\n {conn.val_slug} and {conn.repo}\n

\n Source of truth: {source}. Branch: {conn.branch}.\n

\n Last sync: {conn.last_sync_at ?? \"never\"} - {conn.last_result ?? \"no result yet\"}\n

\n\n

\n \n \n

\n\n

Recent events

\n {events.length === 0 ?

No events yet.

: (\n \n \n \n \n \n \n \n \n \n {events.map((e) => (\n \n \n \n \n \n ))}\n \n

Time	Kind	Detail
{e.ts}	{e.kind}	{e.detail}

\n )}\n

\n );\n}\n",[],[251,243],"views","b8a6320f-99c6-4b7d-b12c-7d7d0187580f","Layout.tsx","fdef2796-66be-11f1-b28c-1607ee4eb77e",["D",1781310591315],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Layout({ title, children }: { title: string; children?: unknown }) {\n return (\n \n \n \n \n {title}\n \n \n \n

\n githubsync\n GitHub and Val Town, in sync\n

\n {children}\n

\n \n \n );\n}\n",[],[251,253],"2212350e-a506-48df-a227-ff033fd82052","Landing.tsx","00805520-66bf-11f1-8aa2-1607ee4eb77e",33,["D",1781354638184],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Landing() {\n return (\n

\n Connect a val to a GitHub repo. We keep them in sync.\n

\n Pick a val, pick a repo, pick which side is the source of truth. Pushes to the repo\n land in the val within seconds; edits to the val land in the repo as clean commits.\n

\n \n Sign in with Val Town\n \n

Sign in with Val Town (grants the API access we sync with)
Install the GitHub App on the repos you want to sync
Pick a val, a repo, and a direction - then connect a repo

\n );\n}\n",[],[251,260],"3e18a2f3-3274-49ce-9065-5a61ed4cb278","Dashboard.tsx","0ecf4bf4-66bf-11f1-bfe7-1607ee4eb77e",32,["D",1781354633103],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Connection } from \"../db.ts\";\n\nfunction ConnectionRow({ conn }: { conn: Connection }) {\n const arrow = conn.direction === \"github\" ? \"repo to val\" : \"val to repo\";\n return (\n \n \n {conn.val_slug}\n \n {conn.repo}\n {arrow}\n {conn.last_result ?? \"never synced\"}\n \n );\n}\n\nexport default function Dashboard(props: {\n username: string;\n vals: string[];\n valsError: string | null;\n connections: Connection[];\n appSlug: string | null;\n installations: { installation_id: number }[];\n}) {\n const { username, vals, valsError, connections, appSlug, installations } = props;\n return (\n

\n Signed in as {username}\n

\n \n

\n\n

Connections

\n {connections.length === 0\n ?

No connections yet.

\n : (\n \n \n \n \n \n \n \n \n \n \n {connections.map((conn) => )}\n \n

Val	Repo	Direction	Last sync

\n )}\n

\n\n

GitHub

\n \n Install the GitHub App\n {\" \"}\n on the repos you want to sync. You grant it Contents read/write; we never ask for a\n personal access token.\n

\n Installations: {installations.length === 0\n ? \"none yet\"\n : installations.map((i) => String(i.installation_id)).join(\", \")}\n

\n\n

Connect a repo

\n Val\n {valsError\n ?

Could not list your vals: {valsError}. Log out and back in.

\n : (\n \n )}\n

\n GitHub repo (owner/name)\n \n

\n Branch\n \n

\n Source of truth\n \n {\" \"}\n GitHub - pushes to the repo overwrite the val\n \n \n {\" \"}\n Val Town - edits to the val are committed to the repo\n \n

\n {installations.length > 0 && (\n

\n GitHub App installation\n \n \n {installations.map((i) => (\n \n ))}\n \n

\n )}\n

\n \n GitHub token (dev fallback - used instead of the GitHub App; needs Contents\n read/write on the repo)\n \n \n

