[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_326":327,"_328":329},"routes/_app.x.$handle.$name",{"_99":98,"_31":44,"_107":89,"_26":108,"_13":14,"_109":-5,"_11":110,"_111":112,"_113":114,"_115":116,"_117":118,"_20":-5,"_119":-5,"_120":-5,"_121":24,"_122":123,"_124":24,"_125":-5,"_126":-5,"_127":128},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":-5,"_18":-5},"project",{"_42":43,"_31":44,"_37":45,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":82,"_83":84,"_85":86,"_87":24},"version",15,"changes",[19],"aiChatInfo","userId",{"_20":21,"_22":-7,"_23":24,"_25":24,"_26":27,"_28":27},"file",{"_29":30,"_31":32,"_33":34,"_35":36,"_37":38,"_39":14,"_40":41,"_23":24},"previous","deleted",false,"deletedHere","path","routes/connections.tsx","latestPath","fileId","2125abd6-66bf-11f1-a63a-1607ee4eb77e","name","connections.tsx","fileType","script","content","/** @jsxImportSource npm:hono@4/jsx */\nimport { Hono } from \"npm:hono@4\";\nimport { getOAuthUserData } from \"https://esm.town/v/std/oauth/middleware.ts\";\nimport {\n deleteConnection,\n getConnection,\n insertConnection,\n recentEvents,\n recordEvent,\n updateSyncResult,\n} from \"../db.ts\";\nimport { devAuthorized, ghTokenFor } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\nimport Layout from \"../views/Layout.tsx\";\nimport Status from \"../views/Status.tsx\";\n\nconst connections = new Hono();\n\nasync function authorizedFor(c: any, connUserId: string): Promise {\n if (devAuthorized(c.req.raw)) return true;\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return false;\n return connUserId === \"dev\" || connUserId === session.user.id;\n}\n\n// Create a connection from the dashboard form.\nconnections.post(\"/\", async (c) => {\n const session = await getOAuthUserData(c.req.raw);\n if (!session) return c.redirect(\"/\");\n const form = await c.req.formData();\n const val = String(form.get(\"val\") ?? \"\");\n const repo = String(form.get(\"repo\") ?? \"\");\n const direction = String(form.get(\"direction\") ?? \"github\") as \"github\" | \"valtown\";\n const branch = String(form.get(\"branch\") || \"main\");\n const ghToken = String(form.get(\"gh_token\") ?? \"\");\n const installationId = Number(form.get(\"installation_id\") || 0) || null;\n\n const token = session.accessToken;\n const valId = await getValId(token, val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: session.user.id,\n val_id: valId,\n val_slug: val,\n repo,\n branch,\n direction,\n vt_token: token,\n gh_token: ghToken || null,\n installation_id: installationId,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n // App installations deliver pushes via the app-level webhook; a pasted token needs a repo hook.\n if (direction === \"github\" && ghToken) {\n await registerPushWebhook(\n await ghTokenFor(conn),\n repo,\n `${new URL(c.req.url).origin}/webhook/github`,\n webhookSecret,\n );\n }\n\n try {\n const backfill = direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.redirect(`/connections/${id}`);\n});\n\nconnections.get(\"/:id\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.redirect(\"/\");\n const events = await recentEvents(conn.id);\n return c.html(\n \n \n ,\n );\n});\n\nconnections.post(\"/:id/resync\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n let result: unknown;\n try {\n result = conn.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(conn.id, \"manual resync ok\");\n await recordEvent(conn.id, \"resync\", JSON.stringify(result));\n } catch (e) {\n result = `error: ${e.message}`;\n await updateSyncResult(conn.id, `resync error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n }\n if (devAuthorized(c.req.raw)) return c.json({ id: conn.id, result });\n return c.redirect(`/connections/${conn.id}`);\n});\n\nconnections.post(\"/:id/delete\", async (c) => {\n const conn = await getConnection(Number(c.req.param(\"id\")));\n if (!conn) return c.text(\"not found\", 404);\n if (!(await authorizedFor(c, conn.user_id))) return c.text(\"unauthorized\", 401);\n await deleteConnection(conn.id);\n if (devAuthorized(c.req.raw)) return c.json({ deleted: conn.id });\n return c.redirect(\"/\");\n});\n\nexport default connections;\n","createdAt",["D",1781310650599],"branchVersion","branchId","503392e9-5051-4383-a7b7-4f37bc194007","id","bb036e1b-8dcf-48ee-9796-68ffb44b04ef","githubsync",["D",1781310279766],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Hosted GitHub <-> Val Town sync service prototype","imageUrl","a0bf3b31-15a5-4d5c-880e-4b1e22c9bc18","pinnedFileId","2cfaf97a-66bf-11f1-9471-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","e81e7335-6d4c-4764-a902-d0962bbfa9f7","tursoName","bb036e1b8dcf48ee979668ffb44b04ef","tursoHostname","bb036e1b8dcf48ee979668ffb44b04ef-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789509672838],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_99":98,"_106":102},"org",{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},"branch",{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"isOwned",46,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","stevekrouse","handle","displayName","avatar","https://images.clerk.dev/uploaded/img_2PqHa2Gsy93xQrjh2w78Xu0cChW.jpeg","tier","pro","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_42":43,"_31":44,"_37":321,"_46":-5,"_47":24,"_48":49,"_50":49,"_51":52,"_53":-5,"_18":54,"_55":56,"_57":58,"_59":-5,"_60":-5,"_61":62,"_63":64,"_65":66,"_67":68,"_69":322,"_71":-5,"_72":73,"_74":73,"_75":76,"_77":76,"_78":76,"_79":73,"_80":73,"_81":323,"_83":324,"_85":325,"_87":24},"tree",[187,191,195,198,204,205],"files",[187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205],"counts",{"_177":62,"_178":148,"_179":62,"_180":181,"_182":183},"contents",[129,130,131,132,133,134],