_32":45,"_38":150,"_47":-5,"_48":25,"_49":50,"_51":50,"_52":53,"_54":-5,"_18":55,"_56":-5,"_57":25,"_58":-5,"_59":-5,"_60":61,"_62":63,"_64":-5,"_65":-5,"_66":-5,"_67":-5,"_68":69,"_70":69,"_71":72,"_73":72,"_74":72,"_75":69,"_76":69,"_77":151,"_79":152,"_81":153,"_83":25},"tree",[145],"files",[145],"counts",{"_134":61,"_135":136,"_137":61,"_138":139,"_140":141},"contents",[126],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles",true,"grants","orgs","customDomains",{},{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":130,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_27":133},"1adf4553-5c63-4a5f-a680-14da30d88965","parentId","latest",["D",1783099783674],9,"label",[28],"pulls","branches",1,"forks","envVars",{"_142":61,"_144":61},"connections",{"_142":61,"_143":61},"count","unfilledCount","emptyCount",{"_43":127,"_32":28,"_30":31,"_128":-5,"_41":42,"_40":14,"_129":25,"_38":146,"_13":131,"_33":34,"_35":37,"_24":25,"_132":-5,"_147":148,"_27":149},["D",1783099783674],"children",[],[28],["D",1783088047239],{"_95":94,"_103":99},{"_95":94,"_96":97,"_98":99,"_18":55,"_100":101,"_102":25},{"_13":84,"_32":85,"_43":42,"_86":44,"_87":-5,"_88":-5,"_89":-5,"_90":-5,"_91":-5,"_92":45,"_93":94},"ctx",{"_77":-5,"_123":187,"_188":189,"_190":191,"_192":25,"_193":25,"_194":25,"_195":121,"_196":-5,"_197":-7,"_198":-7,"_199":61,"_200":25,"_201":25,"_202":-5,"_203":25,"_204":25,"_205":25,"_206":-5},"ENV",{"_158":159,"_160":161,"_162":85,"_163":164,"_165":166,"_167":168,"_169":170,"_171":172,"_173":174,"_175":176,"_177":178,"_179":180,"_181":182,"_183":184,"_185":186},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v10