\n \n

\n );\n}\n",[],[251,268],"5ef8c3f2-ec35-42b8-acec-e06fd75aa810",["D",1781310591315],[200,201,202,203],[251],["D",1781310557274],[],[18,80],["D",1781310546326],[],[18,65],["D",1781310546326],[197,198],[18],"4d27136a-704d-4edc-af40-711880a25e0f","webhook.ts","f2da73c4-66be-11f1-aae1-1607ee4eb77e","165a136c-f6d1-45c0-99f2-259223c2e53a",24,["D",1781354574722],"import { Hono } from \"npm:hono@4\";\nimport { connectionsForRepo, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { sharedApp } from \"../lib/app.ts\";\nimport { resolveSecret } from \"../lib/creds.ts\";\nimport { fullSync, incrementalSync } from \"../sync/ghToVal.ts\";\n\nasync function validSignature(\n secret: string,\n body: Uint8Array,\n sigHeader: string | null,\n): Promise {\n if (!sigHeader?.startsWith(\"sha256=\")) return false;\n const hex = sigHeader.slice(\"sha256=\".length);\n if (!/^[0-9a-f]{64}$/.test(hex)) return false;\n const sig = new Uint8Array(hex.match(/../g)!.map((b) => parseInt(b, 16)));\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n return await crypto.subtle.verify(\"HMAC\", key, sig, body); // timing-safe\n}\n\nconst webhook = new Hono();\n\nwebhook.post(\"/github\", async (c) => {\n const body = new Uint8Array(await c.req.arrayBuffer());\n const event = c.req.header(\"x-github-event\");\n if (event === \"ping\") return c.json({ ok: true, pong: true });\n if (event !== \"push\") return c.json({ ok: true, ignored: `event ${event}` });\n\n const payload = JSON.parse(new TextDecoder().decode(body));\n const repo = payload.repository?.full_name;\n if (!repo) return c.json({ ok: true, ignored: \"no repository in payload\" });\n\n const conns = await connectionsForRepo(repo, \"github\");\n if (conns.length === 0) return c.json({ ok: true, ignored: `no connections for ${repo}` });\n\n // Candidate secrets: each connection's repo-webhook secret (dev/PAT path) plus the\n // shared app's webhook secret (app installations deliver pushes via the app webhook).\n const sig = c.req.header(\"x-hub-signature-256\") ?? null;\n const secrets = conns.map((x) => resolveSecret(x.webhook_secret)).filter(Boolean) as string[];\n try {\n secrets.push(sharedApp().webhook_secret);\n } catch { /* shared app not configured; fall back to per-connection secrets */ }\n let verified = false;\n for (const s of secrets) {\n if (await validSignature(s, body, sig)) {\n verified = true;\n break;\n }\n }\n if (!verified) return c.text(\"bad signature\", 401);\n\n if (payload.deleted) return c.json({ ok: true, ignored: \"branch deletion\" });\n\n const results: Record = {};\n for (const conn of conns) {\n if (payload.ref !== `refs/heads/${conn.branch}`) {\n results[conn.id] = `ignored ref ${payload.ref} (only syncing ${conn.branch})`;\n continue;\n }\n try {\n // GitHub truncates the commits array at 20; force pushes rewrite history.\n const needFull = payload.forced || payload.commits.length >= 20;\n const r = needFull ? await fullSync(conn, payload.after) : await incrementalSync(conn, payload);\n await updateSyncResult(conn.id, `${needFull ? \"full\" : \"incremental\"} sync: ${r.length} files`);\n await recordEvent(\n conn.id,\n \"push\",\n JSON.stringify({ after: payload.after?.slice(0, 7), results: r }),\n );\n results[conn.id] = r;\n } catch (e) {\n await updateSyncResult(conn.id, `error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n results[conn.id] = `error: ${e.message}`;\n }\n }\n console.log(`push ${payload.after?.slice(0, 7)} to ${repo}:`, results);\n return c.json({ ok: true, results });\n});\n\nexport default webhook;\n",[],[297,289],"routes","c6d37e26-5fc7-4645-86c0-2e693a713ef0","githubApp.tsx","26503bda-66bf-11f1-8863-1607ee4eb77e",25,["D",1781354593536],"/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport { insertApp, insertInstallation } from \"../db.ts\";\nimport { installUrl, sharedApp } from \"../lib/app.ts\";\nimport { devAuthorized } from \"../lib/creds.ts\";\n\nconst githubApp = new Hono();\n\n// Normal user path: install the ONE shared GitHub App on the repos you want to sync.