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_42":171,"_31":172,"_29":173,"_138":-5,"_40":41,"_39":174,"_140":58,"_37":175,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_26":176},{"_42":165,"_31":166,"_29":167,"_138":-5,"_40":41,"_39":168,"_140":58,"_37":169,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_26":170},{"_42":159,"_31":160,"_29":161,"_138":-5,"_40":41,"_39":162,"_140":58,"_37":163,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_26":164},{"_42":152,"_31":153,"_29":154,"_138":-5,"_40":41,"_39":155,"_140":58,"_37":156,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_26":158},{"_42":145,"_31":146,"_29":147,"_138":-5,"_40":41,"_39":148,"_140":24,"_37":149,"_13":62,"_33":20,"_35":150,"_23":24,"_143":-5,"_26":151},{"_42":135,"_31":136,"_29":137,"_138":-5,"_40":41,"_39":139,"_140":58,"_37":141,"_13":62,"_33":34,"_35":142,"_23":24,"_143":-5,"_26":144},"346b227e-45f9-4f66-bf07-0b28f36fec8b","db.ts","c3e688dc-66be-11f1-9ff7-1607ee4eb77e","parentId",2,"latest",["D",1781310494158],"import { sqlite } from \"https://esm.town/v/std/sqlite/main.ts\";\n\nconst TABLES = [\n `CREATE TABLE IF NOT EXISTS users (\n user_id TEXT PRIMARY KEY,\n username TEXT NOT NULL,\n access_token TEXT NOT NULL,\n refresh_token TEXT,\n updated_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS apps (\n app_id INTEGER PRIMARY KEY,\n slug TEXT NOT NULL,\n client_id TEXT NOT NULL,\n client_secret TEXT NOT NULL,\n webhook_secret TEXT NOT NULL,\n pem TEXT NOT NULL,\n owner_user_id TEXT,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS installations (\n installation_id INTEGER PRIMARY KEY,\n app_id INTEGER NOT NULL,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS connections (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n user_id TEXT NOT NULL,\n val_id TEXT NOT NULL,\n val_slug TEXT NOT NULL,\n repo TEXT NOT NULL,\n branch TEXT NOT NULL DEFAULT 'main',\n direction TEXT NOT NULL CHECK (direction IN ('github','valtown')),\n vt_token TEXT NOT NULL,\n gh_token TEXT,\n installation_id INTEGER,\n webhook_secret TEXT,\n last_sync_at TEXT,\n last_result TEXT,\n created_at TEXT NOT NULL\n )`,\n `CREATE TABLE IF NOT EXISTS events (\n id INTEGER PRIMARY KEY AUTOINCREMENT,\n connection_id INTEGER NOT NULL,\n ts TEXT NOT NULL,\n kind TEXT NOT NULL,\n detail TEXT\n )`,\n];\nfor (const sql of TABLES) await sqlite.execute(sql);\n\nfunction asObjects(rs: { columns: string[]; rows: unknown[] }): T[] {\n const rows = rs.rows ?? [];\n if (rows.length === 0) return [];\n if (!Array.isArray(rows[0])) return rows as T[];\n return (rows as unknown[][]).map((r) =>\n Object.fromEntries(rs.columns.map((c, i) => [c, r[i]])) as T\n );\n}\n\nconst now = () => new Date().toISOString();\n\nexport type Connection = {\n id: number;\n user_id: string;\n val_id: string;\n val_slug: string;\n repo: string;\n branch: string;\n direction: \"github\" | \"valtown\";\n vt_token: string;\n gh_token: string | null;\n installation_id: number | null;\n webhook_secret: string | null;\n last_sync_at: string | null;\n last_result: string | null;\n created_at: string;\n};\n\nexport type App = {\n app_id: number;\n slug: string;\n client_id: string;\n client_secret: string;\n webhook_secret: string;\n pem: string;\n owner_user_id: string | null;\n created_at: string;\n};\n\nexport type SyncEvent = {\n id: number;\n connection_id: number;\n ts: string;\n kind: string;\n detail: string | null;\n};\n\nexport async function upsertUser(\n userId: string,\n username: string,\n accessToken: string,\n refreshToken: string | null,\n) {\n await sqlite.execute({\n sql: `INSERT INTO users (user_id, username, access_token, refresh_token, updated_at)\n VALUES (?, ?, ?, ?, ?)\n ON CONFLICT(user_id) DO UPDATE SET\n username = excluded.username,\n access_token = excluded.access_token,\n refresh_token = excluded.refresh_token,\n updated_at = excluded.updated_at`,\n args: [userId, username, accessToken, refreshToken, now()],\n });\n}\n\nexport async function insertApp(a: Omit) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO apps\n (app_id, slug, client_id, client_secret, webhook_secret, pem, owner_user_id, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [a.app_id, a.slug, a.client_id, a.client_secret, a.webhook_secret, a.pem, a.owner_user_id, now()],\n });\n}\n\nexport async function getApp(): Promise {\n const rs = await sqlite.execute(`SELECT * FROM apps ORDER BY created_at DESC LIMIT 1`);\n return asObjects(rs)[0] ?? null;\n}\n\nexport async function insertInstallation(installationId: number, appId: number) {\n await sqlite.execute({\n sql: `INSERT OR REPLACE INTO installations (installation_id, app_id, created_at) VALUES (?, ?, ?)`,\n args: [installationId, appId, now()],\n });\n}\n\nexport async function listInstallations(): Promise<{ installation_id: number; app_id: number }[]> {\n const rs = await sqlite.execute(`SELECT * FROM installations ORDER BY created_at DESC`);\n return asObjects(rs);\n}\n\nexport async function insertConnection(\n c: Omit,\n): Promise {\n const rs = await sqlite.execute({\n sql: `INSERT INTO connections\n (user_id, val_id, val_slug, repo, branch, direction, vt_token, gh_token, installation_id, webhook_secret, created_at)\n VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n args: [\n c.user_id, c.val_id, c.val_slug, c.repo, c.branch, c.direction,\n c.vt_token, c.gh_token, c.installation_id, c.webhook_secret, now(),\n ],\n });\n return Number(rs.lastInsertRowid);\n}\n\nexport async function getConnection(id: number): Promise {\n const rs = await sqlite.execute({ sql: `SELECT * FROM connections WHERE id = ?