\n// `state` is optional and round-trips back to /github/setup after install.\ngithubApp.get(\"/install\", (c) => {\n const state = c.req.query(\"state\") ?? undefined;\n return c.redirect(installUrl(state));\n});\n\n// Post-install redirect carries the installation id; tie it to the shared app.\ngithubApp.get(\"/setup\", async (c) => {\n const installationId = Number(c.req.query(\"installation_id\") || 0);\n if (installationId) {\n await insertInstallation(installationId, sharedApp().app_id);\n }\n return c.redirect(\"/\");\n});\n\n// ---------------------------------------------------------------------------\n// Operator-only, one-time: create a NEW GitHub App via the manifest flow. This\n// is NOT part of the normal user path — users install the shared app instead.\n// Guarded by DEV_SECRET so it isn't reachable from the public dashboard. After\n// running it once, promote the resulting app's credentials into the GH_APP_*\n// env vars (which are the single source of truth) by hand.\n// ---------------------------------------------------------------------------\ngithubApp.get(\"/new-app\", (c) => {\n if (!devAuthorized(c.req.raw)) return c.text(\"unauthorized (operator-only route)\", 401);\n const origin = new URL(c.req.url).origin;\n const manifest = JSON.stringify({\n name: `valtown-sync-${crypto.randomUUID().slice(0, 6)}`,\n url: origin,\n hook_attributes: { url: `${origin}/webhook/github`, active: true },\n redirect_url: `${origin}/github/manifest-callback`,\n setup_url: `${origin}/github/setup`,\n public: false,\n default_events: [\"push\"],\n default_permissions: { contents: \"write\" },\n });\n // Returns a tiny auto-submitting form so the operator can POST the manifest.\n return c.html(\n \n \n \n \n ,\n );\n});\n\ngithubApp.get(\"/manifest-callback\", async (c) => {\n const code = c.req.query(\"code\");\n if (!code) return c.text(\"missing code\", 400);\n const res = await fetch(`https://api.github.com/app-manifests/${code}/conversions`, {\n method: \"POST\",\n headers: { Accept: \"application/vnd.github+json\", \"User-Agent\": \"githubsync-val\" },\n });\n if (!res.ok) return c.text(`manifest conversion failed: ${res.status} ${await res.text()}`, 500);\n const a = await res.json();\n const session = await getOAuthUserData(c.req.raw);\n // Stored in the DB for reference only; the GH_APP_* env vars remain the source\n // of truth. The operator must copy these into the env vars to promote the app.\n await insertApp({\n app_id: a.id,\n slug: a.slug,\n client_id: a.client_id,\n client_secret: a.client_secret,\n webhook_secret: a.webhook_secret,\n pem: a.pem,\n owner_user_id: session?.user?.id ?? null,\n });\n return c.text(\n `App created: id=${a.id} slug=${a.slug}. Promote these into the GH_APP_* env vars, ` +\n `then install via /github/install.`,\n );\n});\n\nexport default githubApp;\n",[],[297,299],"51d120f1-e985-4b8e-a0fd-9bb83af9c6d6","dev.ts","f85353de-66be-11f1-bdd6-1607ee4eb77e",9,["D",1781310582110],"import { Hono } from \"npm:hono@4\";\nimport { getConnection, insertConnection, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { devAuthorized, ghTokenFor, resolveSecret } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\n\n// Dev-mode API: create a connection without the browser OAuth + GitHub App flow.\n// Auth: Authorization: Bearer . Tokens may be passed as \"env:NAME\" to\n// resolve from this val's environment so they never land in the database.