`, args: [id] });\n return asObjects(rs)[0] ?? null;\n}\n\nexport async function listConnections(userId?: string): Promise {\n const rs = userId\n ? await sqlite.execute({\n sql: `SELECT * FROM connections WHERE user_id = ? OR user_id = 'dev' ORDER BY id DESC`,\n args: [userId],\n })\n : await sqlite.execute(`SELECT * FROM connections ORDER BY id DESC`);\n return asObjects(rs);\n}\n\nexport async function connectionsForRepo(repo: string, direction: string): Promise {\n const rs = await sqlite.execute({\n sql: `SELECT * FROM connections WHERE repo = ? AND direction = ?`,\n args: [repo, direction],\n });\n return asObjects(rs);\n}\n\nexport async function valtownSourceConnections(): Promise {\n const rs = await sqlite.execute(`SELECT * FROM connections WHERE direction = 'valtown'`);\n return asObjects(rs);\n}\n\nexport async function updateSyncResult(id: number, result: string) {\n await sqlite.execute({\n sql: `UPDATE connections SET last_sync_at = ?, last_result = ? WHERE id = ?`,\n args: [now(), result.slice(0, 500), id],\n });\n}\n\nexport async function deleteConnection(id: number) {\n await sqlite.execute({ sql: `DELETE FROM events WHERE connection_id = ?`, args: [id] });\n await sqlite.execute({ sql: `DELETE FROM connections WHERE id = ?`, args: [id] });\n}\n\nexport async function recordEvent(connectionId: number, kind: string, detail: string) {\n await sqlite.execute({\n sql: `INSERT INTO events (connection_id, ts, kind, detail) VALUES (?, ?, ?, ?)`,\n args: [connectionId, now(), kind, detail.slice(0, 2000)],\n });\n}\n\nexport async function recentEvents(connectionId: number, limit = 20): Promise {\n const rs = await sqlite.execute({\n sql: `SELECT * FROM events WHERE connection_id = ? ORDER BY id DESC LIMIT ?`,\n args: [connectionId, limit],\n });\n return asObjects(rs);\n}\n","label",[136],"306eebb3-4fed-44bc-abc3-84908ccf2f72","README.md","44204278-66be-11f1-b28c-1607ee4eb77e",1,["D",1781310279784],"# githubsync\n\nHosted GitHub <-> Val Town sync service prototype.\n",[146],"5ef8c3f2-ec35-42b8-acec-e06fd75aa810","views","8439d568-2859-4034-9d9d-dda5df5c702e",10,["D",1781310591315],"directory",[153],"0f97f978-6838-46a4-abf2-05b0c4751b4a","sync","91476b4f-e132-4c92-bb12-67166e8574f5",6,["D",1781310546326],[160],"6a03e418-b02f-44a1-8e11-2ad90bc19cbf","routes","165a136c-f6d1-45c0-99f2-259223c2e53a",8,["D",1781310572920],[166],"9c70151a-a2a2-4ce0-b510-626634ee1fe5","lib","640e6044-ddfa-454d-bb57-f42fb8b69d43",3,["D",1781310508175],[172],"pulls","branches","forks","envVars",{"_184":155,"_186":62},"connections",{"_184":62,"_185":62},"count","unfilledCount","emptyCount",{"_42":171,"_31":172,"_29":173,"_138":-5,"_40":41,"_39":174,"_140":58,"_37":318,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_207":319,"_26":320},{"_42":310,"_31":311,"_29":312,"_138":173,"_40":41,"_39":313,"_140":24,"_37":314,"_13":62,"_33":34,"_35":315,"_23":24,"_143":-5,"_207":316,"_26":317},{"_42":303,"_31":304,"_29":305,"_138":173,"_40":41,"_39":174,"_140":58,"_37":306,"_13":62,"_33":34,"_35":307,"_23":24,"_143":-5,"_207":308,"_26":309},{"_42":295,"_31":296,"_29":297,"_138":173,"_40":41,"_39":298,"_140":58,"_37":299,"_13":62,"_33":34,"_35":300,"_23":24,"_143":-5,"_207":301,"_26":302},{"_42":165,"_31":166,"_29":167,"_138":-5,"_40":41,"_39":168,"_140":58,"_37":292,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_207":293,"_26":294},{"_42":288,"_31":32,"_29":30,"_138":167,"_40":41,"_39":14,"_140":58,"_37":289,"_13":62,"_33":34,"_35":36,"_23":24,"_143":-5,"_207":290,"_26":291},{"_42":280,"_31":281,"_29":282,"_138":167,"_40":41,"_39":283,"_140":58,"_37":284,"_13":62,"_33":34,"_35":285,"_23":24,"_143":-5,"_207":286,"_26":287},{"_42":273,"_31":274,"_29":275,"_138":167,"_40":41,"_39":168,"_140":24,"_37":276,"_13":62,"_33":34,"_35":277,"_23":24,"_143":-5,"_207":278,"_26":279},{"_42":159,"_31":160,"_29":161,"_138":-5,"_40":41,"_39":162,"_140":58,"_37":270,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_207":271,"_26":272},{"_42":263,"_31":264,"_29":265,"_138":161,"_40":41,"_39":162,"_140":58,"_37":266,"_13":62,"_33":34,"_35":267,"_23":24,"_143":-5,"_207":268,"_26":269},{"_42":255,"_31":256,"_29":257,"_138":161,"_40":41,"_39":258,"_140":58,"_37":259,"_13":62,"_33":34,"_35":260,"_23":24,"_143":-5,"_207":261,"_26":262},{"_42":152,"_31":153,"_29":154,"_138":-5,"_40":41,"_39":155,"_140":58,"_37":252,"_13":62,"_33":157,"_35":-5,"_23":24,"_143":-5,"_207":253,"_26":254},{"_42":244,"_31":245,"_29":246,"_138":154,"_40":41,"_39":247,"_140":24,"_37":248,"_13":62,"_33":34,"_35":249,"_23":24,"_143":-5,"_207":250,"_26":251},{"_42":236,"_31":237,"_29":238,"_138":154,"_40":41,"_39":239,"_140":24,"_37":240,"_13":62,"_33":34,"_35":241,"_23":24,"_143":-5,"_207":242,"_26":243},{"_42":229,"_31":230,"_29":231,"_138":154,"_40":41,"_39":155,"_140":58,"_37":232,"_13":62,"_33":34,"_35":233,"_23":24,"_143":-5,"_207":234,"_26":235},{"_42":221,"_31":222,"_29":223,"_138":154,"_40":41,"_39":224,"_140":24,"_37":225,"_13":62,"_33":34,"_35":226,"_23":24,"_143":-5,"_207":227,"_26":228},{"_42":213,"_31":214,"_29":215,"_138":154,"_40":41,"_39":216,"_140":58,"_37":217,"_13":62,"_33":34,"_35":218,"_23":24,"_143":-5,"_207":219,"_26":220},{"_42":145,"_31":146,"_29":147,"_138":-5,"_40":41,"_39":148,"_140":24,"_37":210,"_13":62,"_33":20,"_35":150,"_23":24,"_143":-5,"_207":211,"_26":212},{"_42":135,"_31":136,"_29":137,"_138":-5,"_40":41,"_39":139,"_140":58,"_37":206,"_13":62,"_33":34,"_35":142,"_23":24,"_143":-5,"_207":208,"_26":209},["D",1781310494158],"children",[],[136],["D",1781310279784],[],[146],"a51b9b38-650e-4aa9-ac36-1700d726cdce","Status.tsx","12c88f04-66bf-11f1-8e28-1607ee4eb77e",13,["D",1781310626501],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { Connection, SyncEvent } from \"../db.ts\";\n\nexport default function Status({ conn, events }: { conn: Connection; events: SyncEvent[] }) {\n const source = conn.direction === \"github\" ? \"GitHub\" : \"Val Town\";\n return (\n

\n {conn.val_slug} and {conn.repo}\n

\n Source of truth: {source}. Branch: {conn.branch}.\n

\n Last sync: {conn.last_sync_at ?? \"never\"} - {conn.last_result ?? \"no result yet\"}\n

\n\n

\n \n \n

\n\n

Recent events

\n {events.length === 0 ?

No events yet.

: (\n \n \n \n \n \n \n \n \n \n {events.map((e) => (\n \n \n \n \n \n ))}\n \n

Time	Kind	Detail
{e.ts}	{e.kind}	{e.detail}

\n )}\n

\n );\n}\n",[],[153,214],"636f75d6-5c9d-4d08-815b-ef21e6a3c0c0","NewAppPage.tsx","15895c64-66bf-11f1-be32-1607ee4eb77e",14,["D",1781310631124],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function NewAppPage({ manifest, state }: { manifest: string; state: string }) {\n return (\n

Create the GitHub App

\n This sends an app manifest to GitHub. GitHub asks you to confirm the app name, then\n redirects back here with the app's credentials (id, private key, webhook secret), which we\n store. After that you install the app on the repos you want to sync.\n

\n \n

Manifest we send

{manifest}

\n );\n}\n",[],[153,222],"b8a6320f-99c6-4b7d-b12c-7d7d0187580f","Layout.tsx","fdef2796-66be-11f1-b28c-1607ee4eb77e",["D",1781310591315],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Layout({ title, children }: { title: string; children?: unknown }) {\n return (\n \n \n \n \n {title}\n \n \n \n

\n githubsync\n GitHub and Val Town, in sync\n

\n {children}\n

\n \n \n );\n}\n",[],[153,230],"6d05f132-3f27-46cc-826a-1a28287a9d84","Landing.tsx","00805520-66bf-11f1-8aa2-1607ee4eb77e",11,["D",1781310595822],"/** @jsxImportSource npm:hono@4/jsx */\n\nexport default function Landing() {\n return (\n

\n Connect a val to a GitHub repo. We keep them in sync.\n

\n Pick a val, pick a repo, pick which side is the source of truth. Pushes to the repo\n land in the val within seconds; edits to the val land in the repo as clean commits.\n

\n \n Sign in with Val Town\n \n

Sign in with Val Town (grants the API access we sync with)
Connect GitHub (one-click GitHub App creation, then install it on your repos)
Pick a val, a repo, and a direction - then Connect

\n );\n}\n",[],[153,237],"78372181-930f-4f91-ac57-4061e8717505","Dashboard.tsx","0ecf4bf4-66bf-11f1-bfe7-1607ee4eb77e",12,["D",1781310619836],"/** @jsxImportSource npm:hono@4/jsx */\nimport type { App, Connection } from \"../db.ts\";\n\nfunction ConnectionRow({ conn }: { conn: Connection }) {\n const arrow = conn.direction === \"github\" ? \"repo to val\" : \"val to repo\";\n return (\n \n \n {conn.val_slug}\n \n {conn.repo}\n {arrow}\n {conn.last_result ?? \"never synced\"}\n \n );\n}\n\nexport default function Dashboard(props: {\n username: string;\n vals: string[];\n valsError: string | null;\n connections: Connection[];\n app: App | null;\n installations: { installation_id: number }[];\n}) {\n const { username, vals, valsError, connections, app, installations } = props;\n return (\n

\n Signed in as {username}\n

\n \n

\n\n

Connections

\n {connections.length === 0\n ?

No connections yet.

\n : (\n \n \n \n \n \n \n \n \n \n \n {connections.map((conn) => )}\n \n

Val	Repo	Direction	Last sync

\n )}\n

\n\n

GitHub

\n {app\n ? (\n

\n GitHub App {app.slug} is registered.\n

\n \n Install it on repos\n {\" \"}\n you want to sync. Known installations:{\" \"}\n {installations.length === 0\n ? \"none yet\"\n : installations.map((i) => String(i.installation_id)).join(\", \")}\n

\n )\n : (\n

\n \n Create the GitHub App\n {\" \"}\n (one click; GitHub generates all credentials and sends them back to us).\n

\n )}\n

\n\n

New connection

\n Val\n {valsError\n ?

Could not list your vals: {valsError}. Log out and back in.