\nconst dev = new Hono();\n\ndev.post(\"/connect\", async (c) => {\n if (!devAuthorized(c.req.raw)) return c.text(\"unauthorized\", 401);\n const b = await c.req.json();\n for (const field of [\"val\", \"repo\", \"direction\", \"vt_token\"]) {\n if (!b[field]) return c.json({ error: `missing ${field}` }, 400);\n }\n const vtToken = resolveSecret(b.vt_token);\n if (!vtToken) return c.json({ error: \"vt_token did not resolve\" }, 400);\n const valId = await getValId(vtToken, b.val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: \"dev\",\n val_id: valId,\n val_slug: b.val,\n repo: b.repo,\n branch: b.branch ?? \"main\",\n direction: b.direction,\n vt_token: b.vt_token,\n gh_token: b.gh_token ?? null,\n installation_id: b.installation_id ?? null,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n let hookId: number | null = null;\n if (b.direction === \"github\" && b.register_webhook !== false) {\n const url = `${new URL(c.req.url).origin}/webhook/github`;\n hookId = (await registerPushWebhook(await ghTokenFor(conn), b.repo, url, webhookSecret)).id;\n }\n\n let backfill: unknown;\n try {\n backfill = b.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n backfill = `error: ${e.message}`;\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.json({ id, hookId, backfill });\n});\n\nexport default dev;\n",[],[297,307],"c91b7956-89cf-4b95-bfe1-edc08c61b6c9","connections.tsx","2125abd6-66bf-11f1-a63a-1607ee4eb77e",15,["D",1781310650599],"/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport {\n deleteConnection,\n getConnection,\n insertConnection,\n recentEvents,\n recordEvent,\n updateSyncResult,\n} from \"../db.ts\";\nimport { devAuthorized, ghTokenFor } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\nimport Layout from \"../views/Layout.tsx\";\nimport Status from \"../views/Status.tsx\";\n\nconst connections = new Hono();\n\nasync function authorizedFor(c: any, connUserId: string): Promise {\n if (devAuthorized(c.req.raw)) return true;\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return false;\n return connUserId === \"dev\" || connUserId === session.user.id;\n}\n\n// Create a connection from the dashboard form.\nconnections.post(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/\");\n const form = await c.req.formData();\n const val = String(form.get(\"val\") ?? \"\");\n const repo = String(form.get(\"repo\") ?? \"\");\n const direction = String(form.get(\"direction\") ?? \"github\") as \"github\" | \"valtown\";\n const branch = String(form.get(\"branch\") || \"main\");\n const ghToken = String(form.get(\"gh_token\") ?? \"\");\n const installationId = Number(form.get(\"installation_id\") || 0) || null;\n\n const token = session.accessToken;\n const valId = await getValId(token, val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: session.user.id,\n val_id: valId,\n val_slug: val,\n repo,\n branch,\n direction,\n vt_token: token,\n gh_token: ghToken || null,\n installation_id: installationId,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n // App installations deliver pushes via the app-level webhook; a pasted token needs a repo hook.\n if (direction === \"github\" && ghToken) {\n await registerPushWebhook(\n await ghTokenFor(conn),\n repo,\n `${new URL(c.req.url).origin}/webhook/github`,\n webhookSecret,\n );\n }\n\n try {\n const backfill = direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.redirect(`/connections/${id}`);\n});\n\nconnections.get(\"/:id\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.redirect(\"/\");\n const events = await recentEvents(conn.id);\n return c.html(\n \n \n ,\n );\n});\n\nconnections.post(\"/:id/resync\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n let result: unknown;\n try {\n result = conn.