\n : (\n \n )}\n

\n GitHub repo (owner/name)\n \n

\n Branch\n \n

\n Source of truth\n \n {\" \"}\n GitHub - pushes to the repo overwrite the val\n \n \n {\" \"}\n Val Town - edits to the val are committed to the repo\n \n

\n {installations.length > 0 && (\n

\n GitHub App installation\n \n \n {installations.map((i) => (\n \n ))}\n \n

\n )}\n

\n \n GitHub token (dev fallback - used instead of the GitHub App; needs Contents\n read/write on the repo)\n \n \n

\n \n

\n );\n}\n",[],[153,245],["D",1781310591315],[199,200,201,202,203],[153],"0f4366d0-d3bb-4884-a5e6-c83013d50af6","valToGh.ts","e988f200-66be-11f1-bfe7-1607ee4eb77e",7,["D",1781310557274],"import { type Connection } from \"../db.ts\";\nimport { ghTokenFor, vtTokenFor } from \"../lib/creds.ts\";\nimport { gh, gitBlobSha, toBase64 } from \"../lib/github.ts\";\nimport { listValFiles, readValFileBytes } from \"../lib/valtown.ts\";\n\n// Diff the val's files against the repo HEAD by computing git blob shas locally;\n// push one commit covering all adds, edits, and deletions. No diff => no commit.\nexport async function pushValToRepo(conn: Connection): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const { repo, branch } = conn;\n\n const files = await listValFiles(vtToken, conn.val_id);\n const entries = await Promise.all(\n files.map(async (f) => {\n const bytes = await readValFileBytes(vtToken, conn.val_id, f.path);\n return { path: f.path, bytes, sha: await gitBlobSha(bytes) };\n }),\n );\n\n const ref = await gh(ghToken, `/repos/${repo}/git/ref/heads/${branch}`);\n const headSha: string = ref.object.sha;\n const headCommit = await gh(ghToken, `/repos/${repo}/git/commits/${headSha}`);\n const headTree = await gh(ghToken, `/repos/${repo}/git/trees/${headCommit.tree.sha}?recursive=1`);\n if (headTree.truncated) throw new Error(\"repo tree truncated - cannot diff safely\");\n const repoShas = new Map(\n headTree.tree.filter((t: any) => t.type === \"blob\").map((t: any) => [t.path, t.sha]),\n );\n\n const changed = entries.filter((e) => repoShas.get(e.path) !== e.sha);\n const deleted = [...repoShas.keys()].filter((p) => !entries.some((e) => e.path === p));\n if (changed.length === 0 && deleted.length === 0) {\n return `up to date with ${repo}@${headSha.slice(0, 7)} - no commit`;\n }\n\n for (const e of changed) {\n const blob = await gh(ghToken, `/repos/${repo}/git/blobs`, {\n method: \"POST\",\n body: JSON.stringify({ content: toBase64(e.bytes), encoding: \"base64\" }),\n });\n if (blob.sha !== e.sha) {\n throw new Error(`blob sha mismatch for ${e.path}: ${blob.sha} != ${e.sha}`);\n }\n }\n\n // Full tree, no base_tree: omitted paths are deletions.\n const tree = await gh(ghToken, `/repos/${repo}/git/trees`, {\n method: \"POST\",\n body: JSON.stringify({\n tree: entries.map((e) => ({ path: e.path, mode: \"100644\", type: \"blob\", sha: e.sha })),\n }),\n });\n\n const summary = `githubsync: ${changed.length} changed, ${deleted.length} deleted`;\n const commit = await gh(ghToken, `/repos/${repo}/git/commits`, {\n method: \"POST\",\n body: JSON.stringify({\n message: `${summary}\\n\\nsource: https://www.val.town/x/${conn.val_slug}`,\n tree: tree.sha,\n parents: [headSha],\n }),\n });\n // force:false — a concurrent push 422s here and the next run recovers.\n await gh(ghToken, `/repos/${repo}/git/refs/heads/${branch}`, {\n method: \"PATCH\",\n body: JSON.stringify({ sha: commit.sha, force: false }),\n });\n return `pushed ${commit.sha.slice(0, 7)} to ${repo}@${branch}: ${summary}`;\n}\n",[],[160,256],"194c3ea0-9712-4b89-be22-ccdb5a89e5e2","ghToVal.ts","e2febbea-66be-11f1-9f5d-1607ee4eb77e",["D",1781310546326],"import { type Connection } from \"../db.ts\";\nimport { ghTokenFor, vtTokenFor } from \"../lib/creds.ts\";\nimport { fetchRepoFile, fetchRepoTree } from \"../lib/github.ts\";\nimport { deleteValFile, listValFiles, upsertValFile } from \"../lib/valtown.ts\";\n\nconst SKIP_PREFIXES = [\".github/\"];\nconst shouldSkip = (path: string) => SKIP_PREFIXES.some((p) => path.startsWith(p));\nconst decoder = new TextDecoder(\"utf-8\", { fatal: true });\n\nasync function syncOneFile(\n vtToken: string,\n ghToken: string,\n conn: Connection,\n path: string,\n ref: string,\n): Promise {\n const bytes = await fetchRepoFile(ghToken, conn.repo, path, ref);\n let content: string;\n try {\n content = decoder.decode(bytes); // throws on binary\n } catch {\n return `skipped (binary): ${path}`;\n }\n if (content.length > 80_000) return `skipped (>80k chars, API limit): ${path}`;\n await upsertValFile(vtToken, conn.val_id, path, content);\n return `synced: ${path}`;\n}\n\n// Fold the push payload's commit list in order so the final action per path wins.\nexport async function incrementalSync(conn: Connection, payload: any): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const actions = new Map();\n for (const commit of payload.commits) {\n for (const p of [...commit.added, ...commit.modified]) actions.set(p, \"upsert\");\n for (const p of commit.removed) actions.set(p, \"remove\");\n }\n const results: string[] = [];\n for (const [path, action] of actions) {\n if (shouldSkip(path)) {\n results.push(`skipped (rule): ${path}`);\n } else if (action === \"upsert\") {\n results.push(await syncOneFile(vtToken, ghToken, conn, path, payload.after));\n } else {\n await deleteValFile(vtToken, conn.val_id, path);\n results.push(`deleted: ${path}`);\n }\n }\n return results;\n}\n\n// Mirror the whole repo tree into the val, deleting val files not in the repo.\nexport async function fullSync(conn: Connection, ref?: string): Promise {\n const vtToken = vtTokenFor(conn);\n const ghToken = await ghTokenFor(conn);\n const r = ref ?? conn.branch;\n const repoPaths = (await fetchRepoTree(ghToken, conn.repo, r)).filter((p) => !shouldSkip(p));\n const results: string[] = [];\n for (const path of repoPaths) {\n results.push(await syncOneFile(vtToken, ghToken, conn, path, r));\n }\n const repoSet = new Set(repoPaths);\n const valFiles = await listValFiles(vtToken, conn.val_id);\n for (const { path } of valFiles) {\n if (!repoSet.has(path) && !shouldSkip(path)) {\n await deleteValFile(vtToken, conn.val_id, path);\n results.push(`deleted (not in repo): ${path}`);\n }\n }\n return results;\n}\n",[],[160,264],["D",1781310546326],[196,197],[160],"d56bdfeb-afe8-449b-a43b-82291be34b11","webhook.ts","f2da73c4-66be-11f1-aae1-1607ee4eb77e",["D",1781310572920],"import { Hono } from \"npm:hono@4\";\nimport { connectionsForRepo, getApp, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { resolveSecret } from \"../lib/creds.ts\";\nimport { fullSync, incrementalSync } from \"../sync/ghToVal.ts\";\n\nasync function validSignature(\n secret: string,\n body: Uint8Array,\n sigHeader: string | null,\n): Promise {\n if (!sigHeader?.startsWith(\"sha256=\")) return false;\n const hex = sigHeader.slice(\"sha256=\".length);\n if (!/^[0-9a-f]{64}$/.test(hex)) return false;\n const sig = new Uint8Array(hex.match(/../g)!.map((b) => parseInt(b, 16)));\n const key = await crypto.subtle.importKey(\n \"raw\",\n new TextEncoder().encode(secret),\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"verify\"],\n );\n return await crypto.subtle.verify(\"HMAC\", key, sig, body); // timing-safe\n}\n\nconst webhook = new Hono();\n\nwebhook.post(\"/github\", async (c) => {\n const body = new Uint8Array(await c.req.arrayBuffer());\n const event = c.req.header(\"x-github-event\");\n if (event === \"ping\") return c.json({ ok: true, pong: true });\n if (event !== \"push\") return c.json({ ok: true, ignored: `event ${event}` });\n\n const payload = JSON.parse(new TextDecoder().decode(body));\n const repo = payload.repository?.full_name;\n if (!repo) return c.json({ ok: true, ignored: \"no repository in payload\" });\n\n const conns = await connectionsForRepo(repo, \"github\");\n if (conns.length === 0) return c.json({ ok: true, ignored: `no connections for ${repo}` });\n\n // Candidate secrets: each connection's repo-webhook secret plus the app-level secret.\n const sig = c.req.header(\"x-hub-signature-256\") ?? null;\n const secrets = conns.map((x) => resolveSecret(x.webhook_secret)).filter(Boolean) as string[];\n const app = await getApp();\n if (app) secrets.push(app.webhook_secret);\n let verified = false;\n for (const s of secrets) {\n if (await validSignature(s, body, sig)) {\n verified = true;\n break;\n }\n }\n if (!verified) return c.text(\"bad signature\", 401);\n\n if (payload.deleted) return c.json({ ok: true, ignored: \"branch deletion\" });\n\n const results: Record = {};\n for (const conn of conns) {\n if (payload.ref !== `refs/heads/${conn.branch}`) {\n results[conn.id] = `ignored ref ${payload.ref} (only syncing ${conn.branch})`;\n continue;\n }\n try {\n // GitHub truncates the commits array at 20; force pushes rewrite history.\n const needFull = payload.forced || payload.commits.length >= 20;\n const r = needFull ? await fullSync(conn, payload.after) : await incrementalSync(conn, payload);\n await updateSyncResult(conn.id, `${needFull ? \"full\" : \"incremental\"} sync: ${r.length} files`);\n await recordEvent(\n conn.id,\n \"push\",\n JSON.stringify({ after: payload.after?.slice(0, 7), results: r }),\n );\n results[conn.id] = r;\n } catch (e) {\n await updateSyncResult(conn.id, `error: ${e.message}`);\n await recordEvent(conn.id, \"error\", e.message);\n results[conn.id] = `error: ${e.message}`;\n }\n }\n console.log(`push ${payload.after?.slice(0, 7)} to ${repo}:`, results);\n return c.json({ ok: true, results });\n});\n\nexport default webhook;\n",[],[166,274],"51d120f1-e985-4b8e-a0fd-9bb83af9c6d6","dev.ts","f85353de-66be-11f1-bdd6-1607ee4eb77e",9,["D",1781310582110],"import { Hono } from \"npm:hono@4\";\nimport { getConnection, insertConnection, recordEvent, updateSyncResult } from \"../db.ts\";\nimport { devAuthorized, ghTokenFor, resolveSecret } from \"../lib/creds.ts\";\nimport { registerPushWebhook } from \"../lib/github.ts\";\nimport { getValId } from \"../lib/valtown.ts\";\nimport { fullSync } from \"../sync/ghToVal.ts\";\nimport { pushValToRepo } from \"../sync/valToGh.ts\";\n\n// Dev-mode API: create a connection without the browser OAuth + GitHub App flow.\n// Auth: Authorization: Bearer . Tokens may be passed as \"env:NAME\" to\n// resolve from this val's environment so they never land in the database.\nconst dev = new Hono();\n\ndev.post(\"/connect\", async (c) => {\n if (!devAuthorized(c.req.raw)) return c.text(\"unauthorized\", 401);\n const b = await c.req.json();\n for (const field of [\"val\", \"repo\", \"direction\", \"vt_token\"]) {\n if (!b[field]) return c.json({ error: `missing ${field}` }, 400);\n }\n const vtToken = resolveSecret(b.vt_token);\n if (!vtToken) return c.json({ error: \"vt_token did not resolve\" }, 400);\n const valId = await getValId(vtToken, b.val);\n const webhookSecret = crypto.randomUUID().replaceAll(\"-\", \"\");\n const id = await insertConnection({\n user_id: \"dev\",\n val_id: valId,\n val_slug: b.val,\n repo: b.repo,\n branch: b.branch ?? \"main\",\n direction: b.direction,\n vt_token: b.vt_token,\n gh_token: b.gh_token ?? null,\n installation_id: b.installation_id ?? null,\n webhook_secret: webhookSecret,\n });\n const conn = (await getConnection(id))!;\n\n let hookId: number | null = null;\n if (b.direction === \"github\" && b.register_webhook !