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(conn.id, \"manual resync ok\");\n await recordEvent(conn.id, \"resync\", JSON.stringify(result));\n } catch (e) {\n result = `error: ${e.message}`;\n await updateSyncResult(conn.id, `resync error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n }\n if (devAuthorized(c.req.raw)) return c.json({ id: conn.id, result });\n return c.redirect(`/connections/${conn.id}`);\n});\n\nconnections.post(\"/:id/delete\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n await deleteConnection(conn.id);\n if (devAuthorized(c.req.raw)) return c.json({ deleted: conn.id });\n return c.redirect(\"/\");\n});\n\nexport default connections;\n",[],[297,315],"6a03e418-b02f-44a1-8e11-2ad90bc19cbf",8,["D",1781310572920],[192,193,194,195],[297],"d7918672-98d4-40bb-9cb1-0abbca6de573","valtown.ts","d6048f50-66be-11f1-8d6e-1607ee4eb77e","640e6044-ddfa-454d-bb57-f42fb8b69d43",4,["D",1781310524554],"const VT_API = \"https://api.val.town\";\n\nasync function vt(\n token: string,\n method: string,\n pathAndQuery: string,\n body?: unknown,\n): Promise {\n return await fetch(`${VT_API}${pathAndQuery}`, {\n method,\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n}\n\nasync function vtJson(token: string, method: string, pathAndQuery: string, body?: unknown) {\n const res = await vt(token, method, pathAndQuery, body);\n if (!res.ok) {\n throw new Error(\n `Val Town ${method} ${pathAndQuery} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.json();\n}\n\nexport async function getValId(token: string, slug: string): Promise {\n const [handle, name] = slug.split(\"/\");\n if (!handle || !name) throw new Error(`bad val slug: ${slug} (expected handle/name)`);\n return (await vtJson(token, \"GET\", `/v2/alias/vals/${handle}/${name}`)).id;\n}\n\nexport async function listMyVals(token: string): Promise {\n const slugs: string[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(token, \"GET\", `/v2/me/vals?limit=100&offset=${offset}`);\n for (const v of data) slugs.push(`${v.author.username}/${v.name}`);\n if (data.length < 100) break;\n }\n return slugs;\n}\n\nexport async function listValFiles(token: string, valId: string): Promise<{ path: string }[]> {\n const files: { path: string; type: string }[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(\n token,\n \"GET\",\n `/v2/vals/${valId}/files?path=&recursive=true&limit=100&offset=${offset}`,\n );\n files.push(...data);\n if (data.length < 100) break;\n }\n return files.filter((f) => f.type !== \"directory\");\n}\n\nexport async function readValFileBytes(\n token: string,\n valId: string,\n path: string,\n): Promise {\n const res = await vt(token, \"GET\", `/v2/vals/${valId}/files/content?path=${encodeURIComponent(path)}`);\n if (!res.ok) throw new Error(`Val Town read ${path} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\n// PUT updates an existing file; on 404 create it (and parent directories) with POST.\nexport async function upsertValFile(token: string, valId: string, path: string, content: string) {\n const q = `?path=${encodeURIComponent(path)}`;\n const put = await vt(token, \"PUT\", `/v2/vals/${valId}/files${q}`, { content });\n if (put.ok) return;\n if (put.status !== 404) throw new Error(`PUT ${path}: ${put.status} ${await put.text()}`);\n const parts = path.split(\"/\");\n for (let i = 1; i < parts.length; i++) {\n const dir = parts.slice(0, i).join(\"/\");\n await vt(token, \"POST\", `/v2/vals/${valId}/files?path=${encodeURIComponent(dir)}`, {\n type: \"directory\",\n });\n }\n const type = /\\.(ts|tsx|js|jsx)$/.test(path) ? \"script\" : \"file\";\n const post = await vt(token, \"POST\", `/v2/vals/${valId}/files${q}`, { content, type });\n if (!post.ok) throw new Error(`POST ${path}: ${post.status} ${await post.text()}`);\n}\n\nexport async function deleteValFile(token: string, valId: string, path: string) {\n const res = await vt(\n token,\n \"DELETE\",\n `/v2/vals/${valId}/files?path=${encodeURIComponent(path)}&recursive=false`,\n );\n if (!res.ok && res.status !