== false) {\n const url = `${new URL(c.req.url).origin}/webhook/github`;\n hookId = (await registerPushWebhook(await ghTokenFor(conn), b.repo, url, webhookSecret)).id;\n }\n\n let backfill: unknown;\n try {\n backfill = b.direction === \"github\" ? await fullSync(conn) : await pushValToRepo(conn);\n await updateSyncResult(id, \"backfill ok\");\n await recordEvent(id, \"backfill\", JSON.stringify(backfill));\n } catch (e) {\n backfill = `error: ${e.message}`;\n await updateSyncResult(id, `backfill error: ${e.message}`);\n await recordEvent(id, \"error\", e.message);\n }\n return c.json({ id, hookId, backfill });\n});\n\nexport default dev;\n",[],[166,281],"c91b7956-89cf-4b95-bfe1-edc08c61b6c9",["D",1781310650599],[],[166,32],["D",1781310572920],[192,193,194],[166],"d7918672-98d4-40bb-9cb1-0abbca6de573","valtown.ts","d6048f50-66be-11f1-8d6e-1607ee4eb77e",4,["D",1781310524554],"const VT_API = \"https://api.val.town\";\n\nasync function vt(\n token: string,\n method: string,\n pathAndQuery: string,\n body?: unknown,\n): Promise {\n return await fetch(`${VT_API}${pathAndQuery}`, {\n method,\n headers: { Authorization: `Bearer ${token}`, \"Content-Type\": \"application/json\" },\n body: body === undefined ? undefined : JSON.stringify(body),\n });\n}\n\nasync function vtJson(token: string, method: string, pathAndQuery: string, body?: unknown) {\n const res = await vt(token, method, pathAndQuery, body);\n if (!res.ok) {\n throw new Error(\n `Val Town ${method} ${pathAndQuery} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.json();\n}\n\nexport async function getValId(token: string, slug: string): Promise {\n const [handle, name] = slug.split(\"/\");\n if (!handle || !name) throw new Error(`bad val slug: ${slug} (expected handle/name)`);\n return (await vtJson(token, \"GET\", `/v2/alias/vals/${handle}/${name}`)).id;\n}\n\nexport async function listMyVals(token: string): Promise {\n const slugs: string[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(token, \"GET\", `/v2/me/vals?limit=100&offset=${offset}`);\n for (const v of data) slugs.push(`${v.author.username}/${v.name}`);\n if (data.length < 100) break;\n }\n return slugs;\n}\n\nexport async function listValFiles(token: string, valId: string): Promise<{ path: string }[]> {\n const files: { path: string; type: string }[] = [];\n for (let offset = 0;; offset += 100) {\n const { data } = await vtJson(\n token,\n \"GET\",\n `/v2/vals/${valId}/files?path=&recursive=true&limit=100&offset=${offset}`,\n );\n files.push(...data);\n if (data.length < 100) break;\n }\n return files.filter((f) => f.type !== \"directory\");\n}\n\nexport async function readValFileBytes(\n token: string,\n valId: string,\n path: string,\n): Promise {\n const res = await vt(token, \"GET\", `/v2/vals/${valId}/files/content?path=${encodeURIComponent(path)}`);\n if (!res.ok) throw new Error(`Val Town read ${path} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\n// PUT updates an existing file; on 404 create it (and parent directories) with POST.\nexport async function upsertValFile(token: string, valId: string, path: string, content: string) {\n const q = `?path=${encodeURIComponent(path)}`;\n const put = await vt(token, \"PUT\", `/v2/vals/${valId}/files${q}`, { content });\n if (put.ok) return;\n if (put.status !== 404) throw new Error(`PUT ${path}: ${put.status} ${await put.text()}`);\n const parts = path.split(\"/\");\n for (let i = 1; i < parts.length; i++) {\n const dir = parts.slice(0, i).join(\"/\");\n await vt(token, \"POST\", `/v2/vals/${valId}/files?path=${encodeURIComponent(dir)}`, {\n type: \"directory\",\n });\n }\n const type = /\\.(ts|tsx|js|jsx)$/.test(path) ? \"script\" : \"file\";\n const post = await vt(token, \"POST\", `/v2/vals/${valId}/files${q}`, { content, type });\n if (!post.ok) throw new Error(`POST ${path}: ${post.status} ${await post.text()}`);\n}\n\nexport async function deleteValFile(token: string, valId: string, path: string) {\n const res = await vt(\n token,\n \"DELETE\",\n `/v2/vals/${valId}/files?path=${encodeURIComponent(path)}&recursive=false`,\n );\n if (!res.ok && res.status !== 404) {\n throw new Error(`DELETE ${path}: ${res.status} ${await res.text()}`);\n }\n}\n",[],[172,296],"3e8cec39-311d-4c87-a4e1-ce28d00c5ab7","github.ts","cc420920-66be-11f1-86c9-1607ee4eb77e",["D",1781310508175],"import { createPrivateKey, createSign } from \"node:crypto\";\n\nconst GH_API = \"https://api.github.com\";\n\nexport async function gh(token: string, path: string, init: RequestInit = {}): Promise {\n const res = await fetch(`${GH_API}${path}`, {\n ...init,\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github+json\",\n \"Content-Type\": \"application/json\",\n \"X-GitHub-Api-Version\": \"2022-11-28\",\n \"User-Agent\": \"githubsync-val\",\n ...(init.headers ?? {}),\n },\n });\n if (!res.ok) {\n throw new Error(\n `GitHub ${init.method ?? \"GET\"} ${path} -> ${res.status}: ${(await res.text()).slice(0, 300)}`,\n );\n }\n return res.status === 204 ? null : res.json();\n}\n\nexport async function fetchRepoFile(\n token: string,\n repo: string,\n path: string,\n ref: string,\n): Promise {\n const encPath = path.split(\"/\").map(encodeURIComponent).join(\"/\");\n const res = await fetch(`${GH_API}/repos/${repo}/contents/${encPath}?ref=${ref}`, {\n headers: {\n Authorization: `Bearer ${token}`,\n Accept: \"application/vnd.github.raw+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`GitHub file ${repo}/${path}@${ref} -> ${res.status}`);\n return new Uint8Array(await res.arrayBuffer());\n}\n\nexport async function fetchRepoTree(token: string, repo: string, ref: string): Promise {\n const tree = await gh(token, `/repos/${repo}/git/trees/${encodeURIComponent(ref)}?recursive=1`);\n if (tree.truncated) throw new Error(\"Repo tree truncated - repo too large for full sync\");\n return tree.tree\n .filter((e: { type: string }) => e.type === \"blob\")\n .map((e: { path: string }) => e.path);\n}\n\nexport async function registerPushWebhook(token: string, repo: string, url: string, secret: string) {\n return await gh(token, `/repos/${repo}/hooks`, {\n method: \"POST\",\n body: JSON.stringify({\n name: \"web\",\n active: true,\n events: [\"push\"],\n config: { url, content_type: \"json\", secret },\n }),\n });\n}\n\n// sha1(\"blob \\0\" + bytes) — git blob sha, computed locally for diffing\nexport async function gitBlobSha(bytes: Uint8Array): Promise {\n const header = new TextEncoder().encode(`blob ${bytes.length}\\0`);\n const buf = new Uint8Array(header.length + bytes.length);\n buf.set(header);\n buf.set(bytes, header.length);\n const digest = await crypto.subtle.digest(\"SHA-1\", buf);\n return [...new Uint8Array(digest)].map((b) => b.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\nexport function toBase64(bytes: Uint8Array): string {\n let bin = \"\";\n for (let i = 0; i < bytes.length; i += 0x8000) {\n bin += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n }\n return btoa(bin);\n}\n\nfunction b64url(input: string | Uint8Array): string {\n const bytes = typeof input === \"string\" ? new TextEncoder().encode(input) : input;\n let bin = \"\";\n for (const b of bytes) bin += String.fromCharCode(b);\n return btoa(bin).replaceAll(\"+\", \"-\").replaceAll(\"/\", \"_\").replace(/=+$/, \"\");\n}\n\n// GitHub App JWT. The manifest-conversion pem is PKCS#1; node:crypto accepts it as-is.\nexport function appJwt(appId: number | string, pem: string): string {\n const nowSec = Math.floor(Date.now() / 1000);\n const header = b64url(JSON.stringify({ alg: \"RS256\", typ: \"JWT\" }));\n const payload = b64url(JSON.stringify({ iat: nowSec - 60, exp: nowSec + 540, iss: String(appId) }));\n const signer = createSign(\"RSA-SHA256\");\n signer.update(`${header}.${payload}`);\n const sig = signer.sign(createPrivateKey(pem));\n return `${header}.${payload}.${b64url(new Uint8Array(sig))}`;\n}\n\nexport async function installationToken(\n app: { app_id: number; pem: string },\n installationId: number,\n): Promise {\n const jwt = appJwt(app.app_id, app.pem);\n const res = await fetch(`${GH_API}/app/installations/${installationId}/access_tokens`, {\n method: \"POST\",\n headers: {\n Authorization: `Bearer ${jwt}`,\n Accept: \"application/vnd.github+json\",\n \"User-Agent\": \"githubsync-val\",\n },\n });\n if (!res.ok) throw new Error(`installation token -> ${res.status}: ${await res.text()}`);\n return (await res.json()).token;\n}\n",[],[172,304],"257cc1a5-d5b2-4f01-9d08-dcb1e23bd659","creds.ts","d8b32ad6-66be-11f1-82b8-1607ee4eb77e",5,["D",1781310529049],"import { type Connection, getApp } from \"../db.ts\";\nimport { installationToken } from \"./github.ts\";\n\n// Secrets stored as \"env:NAME\" resolve from this val's environment at use time,\n// so dev-mode tokens never live in the database.\nexport function resolveSecret(v: string | null | undefined): string | undefined {\n if (!v) return undefined;\n return v.startsWith(\"env:\") ? Deno.env.get(v.slice(4)) : v;\n}\n\nexport function vtTokenFor(conn: Connection): string {\n const t = resolveSecret(conn.vt_token);\n if (!t) throw new Error(`connection ${conn.id}: missing Val Town token`);\n return t;\n}\n\nexport async function ghTokenFor(conn: Connection): Promise {\n const pat = resolveSecret(conn.gh_token);\n if (pat) return pat;\n if (conn.installation_id) {\n const app = await getApp();\n if (!app) throw new Error(\"no GitHub App registered\");\n return await installationToken(app, conn.installation_id);\n }\n throw new Error(`connection ${conn.id}: no GitHub credential`);\n}\n\nexport function devAuthorized(req: Request): boolean {\n const secret = Deno.env.get(\"DEV_SECRET\");\n return !!secret && req.headers.get(\"authorization\") === `Bearer ${secret}`;\n}\n",[],[172,311],["D",1781310508175],[188,189,190],[172],["D",1781310279766],["D",1789509672838],{"_99":98,"_106":102},{"_99":98,"_100":-5,"_101":102,"_18":54,"_103":104,"_105":24},{"_13":88,"_31":89,"_42":41,"_90":43,"_91":-5,"_92":-5,"_93":-5,"_94":-5,"_95":-5,"_96":44,"_97":98},"ctx",{"_81":-5,"_126":359,"_360":361,"_362":363,"_364":24,"_365":24,"_366":24,"_367":58,"_368":-5,"_369":-7,"_370":-7,"_371":62,"_372":24,"_373":24,"_374":-5,"_375":24,"_376":24,"_377":24,"_378":-5},"ENV",{"_330":331,"_332":333,"_334":89,"_335":336,"_337":338,"_339":340,"_341":342,"_343":344,"_345":346,"_347":348,"_349":350,"_351":352,"_353":354,"_355":356,"_357":358},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v15