== 404) {\n throw new Error(`DELETE ${path}: ${res.status} ${await res.text()}`);\n }\n}\n",[],[336,328],"lib","3e8cec39-311d-4c87-a4e1-ce28d00c5ab7","github.ts","cc420920-66be-11f1-86c9-1607ee4eb77e",3,["D",1781310508175],"import { createPrivateKey, createSign } from \"node:crypto\";\n\nconst GH_API = \"https://api.github.com\";\n\nexport async function gh(token: string, path: string, init: RequestInit = {}): Promise {\n const res = await fetch(`${GH_API}${path}`, {\n ...init,\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n \"Content-Type\": \"application/json\",\n \"X-GitHub-Api-Version\": \"2022-11-28\",\n \"User-Agent\": \"githubsync-val\",\n ...(init.headers ?? {}),\n },\n });\n if (!res.ok) {\n throw new Error(\n `GitHub ${init.method ?? \"GET\"} ${path} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.status === 204 ? null : res.json();\n}\n\nexport async function fetchRepoFile(\n token: string,\n repo: string,\n path: string,\n ref: string,\n): Promise {\n const encPath = path.split(\"/\").map(encodeURIComponent).join(\"/\");\n const res = await fetch(`${GH_API}/repos/${repo}/contents/${encPath}?ref=${ref}`, {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github.raw+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`GitHub file ${repo}/${path}@${ref} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\nexport async function fetchRepoTree(token: string, repo: string, ref: string): Promise {\n const tree = await gh(token, `/repos/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`);\n if (tree.truncated) throw new Error(\"Repo tree truncated - repo too large for full sync\");\n return tree.tree\n .filter((e: { type: string }) => e.type === \"blob\")\n .map((e: { path: string }) => e.path);\n}\n\nexport async function registerPushWebhook(token: string, repo: string, url: string, secret: string) {\n return await gh(token, `/repos/${repo}/hooks`, {\n method: \"POST\",\n body: JSON.stringify({\n name: \"web\",\n active: true,\n events: [\"push\"],\n config: { url, content_type: \"json\", secret },\n }),\n });\n}\n\n// sha1(\"blob \\0\" + bytes) — git blob sha, computed locally for diffing\nexport async function gitBlobSha(bytes: Uint8Array): Promise {\n const header = new TextEncoder().encode(`blob ${bytes.length}\\0`);\n const buf = new Uint8Array(header.length + bytes.length);\n buf.set(header);\n buf.set(bytes, header.length);\n const digest = await crypto.subtle.digest(\"SHA-1\", buf);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n for (let i = 0; i < bytes.length; i += 0x8000) {\n bin += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n }\n return btoa(bin);\n}\n\nfunction b64url(input: string | Uint8Array): string {\n const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\n// GitHub App JWT. The manifest-conversion pem is PKCS#1; node:crypto accepts it as-is.\nexport function appJwt(appId: number | string, pem: string): string {\n const nowSec = Math.floor(Date.now() / 1000);\n const header = b64url(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" }));\n const payload = b64url(JSON.stringify({ iat: nowSec - 60, exp: nowSec + 540, iss: String(appId) }));\n const signer = createSign(\"RSA-SHA256\");\n signer.update(`${header}.${payload}`);\n const sig = signer.sign(createPrivateKey(pem));\n return `${header}.${payload}.${b64url(new Uint8Array(sig))}`;\n}\n\nexport async function installationToken(\n app: { app_id: number; pem: string },\n installationId: number,\n): Promise {\n const jwt = appJwt(app.app_id, app.pem);\n const res = await fetch(`${GH_API}/app/installations/${installationId}/access_tokens`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${jwt}`,\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`installation token -> ${res.status}: ${await res.text()}`);\n return (await res.json()).token;\n}\n",[],[336,338],"aa825a9f-69c9-4948-8afd-54a51acafe08","creds.ts","d8b32ad6-66be-11f1-82b8-1607ee4eb77e",22,["D",1781354566309],"import { type Connection } from \"../db.ts\";\nimport { sharedApp } from \"./app.ts\";\nimport { installationToken } from \"./github.ts\";\n\n// Secrets stored as \"env:NAME\" resolve from this val's environment at use time,\n// so dev-mode tokens never live in the database.\nexport function resolveSecret(v: string | null | undefined): string | undefined {\n if (!v) return undefined;\n return v.startsWith(\"env:\") ? Deno.env.get(v.slice(4)) : v;\n}\n\nexport function vtTokenFor(conn: Connection): string {\n const t = resolveSecret(conn.vt_token);\n if (!t) throw new Error(`connection ${conn.id}: missing Val Town token`);\n return t;\n}\n\nexport async function ghTokenFor(conn: Connection): Promise {\n const pat = resolveSecret(conn.gh_token);\n if (pat) return pat;\n if (conn.installation_id) {\n return await installationToken(sharedApp(), conn.installation_id);\n }\n throw new Error(`connection ${conn.id}: no GitHub credential`);\n}\n\nexport function devAuthorized(req: Request): boolean {\n const secret = Deno.env.get(\"DEV_SECRET\");\n return !!secret && req.headers.get(\"authorization\") === `Bearer ${secret}`;\n}\n",[],[336,346],"11388e0a-e238-4fc5-afbf-31da76112b59","app.ts","5d52c18c-6725-11f1-8a46-1607ee4eb77e",20,["D",1781354560229],"// The shared GitHub App is the single source of truth, configured via env vars.\n// Users INSTALL this one app on their repos; nobody creates their own app.\n// The per-app `apps` SQLite table is no longer the user-creation target — see\n// routes/githubApp.tsx for the (operator-only) legacy manifest-create path.\n\nexport type SharedApp = {\n app_id: number;\n slug: string;\n client_id: string;\n client_secret: string;\n webhook_secret: string;\n pem: string;\n};\n\nfunction reqEnv(key: string): string {\n const v = Deno.env.get(key);\n if (!v) throw new Error(`missing env var ${key} (shared GitHub App is not configured)`);\n return v;\n}\n\n/** The single shared GitHub App, read from GH_APP_* env vars. */\nexport function sharedApp(): SharedApp {\n return {\n app_id: Number(reqEnv(\"GH_APP_ID\")),\n slug: reqEnv(\"GH_APP_SLUG\"),\n client_id: reqEnv(\"GH_APP_CLIENT_ID\"),\n client_secret: reqEnv(\"GH_APP_CLIENT_SECRET\"),\n webhook_secret: reqEnv(\"GH_APP_WEBHOOK_SECRET\"),\n pem: reqEnv(\"GH_APP_PEM\"),\n };\n}\n\n/** The install URL users are sent to. `state` is optional and round-tripped back to /github/setup. */\nexport function installUrl(state?: string): string {\n const slug = reqEnv(\"GH_APP_SLUG\");\n const base = `https://github.com/apps/${slug}/installations/new`;\n return state ? `${base}?state=${encodeURIComponent(state)}` : base;\n}\n",[],[336,354],"9c70151a-a2a2-4ce0-b510-626634ee1fe5",["D",1781310508175],[187,188,189,190],[336],["D",1781310279766],["D",1789509672838],{"_11":12,"_135":71},{"_11":12,"_131":-5,"_70":71,"_31":69,"_132":133,"_134":30},{"_40":122,"_13":16,"_34":37,"_123":84,"_124":-5,"_125":-5,"_126":-5,"_127":-5,"_128":-5,"_129":14,"_130":12},"ctx",{"_53":-5,"_154":403,"_404":405,"_406":407,"_408":30,"_409":30,"_410":30,"_411":24,"_412":-5,"_413":-7,"_414":-7,"_415":26,"_416":30,"_417":30,"_418":-5,"_419":30,"_420":30,"_421":30,"_422":-5},"ENV",{"_374":375,"_376":377,"_378":16,"_379":380,"_381":382,"_383":384,"_385":386,"_387":388,"_389":390,"_391":392,"_393":394,"_395":396,"_397":398,"_399":400,"_401":402},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

History · sync